From 91e1cbb50d029a7e7ff69645d491a40d474c6d9b Mon Sep 17 00:00:00 2001 From: Maximiliano Sandoval Date: Thu, 16 Jul 2026 23:26:04 +0200 Subject: [PATCH 1/2] capability: Clarify what insecure memory means --- server/src/capability.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/server/src/capability.rs b/server/src/capability.rs index 4b6ebeaf..e7b84776 100644 --- a/server/src/capability.rs +++ b/server/src/capability.rs @@ -122,12 +122,14 @@ pub fn drop_unnecessary_capabilities() -> Result<(), rustix::io::Errno> { )?; } CapabilityState::None => { - tracing::warn!("No process capabilities, insecure memory might get used"); + tracing::warn!("No process capabilities, secrets in memory might be swapped to disk"); return Ok(()); } CapabilityState::Partial => { if !caps.effective.contains(CapabilitySet::IPC_LOCK) { - tracing::warn!("Insufficient process capabilities, insecure memory might get used"); + tracing::warn!( + "Missing IPC_LOCK capability, secrets in memory might be swapped to disk" + ); } // Clear bounding set if we have CAP_SETPCAP (do this before dropping caps) From abb93e86e3c9b8d0491f4d56191441c02d42596e Mon Sep 17 00:00:00 2001 From: Maximiliano Sandoval Date: Fri, 17 Jul 2026 18:26:49 +0200 Subject: [PATCH 2/2] capability: Add note for users & packagers --- server/src/capability.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/src/capability.rs b/server/src/capability.rs index e7b84776..c688d9d3 100644 --- a/server/src/capability.rs +++ b/server/src/capability.rs @@ -122,6 +122,9 @@ pub fn drop_unnecessary_capabilities() -> Result<(), rustix::io::Errno> { )?; } CapabilityState::None => { + // NOTE: For users that landed here. The binary is probably missing + // the CAP_IPC_LOCK capability which should have been set as part of + // packaging. See capabilities(7) and setcap(8) for more details. tracing::warn!("No process capabilities, secrets in memory might be swapped to disk"); return Ok(()); }