[Pkg-utopia-maintainers] Bug#1144853: network-manager: shared dnsmasq warns "chown of PID file failed: please add capability CAP_CHOWN"

[Landon Hendee]

Package: network-manager
Version: 1.52.1-1
Severity: minor

Dear Maintainer,

On an unmodified Debian 13.6 installation, activating a NetworkManager
connection with 802-11-wireless.mode=ap and ipv4.method=shared causes
NetworkManager's private dnsmasq process to log:

  dnsmasq: chown of PID file /run/nm-dnsmasq-wlp3s0.pid failed:
  please add capability CAP_CHOWN

The hotspot otherwise works: dnsmasq listens for DNS and DHCP and
successfully issues leases.

The stock NetworkManager systemd unit contains:

  CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW
  CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE
  CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT

CAP_CHOWN is not included. There are no local NetworkManager systemd
drop-ins, no custom files in /etc/NetworkManager/dnsmasq-shared.d, and
no relevant AppArmor denial.

Steps to reproduce:

1. Configure a Wi-Fi connection in AP mode with ipv4.method=shared.
2. Activate it or reboot with connection.autoconnect enabled.
3. Inspect the NetworkManager journal.

Expected result:

NetworkManager's supported shared-connection configuration starts
dnsmasq without a missing-capability warning, either by handling the
PID-file ownership consistently with the service capability set or by
otherwise avoiding the unsupported ownership operation.

Actual result:

dnsmasq emits the CAP_CHOWN warning once during startup.

Impact:

No functional DHCP or DNS failure has been observed, so this report is
filed with minor severity. The warning is nevertheless produced by the
stock package configuration and looks actionable to users.

Package versions:

  network-manager 1.52.1-1
  dnsmasq-base 2.91-1+deb13u1
  systemd 257.13-1~deb13u1
  Debian 13.6
  Linux 6.12.101+deb13-amd64

Please reassign this report to dnsmasq if that is the more appropriate
package.


-- System Information:
Debian Release: 13.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.101+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages network-manager depends on:
ii  adduser                         3.152
ii  dbus [default-dbus-system-bus]  1.16.2-2
ii  libaudit1                       1:4.0.2-2+b2
ii  libbluetooth3                   5.82-1.1
ii  libc6                           2.41-12+deb13u3
ii  libcurl3t64-gnutls              8.14.1-2+deb13u4
ii  libglib2.0-0t64                 2.84.4-3~deb13u3
ii  libgnutls30t64                  3.8.9-3+deb13u4
ii  libjansson4                     2.14-2+b3
ii  libmm-glib0                     1.24.0-1+deb13u1
ii  libndp0                         1.9-1+b1
ii  libnewt0.52                     0.52.25-1
ii  libnm0                          1.52.1-1
ii  libpsl5t64                      0.21.2-1.1+b1
ii  libreadline8t64                 8.2-6
ii  libselinux1                     3.8.1-1
ii  libsystemd0                     257.13-1~deb13u1
ii  libteamdctl0                    1.31-1+b2
ii  libudev1                        257.13-1~deb13u1

Versions of packages network-manager recommends:
ii  dnsmasq-base [dnsmasq-base]  2.91-1+deb13u1
ii  libpam-systemd               257.13-1~deb13u1
ii  modemmanager                 1.24.0-1+deb13u1
ii  network-manager-l10n         1.52.1-1
ii  polkitd                      126-2
ii  ppp                          2.5.2-1+1
ii  udev                         257.13-1~deb13u1
ii  wireless-regdb               2026.05.30-1~deb13u1
ii  wpasupplicant                2:2.10-24

Versions of packages network-manager suggests:
ii  iptables       1.8.11-2
pn  libteam-utils  <none>

Versions of packages network-manager is related to:
pn  isc-dhcp-client  <none>