pam: pam clients need cap_dac_override for pam_faillock
pam: pam clients need cap_dac_override for pam_faillock

/run/faillock/.* files are owned by unprivuser with 0600 and root needs to write records to it

DefenSec/dssp2-standard