> nobody would want to deal with the resulting thousands/millions of little group tags But... you have to? You can hide it behind polkit or ACLs or capabilitie

> nobody would want to deal with the resulting thousands/millions of little group tags But... you have to? You can hide it behind polkit or ACLs or capabilities or whatever but you still have to actually specify the logic. It's something I'm still annoyed about as we port a realtime application to rtkit: it's the exact same limits you used to have to establish in /etc/limits.conf but now they're in a different place. That doesn't actually simplify anything; you still have to establish the same limits.