=== modified file 'ubuntu/12.04/usr.sbin.unbound'
--- ubuntu/12.04/usr.sbin.unbound	2011-11-30 12:57:44 +0000
+++ ubuntu/12.04/usr.sbin.unbound	2011-11-30 21:51:24 +0000
@@ -11,14 +11,22 @@
   capability setuid,
   capability sys_chroot,
   capability sys_resource,
+  capability chown,
+  capability dac_override,
 
   # for networking
   owner @{PROC}/[0-9]*/net/if_inet6 r,
   owner @{PROC}/[0-9]*/net/ipv6_route r,
 
+  # unbound wants to mmap those files but that's not
+  # authorized in the nameservice abstraction
+  /etc/passwd rm,
+  /etc/group rm,
+
   # non-chrooted paths
   /etc/unbound/** r,
   owner /etc/unbound/*.key rw,
+  owner /var/lib/unbound/root.key rw,
   audit deny /etc/unbound/unbound_{control,server}.key w,
 
   # chrooted paths