systemd CAP_DAC_OVERRIDE possibly overkill

systemd unit claims:

# CAP_DAC_OVERRIDE To allow auth_pam_tool (which is SUID root) to read /etc/shadow when it's chmod 0

#   does nothing for non-root, not needed if /etc/shadow is u+r

It may be possible to reduce this to CAP_DAC_READ_SEARCH without breaking anything else, to prevent `SELECT INTO OUTFILE` from creating files in unexpected locations (those not prevented by ProtectSystem)