Remove CAP_DAC_OVERRIDE, CAP_CHOWN, CAP_FOWNER from systemd unit files

Remove CAP_DAC_OVERRIDE, CAP_CHOWN, CAP_FOWNER from the systemd service files'
CapabilityBoundingSet.  We may no longer need them.  The upstream changelog
says that Tor changed some logic with 0.2.8.1-alpha that made CAP_CHOWN
CAP_FOWNER no longer needed.

debian/changelog

+tor (0.2.8.10-2) UNRELEASED; urgency=medium
+
+  * Remove CAP_DAC_OVERRIDE, CAP_CHOWN, CAP_FOWNER from the systemd service
+    files' CapabilityBoundingSet.  We may no longer need them.  The upstream
+    changelog says that Tor changed some logic with 0.2.8.1-alpha that made
+    CAP_CHOWN CAP_FOWNER no longer needed.
+
+ -- Peter Palfrader <weasel@debian.org>  Thu, 08 Dec 2016 16:32:55 +0100
+
 tor (0.2.8.10-1) unstable; urgency=medium
 
   * New upstream version.

debian/systemd/tor@.service

@@ -29,7 +29,7 @@ ProtectSystem=full
 ReadOnlyDirectories=/
 ReadWriteDirectories=-/var/lib/tor-instances
 ReadWriteDirectories=-/var/run
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE
 
 [Install]
 WantedBy=multi-user.target

debian/systemd/tor@default.service

@@ -31,4 +31,4 @@ ReadWriteDirectories=-/proc
 ReadWriteDirectories=-/var/lib/tor
 ReadWriteDirectories=-/var/log/tor
 ReadWriteDirectories=-/var/run
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER
+CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE