DESCRIPTION When running KWin as a standalone Wayland compositor via kwin_wayland_wrapper, KWin is leaking its ambient capabilities (specifically CAP_SYS_NICE) down to the child processes it spawns. This creates a critical environment breakage for unprivileged sandboxing tools like Bubblewrap (bwrap), which instantly terminate when they detect unexpected high-level ambient capabilities. STEPS TO REPRODUCE Launch a minimal Wayland session from a TTY using the wrapper: /usr/bin/kwin_wayland_wrapper --xwayland 'es-de --no-splash' Attempt to launch any application from within that session that relies on bwrap (e.g., Proton, umu-launcher, or Steam Linux Runtime). The child process instantly crashes. OBSERVED RESULT Capturing the stderr from the crashed child process reveals: pressure-vessel-wrap[772]: E: Child process exited with code 1: bwrap: Unexpected capabilities but not setuid, old file caps config? EXPECTED RESULT Child processes spawned by the wrapper should inherit a clean, unprivileged environment without KWin's elevated ambient capabilities. SOFTWARE/OS VERSIONS Operating System: Arch Linux KDE Plasma Version: 6.6.5 KDE Frameworks Version: 6.26.0 Qt Version: 6.11.1 ADDITIONAL INFORMATION Workaround Proof: If I manually strip the ambient capabilities before executing the frontend, the environment is sanitised and all bwrap containers launch perfectly: /usr/bin/kwin_wayland_wrapper --xwayland 'setpriv --ambient-caps="-all" es-de --no-splash' Testing Context: This was reproduced on a completely re-imaged, fresh, bare-metal installation to strictly rule out local system state corruption.
A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwin/-/merge_requests/9346
Git commit 95394f6399963e167ec88d1083475eca5818900e by Vlad Zahorodnii. Committed on 08/06/2026 at 08:42. Pushed by vladz into branch 'master'. Lower ambient CAP_SYS_NICE To avoid leaking it to child processes. M +11 -0 src/main_wayland.cpp https://invent.kde.org/plasma/kwin/-/commit/95394f6399963e167ec88d1083475eca5818900e
Git commit db76e66fb97713aaecec4a6b03eb00c24d60dad0 by Vlad Zahorodnii. Committed on 08/06/2026 at 10:42. Pushed by vladz into branch 'Plasma/6.7'. Lower ambient CAP_SYS_NICE To avoid leaking it to child processes. (cherry picked from commit 95394f6399963e167ec88d1083475eca5818900e) Co-authored-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org> M +11 -0 src/main_wayland.cpp https://invent.kde.org/plasma/kwin/-/commit/db76e66fb97713aaecec4a6b03eb00c24d60dad0
Git commit 2f4b8c8a1303139f6985823d9ec72ff84f23b916 by Vlad Zahorodnii. Committed on 09/06/2026 at 12:53. Pushed by vladz into branch 'Plasma/6.6'. Lower ambient CAP_SYS_NICE To avoid leaking it to child processes. (cherry picked from commit 95394f6399963e167ec88d1083475eca5818900e) Co-authored-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org> M +11 -0 src/main_wayland.cpp https://invent.kde.org/plasma/kwin/-/commit/2f4b8c8a1303139f6985823d9ec72ff84f23b916