Thanks. It was not evident from the example whether root inside of the sandbox is necessary - I assumed creating arbitrary symlinks doesn't require any particular capabilities, and there's nothing special about the locations.

Though it's not clear to me now:

- why was this patched then?

- is the point about root that non-root wouldn't have access to passwd anyway?