fail2ban...
 

Fail2ban seems to lack the next

---8<---
module fail2ban-nb 1.0;

require {
type fail2ban_t;
class capability dac_override;
}

#============= fail2ban_t ==============
allow fail2ban_t self:capability dac_override;