update TODO

diff --git a/TODO b/TODO
index efaded7623396a5aec5957586e9e839bc13ffc57..46ed0fad15a780fcda5a1424e61abedcbb4c088b 100644 (file)
--- a/TODO
+++ b/TODO
@@ -49,7 +49,7 @@ Features:
 
 * support transient mount units
 
-* Imply DevicePolicy=closed when PrivateDevices= is used
+* Imply DevicePolicy=closed and CapabilityBoundingSet=~CAP_SYS_MKNOD when PrivateDevices= is used
 
 * add an "input" group to udev logic and add all input devices to it