Created separate PR https://github.com/openSUSE/permissions/pull/25 where adding capability only for clockdiff. Matthias, thanks for handling the audit.