<div dir="ltr" class="gmail_msg">CapabilityBoundingSet is the exact opposite of what you need, then. It's the *bounding set*, it limits capabilities.</div><span>
</span><div><br></div><div>With recent kernels, you'll probably want AmbientCapabilities= as the simplest option. (Can't remember when that was introduced though.)</div><div><br></div><div>With older kernels you'll have to use the older Capabilities= setting *and* set file capabilities (setcap) on the executable itself.</div><div><br></div><div>(<span style="font-size:13px">Well, depending on what file caps you set you might not even need any systemd settings at all... See e.g. "getcap /sbin/ping" as a fully standalone example, iirc it uses "cap_foo=eip" for this.)</span></div><br class="gmail_msg"><div class="gmail_quote gmail_msg"><div dir="ltr" class="gmail_msg">On Wed, Mar 1, 2017, 00:40 Ian Pilcher <<a href="mailto:arequipeno@gmail.com" class="gmail_msg" target="_blank">arequipeno@gmail.com</a>> wrote:<br class="gmail_msg"></div><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Does anyone know of a "howto" or similar that lists the steps that I<br class="gmail_msg">
need to take to run a service as a non-root user (nobody) with<br class="gmail_msg">
CAP_NET_RAW?<br class="gmail_msg">
<br class="gmail_msg">
I've tried adding CapabilityBoundingSet=CAP_NET_RAW to the [Service]<br class="gmail_msg">
section of my unit file, but it doesn't appear to be working.<br class="gmail_msg">
<br class="gmail_msg">
What else do I need to do?<br class="gmail_msg">
<br class="gmail_msg">
Thanks!<br class="gmail_msg">
<br class="gmail_msg">
--<br class="gmail_msg">
========================================================================<br class="gmail_msg">
Ian Pilcher <a href="mailto:arequipeno@gmail.com" class="gmail_msg" target="_blank">arequipeno@gmail.com</a><br class="gmail_msg">
-------- "I grew up before Mark Zuckerberg invented friendship" --------<br class="gmail_msg">
========================================================================<br class="gmail_msg">
<br class="gmail_msg">
_______________________________________________<br class="gmail_msg">
systemd-devel mailing list<br class="gmail_msg">
<a href="mailto:systemd-devel@lists.freedesktop.org" class="gmail_msg" target="_blank">systemd-devel@lists.freedesktop.org</a><br class="gmail_msg">
<a href="https://lists.freedesktop.org/mailman/listinfo/systemd-devel" rel="noreferrer" class="gmail_msg" target="_blank">https://lists.freedesktop.org/mailman/listinfo/systemd-devel</a><br class="gmail_msg">
</blockquote></div><div dir="ltr">-- <br></div><div data-smartmail="gmail_signature"><p dir="ltr">Mantas Mikulėnas <<a href="mailto:grawity@gmail.com">grawity@gmail.com</a>><br>
Sent from my phone</p>
</div>