Bug 1381057

Summary:	Unable to merge capabilities using drop in configuration
Product:	Red Hat Enterprise Linux 7	Reporter:	M. Scherer <mscherer>
Component:	systemd	Assignee:	systemd-maint
Status:	CLOSED DUPLICATE	QA Contact:	qe-baseos-daemons
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	bblaskov, jsynacek, systemd-maint-list
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-03 16:34:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1383699, 1393867, 1400961

Description M. Scherer 2016-10-02 19:11:25 UTC

Description of problem:
As seen while trying to work around https://bugzilla.redhat.com/show_bug.cgi?id=1380682 , systemd reset capabilities to 0 rather than merging them.

Version-Release number of selected component (if applicable):
$ rpm -q systemd
systemd-219-19.el7_2.13.x86_64

How reproducible:
each time

Steps to Reproduce:
1. install tor
2. add a file fix_rh_1375369.conf to /etc/systemd/system/tor.service.d/ with the following content:
[Service]
CapabilityBoundingSet=CAP_DAC_READ_SEARCH

3. systemctl daemon-reload
4.  systemctl show tor.service |grep -i cap


Actual results:

CapabilityBoundingSet=0

Expected results:
CapabilityBoundingSet=1220
(or at least, something which is not '0')

Additional info:

https://github.com/systemd/systemd/issues/1221 is quite similar, and both

b9d345b53ff0ee402c9dceee1bc14bf0d8907706 and 661b37b05be6720dc8678ba44ed6b321679aa260 might be the fixes

Comment 2 Lukáš Nykrýn 2016-10-04 13:10:43 UTC

Definitely something we should check during 7.4 development.

Comment 3 Lukáš Nykrýn 2017-01-03 16:34:36 UTC


*** This bug has been marked as a duplicate of bug 1409586 ***