Bug 1381057 - Unable to merge capabilities using drop in configuration
Summary: Unable to merge capabilities using drop in configuration
Keywords:
Status: CLOSED DUPLICATE of bug 1409586
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: systemd-maint
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks: 74systemd 1393867 1400961
TreeView+ depends on / blocked
 
Reported: 2016-10-02 19:11 UTC by M. Scherer
Modified: 2017-01-03 16:34 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-03 16:34:36 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description M. Scherer 2016-10-02 19:11:25 UTC 
Description of problem:
As seen while trying to work around https://bugzilla.redhat.com/show_bug.cgi?id=1380682 , systemd reset capabilities to 0 rather than merging them.

Version-Release number of selected component (if applicable):
$ rpm -q systemd
systemd-219-19.el7_2.13.x86_64

How reproducible:
each time

Steps to Reproduce:
1. install tor
2. add a file fix_rh_1375369.conf to /etc/systemd/system/tor.service.d/ with the following content:
[Service]
CapabilityBoundingSet=CAP_DAC_READ_SEARCH

3. systemctl daemon-reload
4.  systemctl show tor.service |grep -i cap


Actual results:

CapabilityBoundingSet=0

Expected results:
CapabilityBoundingSet=1220
(or at least, something which is not '0')

Additional info:

https://github.com/systemd/systemd/issues/1221 is quite similar, and both

b9d345b53ff0ee402c9dceee1bc14bf0d8907706 and 661b37b05be6720dc8678ba44ed6b321679aa260 might be the fixes
Comment 2 Lukáš Nykrýn 2016-10-04 13:10:43 UTC 
Definitely something we should check during 7.4 development.
Comment 3 Lukáš Nykrýn 2017-01-03 16:34:36 UTC 

*** This bug has been marked as a duplicate of bug 1409586 ***
Note You need to log in before you can comment on or make changes to this bug.