Description of problem:
Hi,

I'm trying to override the CapabilityBoundingSet in a drop-in file but that doesn't seems to work. The upstream .service file is cleaning the set completely (CapabilityBoundingSet=) and in the drop-in file I'm trying to grant CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN

Version-Release number of selected component (if applicable):
systemd-219-30.el7_3.6.x86_64

# systemctl cat collectd.service 
# /usr/lib/systemd/system/collectd.service
[Unit]
Description=Collectd statistics daemon
Documentation=man:collectd(1) man:collectd.conf(5)
After=local-fs.target network-online.target
Requires=local-fs.target network-online.target

[Service]
ExecStart=/usr/sbin/collectd
EnvironmentFile=-/etc/sysconfig/collectd
EnvironmentFile=-/etc/default/collectd
ProtectSystem=full
ProtectHome=true

# A few plugins won't work without some privileges, which you'll have to
# specify using the CapabilityBoundingSet directive below.
#
# Here's a (incomplete) list of the plugins known capability requirements:
#   ceph            CAP_DAC_OVERRIDE
#   dns             CAP_NET_RAW
#   exec            CAP_SETUID CAP_SETGID
#   iptables        CAP_NET_ADMIN
#   ping            CAP_NET_RAW
#   turbostat       CAP_SYS_RAWIO
#
# Example, if you use the iptables plugin alongside the dns or ping plugin:
#CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN
#
# By default, drop all capabilities:
CapabilityBoundingSet=

NoNewPrivileges=true

# Tell systemd it will receive a notification from collectd over it's control
# socket once the daemon is ready. See systemd.service(5) for more details.
Type=notify

# Restart the collectd daemon when it fails.
Restart=on-failure

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/collectd.service.d/capabilities.conf
[Service]

CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN

==========

# systemctl show -p CapabilityBoundingSet collectd.service 
CapabilityBoundingSet=0

==========


Somebody confirmed on IRC that it was working on Arch with version 232