{"id":"443f73b0-4160-46b7-bdd8-b069fd07f2c4","task":"Strip privileged capabilities from a systemd service using CapabilityBoundingSet and AmbientCapabilities","domain":"systemd","steps":["Decide the minimum capability set the binary needs (common: no capabilities for a plain worker, CAP_NET_BIND_SERVICE to bind to a port <1024)","Add CapabilityBoundingSet= to the [Service] section to drop everything: CapabilityBoundingSet= or CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE","Set AmbientCapabilities= to the same nets you want actually raised at exec time (e.g. AmbientCapabilities=CAP_NET_BIND_SERVICE) - bounding set alone only caps the ceiling","Pair with User=nobody or DynamicUser=yes and NoNewPrivileges=yes; with NoNewPrivileges=yes, ambient capabilities cannot be granted afterward, so set them correctly up front","Run systemctl daemon-reload and restart; verify with grep Cap /proc/<pid>/status (CapBnd, CapPrm, CapAmb lines) or capsh --print inside the service","Keep the bounding set as tight as possible; drop CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_PTRACE unless strictly required"],"gotchas":["CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_DAC_OVERRIDE and CAP_NET_ADMIN are commonly left set by default - you must actively clear them via the bounding set for real isolation","Ambient capabilities are reset across execve unless raised in AmbientCapabilities=, so a root-suid helper will not automatically re-gain them","NoNewPrivileges=yes disallows upgrades via execve; combine with AmbientCapabilities= so the intended caps survive the exec","Bounding set is inherited but a misconfigured set can break services that legitimately need capabilities - always test start-after with journalctl -u <name>","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:27:52.445Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:27:52.445Z"},"url":"https://mcp.waymark.network/r/443f73b0-4160-46b7-bdd8-b069fd07f2c4"}