I have a service that I start using systemd. The service user and group are changed to a non-privileged user.


At some point the service needs to start another process, which is expected to become root. That other process has its 's' bit set and it uses setuid() to become root.

The process works just fine if I start it. However, somehow, when the service tries to start it, the setuid() function returns with an error:

Operation not permitted.

I've seen some options about capabilities, but I have no clue whether those are what needs to be used to keep the setuid() capability working in my service. I tried a few things and none helped so far.

For example, I tried that:

AmbientCapabilities=CAP_SETGID CAP_SETUID

And although the process does not seem to generate an error anymore, it still does not do what it is supposed to do (again, if I run that process in my console, it works just fine!)

1 Answer 1


I actually found the NoNewPrivileges= option that allows my process children to use the setuid().

From what they are saying, it is certainly not an option one should lightly choose to use. However, the default is: do not allow the setuid() feature. (what they mean by «elevate privileges».)

What worked for me was to do this:


Note that the documentation does not clearly say that the default for this option is true on Ubuntu 16.04. This may vary depending on the OS.

  • On which OS and version was the default tested to be set to true? Oct 10, 2016 at 14:19
  • 1
    @MarkStosberg, I added the OS info in the answer. Oct 10, 2016 at 17:05
  • 2
    After I filled a bug report, the default value for this is now documented. It defaults to false for system services, but can be defaulted to true for user-managed services if certain other directives are set. Details are here: github.com/systemd/systemd/commit/… Oct 28, 2016 at 15:18
  • 1
    @MarkStosberg, thank you for fixing the docs. That's a big job for such a large project. Oct 28, 2016 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .