How do I run a process that wants to become root from a systemd service which is a regular user?

Question

I have a service that I start using systemd. The service user and group are changed to a non-privileged user.

[Service]
...
User=regular_user
Group=regular_user
...

At some point the service needs to start another process, which is expected to become root. That other process has its 's' bit set and it uses setuid() to become root.

The process works just fine if I start it. However, somehow, when the service tries to start it, the setuid() function returns with an error:

Operation not permitted.

I've seen some options about capabilities, but I have no clue whether those are what needs to be used to keep the setuid() capability working in my service. I tried a few things and none helped so far.

For example, I tried that:

AmbientCapabilities=CAP_SETGID CAP_SETUID
SecureBits=keep-caps

And although the process does not seem to generate an error anymore, it still does not do what it is supposed to do (again, if I run that process in my console, it works just fine!)

Answer 1

I actually found the NoNewPrivileges= option that allows my process children to use the setuid().

From what they are saying, it is certainly not an option one should lightly choose to use. However, the default is: do not allow the setuid() feature. (what they mean by «elevate privileges».)

What worked for me was to do this:

NoNewPrivileges=false

Note that the documentation does not clearly say that the default for this option is true on Ubuntu 16.04. This may vary depending on the OS.