I have a service that I start using systemd. The service user and group are changed to a non-privileged user.
[Service] ... User=regular_user Group=regular_user ...
At some point the service needs to start another process, which is expected to become root. That other process has its 's' bit set and it uses
setuid() to become root.
The process works just fine if I start it. However, somehow, when the service tries to start it, the
setuid() function returns with an error:
Operation not permitted.
I've seen some options about capabilities, but I have no clue whether those are what needs to be used to keep the
setuid() capability working in my service. I tried a few things and none helped so far.
For example, I tried that:
AmbientCapabilities=CAP_SETGID CAP_SETUID SecureBits=keep-caps
And although the process does not seem to generate an error anymore, it still does not do what it is supposed to do (again, if I run that process in my console, it works just fine!)