0

I am confused about this issue and the google search has limited information.

Some people say they need systemd v229 or higher to support it.

https://github.com/antoiner77/caddy-ansible/issues/31

The update log from Red Hat indicates that support has been available since RHEL 7.3.

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.3_release_notes/new_features_kernel

But this conflicts with my query results. Which statement is correct? Is there any way to confirm the actual support of the Ambient capabilities?

# systemctl --version
systemd 219
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN

# rpm -q centos-release
centos-release-7-6.1810.2.el7.centos.x86_64
  • The systemd AmbientCapabilities setting was indeed added in 229. The RedHat page says the kernel now supports ambient capabilities. It doesn't say anything about systemd. Is that what you're confused about? – muru Nov 6 at 9:58
  • "Some people say they need systemd v229 ..." what is the exact claim? Are you asking can you use ambient capabilities with systemd or in general via command line or programming API? – sebasth Nov 6 at 10:18
  • @muru Sorry, maybe I didn't express it clearly. I need to add AmbientCapabilities=CAP_NET_BIND_SERVICE to the .service file, but I'm not sure if this will work on centos 7.3 or higher. – Matthew Nov 6 at 11:20
  • @sebasth Sorry, maybe I didn't express it clearly. I need to add AmbientCapabilities=CAP_NET_BIND_SERVICE to the .service file, but I'm not sure if this will work on centos 7.3 or higher. – Matthew Nov 6 at 11:21
  • 1
    You need support in both, and you have support in the kernel. So if you want to use AmbientCapabilities=CAP_NET_BIND_SERVICE, a systemd update is also needed. – muru Nov 6 at 12:16
2

Ambient capabilities is a Linux kernel feature that is available via Linux user-space API. This is what RHEL7.3 release note refer to.

User-space programs also need to have the support for ambient capabilities. AmbientCapabilities systemd feature is available since systemd v229, which is newer than the version installed on your system.

  • This shows that centos 7 can't currently use AmbientCapabilities=CAP_NET_BIND_SERVICE in systemd, right? The systemd version in centos 7 stays at 219. – Matthew Nov 6 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.