Clarify CAPABILITIES exec error "Invalid argument"

[mestaritonttu]

Submission type

• Request for enhancement (RFE)

systemd version the issue has been seen with

229-232

Used distribution

Arch Linux

This is similar to #4959

Using the service file for Caddy webserver, if I uncomment AmbientCapabilities=CAP_NET_BIND_SERVICE I get Failed at step CAPABILITIES spawning /usr/bin/caddy: Invalid argument.

Same is observed with this test service:

[Service]
ExecStart=/sbin/capsh --print
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
User=nobody

Would be great to have a more detailed error appear in journal.

[jnpkrn]

It would be helpful if the log was more detailed about what call
or action failed in particular. At least I wished there was a bigger
verbosity when finding a root cause of
https://bugzilla.redhat.com/show_bug.cgi?id=1412165
which turned out to be SELinux (or rather selinux-policy) issue,
unfortunate decision to make respective rules dontaudit did not
exactly help there.

[mestaritonttu]

By the way, I did an strace and this is the exact error:
prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0) = -1 EINVAL (Invalid argument)
.. and I still have no idea of the cause