---

   systemd.exec    ( 5 )

---

CAPABILITIES

These options are only available for system services and are not
       supported for services running in per-user instances of the
       service manager.

       CapabilityBoundingSet=
           Controls which capabilities to include in the capability
           bounding set for the executed process. See capabilities(7)
           for details. Takes a whitespace-separated list of capability
           names, e.g.  CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_SYS_PTRACE.
           Capabilities listed will be included in the bounding set, all
           others are removed. If the list of capabilities is prefixed
           with "~", all but the listed capabilities will be included,
           the effect of the assignment inverted. Note that this option
           also affects the respective capabilities in the effective,
           permitted and inheritable capability sets. If this option is
           not used, the capability bounding set is not modified on
           process execution, hence no limits on the capabilities of the
           process are enforced. This option may appear more than once,
           in which case the bounding sets are merged by OR, or by AND
           if the lines are prefixed with "~" (see below). If the empty
           string is assigned to this option, the bounding set is reset
           to the empty capability set, and all prior settings have no
           effect. If set to "~" (without any further argument), the
           bounding set is reset to the full set of available
           capabilities, also undoing any previous settings. This does
           not affect commands prefixed with "+".

           Use systemd-analyze(1)'s capability command to retrieve a
           list of capabilities defined on the local system.

           Example: if a unit has the following,

               CapabilityBoundingSet=CAP_A CAP_B
               CapabilityBoundingSet=CAP_B CAP_C

           then CAP_A, CAP_B, and CAP_C are set. If the second line is
           prefixed with "~", e.g.,

               CapabilityBoundingSet=CAP_A CAP_B
               CapabilityBoundingSet=~CAP_B CAP_C

           then, only CAP_A is set.

       AmbientCapabilities=
           Controls which capabilities to include in the ambient
           capability set for the executed process. Takes a
           whitespace-separated list of capability names, e.g.
           CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_SYS_PTRACE. This option
           may appear more than once in which case the ambient
           capability sets are merged (see the above examples in
           CapabilityBoundingSet=). If the list of capabilities is
           prefixed with "~", all but the listed capabilities will be
           included, the effect of the assignment inverted. If the empty
           string is assigned to this option, the ambient capability set
           is reset to the empty capability set, and all prior settings
           have no effect. If set to "~" (without any further argument),
           the ambient capability set is reset to the full set of
           available capabilities, also undoing any previous settings.
           Note that adding capabilities to ambient capability set adds
           them to the process's inherited capability set.

           Ambient capability sets are useful if you want to execute a
           process as a non-privileged user but still want to give it
           some capabilities. Note that in this case option keep-caps is
           automatically added to SecureBits= to retain the capabilities
           over the user change.  AmbientCapabilities= does not affect
           commands prefixed with "+".