I have a service that I start using systemd. The service user and group are changed to a non-privileged user.[Service]...User=regular_userGroup=regular_user...At some point the service needs to start another process, which is expected to become root. That other process has its 's' bit set and it uses setuid() to become root.The process works just fine if I start it. However, somehow, when the service tries to start it, the setuid() function returns with an error:Operation not permitted.I've seen some options about capabilities, but I have no clue whether those are what needs to be used to keep the setuid() capability working in my service. I tried a few things and none helped so far.For example, I tried that:AmbientCapabilities=CAP_SETGID CAP_SETUIDSecureBits=keep-capsAnd although the process does not seem to generate an error anymore, it still does not do what it is supposed to do (again, if I run that process in my console, it works just fine!)
How do I run a process that wants to become root from a systemd service which is a regular user?
systemd;services;setuid;capabilities