From e4fb83d697bcb4b76dd2c20fff95e66970cffb1e Mon Sep 17 00:00:00 2001 From: everyx Date: Sat, 26 Nov 2022 09:51:52 +0800 Subject: [PATCH] fix: systemd service caps for process sniffing Add capabilities for process name/path sniffing feature. --- release/config/sing-box.service | 4 ++-- release/config/sing-box@.service | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/release/config/sing-box.service b/release/config/sing-box.service index 707efe5d..16ca0a32 100644 --- a/release/config/sing-box.service +++ b/release/config/sing-box.service @@ -5,8 +5,8 @@ After=network.target nss-lookup.target [Service] WorkingDirectory=/var/lib/sing-box -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH ExecStart=/usr/bin/sing-box run -c /etc/sing-box/config.json Restart=on-failure RestartSec=10s diff --git a/release/config/sing-box@.service b/release/config/sing-box@.service index d6292a04..44925767 100644 --- a/release/config/sing-box@.service +++ b/release/config/sing-box@.service @@ -5,8 +5,8 @@ After=network.target nss-lookup.target [Service] WorkingDirectory=/var/lib/sing-box-%i -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH ExecStart=/usr/bin/sing-box run -c /etc/sing-box/%i.json Restart=on-failure RestartSec=10s