#1093126 systemd-homed: Ambient capabilities of a user are not set

Package:
systemd-homed
Source:
systemd-homed
Description:
home area manager
Submitter:
Manuel Traut
Date:
2025-01-15 12:06:02 UTC
Severity:
normal
#1093126#5
Date:
2025-01-15 12:01:38 UTC
From:
To:
I expected that setting CAP_SYSLOG as AmbientCapability for a user
is enough to allow the usage of dmesg.

root@iris:~# homectl create --capability-ambient-set=CAP_SYSLOG testuser
���� Please enter new password for user testuser: ������������������
���� Please enter new password for user testuser (repeat): ������������������
root@iris:~# exit
logout

testuser@iris:~$ dmesg
dmesg: read kernel buffer failed: Operation not permitted

The capability is reported properly:

testuser@iris:~$ homectl inspect testuser | grep Cap
Ambient Caps: cap_syslog

But not available in the users shell:

testuser@iris:~$ /usr/sbin/capsh --current
Current: =
Current IAB:

testuser@iris:~$ ps aux | grep testuser | grep bash
testuser     709  0.0  0.2   5696  4240 pts/1    Ss   11:48   0:00 -bash
testuser     723  0.0  0.0   3452  1736 pts/1    S+   11:51   0:00 grep bash

testuser@iris:~$ cat /proc/709/status | grep Cap
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 000001ffffffffff
CapAmb: 0000000000000000