diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 9c6e863c7f..707cab28aa 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -925,11 +925,21 @@ inverted. Note that this option also affects the respective capabilities in the effective, permitted and inheritable capability sets. If this option is not used, the capability bounding set is not modified on process execution, hence no limits on the capabilities of the process are enforced. This option may appear more than - once, in which case the bounding sets are merged. If the empty string is assigned to this option, the bounding - set is reset to the empty capability set, and all prior settings have no effect. If set to - ~ (without any further argument), the bounding set is reset to the full set of available + once, in which case the bounding sets are merged by AND, or by OR + if the lines are prefixed with ~ (see below). If the empty string is assigned + to this option, the bounding set is reset to the empty capability set, and all prior settings have no effect. + If set to ~ (without any further argument), the bounding set is reset to the full set of available capabilities, also undoing any previous settings. This does not affect commands prefixed with - +. + +. + + Example: if a unit has the following, + CapabilityBoundingSet=CAP_A CAP_B +CapabilityBoundingSet=CAP_B CAP_C + then CAP_A, CAP_B, and CAP_C are set. + If the second line is prefixed with ~, e.g., + CapabilityBoundingSet=CAP_A CAP_B +CapabilityBoundingSet=~CAP_B CAP_C + then, only CAP_A is set. @@ -938,7 +948,8 @@ Controls which capabilities to include in the ambient capability set for the executed process. Takes a whitespace-separated list of capability names, e.g. CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_SYS_PTRACE. This option may appear more than - once in which case the ambient capability sets are merged. If the list of capabilities is prefixed with + once in which case the ambient capability sets are merged (see the above examples in + CapabilityBoundingSet=). If the list of capabilities is prefixed with ~, all but the listed capabilities will be included, the effect of the assignment inverted. If the empty string is assigned to this option, the ambient capability set is reset to the empty capability set, and all prior settings have no effect. If set to ~ (without any further