mirror of
https://github.com/syncthing/syncthing.git
synced 2026-03-24 17:21:56 -04:00
c4ff02def7
Syncthing docs in https://docs.syncthing.net/users/autostart.html#permissions tell the user to set `AmbientCapabilities=CAP_CHOWN CAP_FOWNER` if the user wishes to use the `syncOwnership` option. https://github.com/syncthing/syncthing/pull/10421 broke `syncOwnership` for users that followed that advice because the PR introduced `CapabilityBoundingSet=` which cancels out any additional capabilities granted with `AmbientCapabilities`. (`AmbientCapabilities` _adds_ capabilities; `CapabilityBoundingSet` _limits_ maximum capabilities to the specified set. Setting `CapabilityBoundingSet` to an empty list prevents any capabilities from being acquired in any way.) This PR fixes the breakage by explicitly setting CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER This does _not_ grant any additional access rights to syncthing if the user is not explicitly setting `AmbientCapabilities` as well, but it does loosen the sandbox _a bit_. An attacker compromising the syncthing process could now more easily expand their access to include CAP_CHOWN/CAP_FOWNER even if the user is not setting `AmbientCapabilities`. Signed-off-by: Val Markovic <val@markovic.io>
Systemd Configuration
This directory contains configuration files for running Syncthing under the "systemd" service manager on Linux both under either a systemd system service or systemd user service. For further documentation take a look at the systemd section on https://docs.syncthing.net.