CAP_NET_ADMIN

[Mathew Heard]

Hi All,

I am stuck trying to get my nginx service which is launched via
SystemD to give CAP_NET_ADMIN to its workers (required for
IP_TRANSPARENT).

I have tried /etc/security/capability.conf & setcap. SystemD has the
permission whitelisted:

CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
CAP_SYS_RESOURCE CAP_SETGID CAP_SETUID
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
CAP_SYS_RESOURCE CAP_SETGID CAP_SETUID

Any advice?

Regards,
Mathew