Re: --user specified but lacking CAP_SETPCAP

On 27/10/2023 15:25, Gert Doering wrote:
> 
>> Systemd doesn't "mess with OpenVPN".
> 
> If it takes away capabilities OpenVPN needs, how would you call it, then?
> 
> "Sabotage"?
Incorrect setup actually.  Or a bug.  Depending on if the missing 
capabilities is due to a local user's change in the openvpn-{client, 
server}@.service unit files provided by the OpenVPN project or 
distribution packaging, or using some other unit files from elsewhere.

The 2.6 release should contain this for the -client variant:

    CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW \
                          CAP_SETGID CAP_SETUID CAP_SETPCAP      \
                          CAP_SYS_CHROOT CAP_DAC_OVERRIDE


The -server variant is a bit more comprehensive:

    CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN        \
                          CAP_NET_BIND_SERVICE CAP_NET_RAW  \
                          CAP_SETGID CAP_SETUID CAP_SETPCAP \
                          CAP_SYS_CHROOT CAP_DAC_OVERRIDE   \
                          CAP_AUDIT_WRITE

If the list of capabilities here is not what a user having issues have, 
it would be a configuration error on the same level as using --user 
foobar in the config and not having created this user account in 
advance.  It would fail starting up.

Since this was related to the error message below:

   --user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN.
   Disabling data channel offload

This indicates that either the unit file in use is incorrect.  Or that 
there is a bug in the OpenVPN code dropping privileges.  Since I have a 
2.6 server running with DCO on RHEL-8.8, I have a feeling it's an 
incorrect unit file.  How that unit file ended up being wrong is hard 
for me to say.

Runing this command should provide a reasonably readable list of 
capabilities in use in the -server unit file:

   # systemctl cat [email protected] \
        | grep CapabilityBoundingSet= | tr ' ' '\n'


This can be specified further adding the config file in use in the line 
above; or change -server with -client if it's a client config in play.


-- 
kind regards,

David Sommerseth
OpenVPN Inc