From a8cd1af78da0277767c242a12365a2efd4c5c41b Mon Sep 17 00:00:00 2001
From: ppom <reaction@ppom.me>
Date: Thu, 12 Feb 2026 12:00:00 +0100
Subject: [PATCH] Set CapabiltyBoundingSet again

---
 src/concepts/plugin.rs             | 3 ++-
 tests/test-conf/test-ipset.jsonnet | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/concepts/plugin.rs b/src/concepts/plugin.rs
index 204f6f2..c5bc330 100644
--- a/src/concepts/plugin.rs
+++ b/src/concepts/plugin.rs
@@ -53,6 +53,8 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
             // Various Protections
             ("LockPersonality", vec!["true"]),
             ("NoNewPrivileges", vec!["true"]),
+            ("AmbientCapabilities", vec![""]),
+            ("CapabilityBoundingSet", vec![""]),
             // Isolate File
             ("RemoveIPC", vec!["true"]),
             ("RestrictNamespaces", vec!["true"]),
@@ -67,7 +69,6 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
             // ("DynamicUser", vec!["true"]),
             // ("User", vec!["reaction-plugin-test"]),
             // Too restrictive
-            // ("CapabilityBoundingSet", vec![""]),
             // ("NoExecPaths", vec!["/"]),
             // ("RestrictAddressFamilies", vec![""]),
         ]
diff --git a/tests/test-conf/test-ipset.jsonnet b/tests/test-conf/test-ipset.jsonnet
index 02df038..13c4c21 100644
--- a/tests/test-conf/test-ipset.jsonnet
+++ b/tests/test-conf/test-ipset.jsonnet
@@ -13,7 +13,7 @@
       path: './target/debug/reaction-plugin-ipset',
       check_root: false,
       systemd_options: {
-        AmbientCapabilities: ['CAP_NET_ADMIN'],
+        CapabilityBoundingSet: ['~CAP_NET_ADMIN', '~CAP_PERFMON'],
       },
     },
   },