From 60a1c678a0003d0cb1ac1a2261edc2408642dd52 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 18:57:00 +0800
Subject: [PATCH] =?UTF-8?q?=E5=90=AF=E7=94=A8Smail=E4=B8=BB=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1=E6=9D=83=E9=99=90=E8=B0=83=E6=95=B4=E8=83=BD=E5=8A=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/systemd/smail.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/systemd/smail.service b/deploy/systemd/smail.service
index ee5af50c..6c1ea255 100644
--- a/deploy/systemd/smail.service
+++ b/deploy/systemd/smail.service
@@ -33,7 +33,7 @@ RuntimeDirectoryMode=0750
 # 目录由 smail 进程拥有，允许主服务创建受保护的本机控制套接字。
 
 NoNewPrivileges=true
-AmbientCapabilities=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
 # 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
 PrivateTmp=true