From 9b5146bc57977782259fe35c0600f560ebb1ce6b Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 19:12:10 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E9=BD=90Smail=E4=B8=BB=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1=E6=96=87=E4=BB=B6=E6=9D=83=E9=99=90=E8=83=BD=E5=8A=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/systemd/smail.service | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/systemd/smail.service b/deploy/systemd/smail.service
index 6c1ea25..6f951a0 100644
--- a/deploy/systemd/smail.service
+++ b/deploy/systemd/smail.service
@@ -33,9 +33,9 @@ RuntimeDirectoryMode=0750
 # 目录由 smail 进程拥有，允许主服务创建受保护的本机控制套接字。
 
 NoNewPrivileges=true
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
 # 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=full