From 6e6ea3758d5560c4a10ff1bceb54a34677c6d399 Mon Sep 17 00:00:00 2001
From: Florian Preinstorfer <site-github@nblock.org>
Date: Sun, 21 Jun 2026 17:30:53 +0200
Subject: [PATCH] Remove CAP_CHOWN from systemd service

---
 packaging/systemd/headscale.service | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/packaging/systemd/headscale.service b/packaging/systemd/headscale.service
index 8a4ba47e..7f02c915 100644
--- a/packaging/systemd/headscale.service
+++ b/packaging/systemd/headscale.service
@@ -14,8 +14,8 @@ RestartSec=5
 WorkingDirectory=/var/lib/headscale
 ReadWritePaths=/var/lib/headscale
 
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 LockPersonality=true
 NoNewPrivileges=true
 PrivateDevices=true
@@ -41,7 +41,6 @@ RuntimeDirectoryMode=0750
 StateDirectory=headscale
 StateDirectoryMode=0750
 SystemCallArchitectures=native
-SystemCallFilter=@chown
 SystemCallFilter=@system-service
 SystemCallFilter=~@privileged
 UMask=0077