* I don't think that inspecting a masked service was ever supposed to work.
But shouldn’t it give consistent results (error?) then? Kind regards, Ulrich Windl From: systemd-devel <[email protected]> On Behalf Of Mantas Mikulenas Sent: Monday, May 25, 2026 10:54 AM To: Leo Rydh <[email protected]> Cc: [email protected] Subject: [EXT] Re: [systemd-devel] Getting Capabilities of a masked service "Masked" means systemd pretends that the unit outright does not exist. (See the 'LoadError=' field in your systemctl show output.) So it does not actually load any of the unit's parameters and reports only the generic defaults. I'm guessing the unit might still have been loaded after masking when you were running 257.8 but was flushed when exec'ing systemd 257.13... either way, I don't think that inspecting a masked service was ever supposed to work. On 20/05/2026 15.29, Leo Rydh wrote: Hi, I had some "issues?" where, when upgrading systemd from 1.257.8 to 1.257.13 I get different capabilities when I try to find out the capabilities of a service. Note as that the service is masked. I read trough some of the release notes and could not really find anything documenting this, so I was unsure if I should create an Issue, or if there is some reason for this change. How to reproduce: Using systemd 1.257.8 Mask a service and run something like: systemctl show my-service | grep -E '^User=|^Group=|^CapabilityBoundingSet=|^PrivateNetwork=|^AmbientCapabilities=|^DynamicUser=' Then do the same thing but when running systemd 1.257.13. When I do this I get the same capabilities masked and unmasked on 1.257.8, but when I switch to 1.257.13, I get additional network capabilities when trying on the masked service, but when the service is not masked, I get the "correct" capabilities. Please let me know if I should add further details or if I am in the wrong place or need to do anyhing differntly. Regards, Leo
