Network scan, not root

[antamy]

Does this feature work when the server is started with systemd? I have created a user, upsnap, installed into /home/upsnap, ran the setcap command and started the application via systemd. I enter my network on the scan page, it goes off for a few seconds and finishes, but no results are shown. The page says you have to run as root to do this. I tried this running as root from the command line and the scan works, but even running as root from systemd does not work. Is there a trick to getting this installed as a service? My systemd file is:

[Unit]
Description=UpSnap WOL Service

[Service]
Type=simple
Restart=always
User=root
AmbientCapabilities = CAP_NET_BIND_SERVICE
CapabilityBoundingSet = CAP_NET_BIND_SERVICE
WorkingDirectory=/home/upsnap
ExecStart=/home/upsnap/upsnap serve --http=0.0.0.0:8090


[Install]
WantedBy=multi-user.target

[seriousm4x]

So a couple things here:

• To run upsnap as a systemd service, you don't need to use setcap in the first place. Just download the binary and let systemd handle the capabilities
• I see you used CAP_NET_BIND_SERVICE in your example, but this should be replaced with CAP_NET_RAW in both lines

Network scan will not work as a non-root user. Upsnap calls nmap under the hood which needs root privileges to find devices.
This is the systemd file I just put together. Swap out the user if you need network scan or not.

[Unit]
Description=A simple wake on lan web app written with SvelteKit, Go and PocketBase

[Service]
type=simple
Restart=always
User=root
ExecStart=/usr/bin/upsnap serve --http=0.0.0.0:8090
CapabilityBoundingSet=CAP_NET_RAW
AmbientCapabilities=CAP_NET_RAW

[Install]
WantedBy=multi-user.target

[antamy]

I tried this and had to make two modifications. (1) the service would fail to start due to permissions errors on the database in pb_data, so I had to chmod o=w on the two database files. (2) the service then failed to start due to operation not permitted, which I didn't really understand. But I changed to ExecStart=+/usr... and that fixed it. Network scan also then worked.