From aed52e4d71c5b54b60c75fa2713a427dab606df8 Mon Sep 17 00:00:00 2001
From: Alexey <247128645+axkurcom@users.noreply.github.com>
Date: Tue, 13 Oct 2026 21:34:39 +0300
Subject: [PATCH] Update install.sh #940

---
 install.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index a0b1714..87fbe92 100644
--- a/install.sh
+++ b/install.sh
@@ -558,7 +558,9 @@ install_binary() {
 
     $SUDO sh -c '[ -x "$1" ]' _ "$bin_dst" || die "$L_ERR_BIN_EXEC $bin_dst"
 
-    if command -v setcap >/dev/null 2>&1; then
+    # File capabilities clear systemd's ambient set and leave firewall helpers unprivileged.
+    # The replaced binary must inherit its capabilities from the service unit instead.
+    if [ "$(get_svc_mgr)" != "systemd" ] && command -v setcap >/dev/null 2>&1; then
         $SUDO setcap cap_net_bind_service,cap_net_admin=+ep "$bin_dst" 2>/dev/null || true
     fi
 }