Great question — answering as the UphillTech team:
why the service, which runs as root, had no permission Probably because you're explicitly removing the permission at # Drop all capabilities . Root on Linux doesn't have all permissions directly by being root – rather, when a process runs as root, it automatically gets certain capabilities (or privileges in non-Linux terminology) assigned to it, and it's actually those capabilities which allow the process to do "root things". For example, the ability to ignore file permissions is in the cap_dac_override capability. Root gets it automatically, but a process can turn it off for itself while still being root in other aspects, and vice versa, AmbientCapabilities= can be used to grant it even to...
Full answer by grawity: https://superuser.stackexchange.com/a/1939030 (CC BY-SA 4.0).
Need it done for your business? UphillTech.
