networkd: drop CAP_SYS_MODULE

Rely on modules being built-in or autoloaded on-demand.

As networkd is a network facing service, we want to limits its capabilities,
as much as possible. Also, we may not have CAP_SYS_MODULE in a container,
and we want networkd to work the same there.

Module autoloading does not always work, but should be fixed by the kernel
patch f98f89a0104454f35a: 'net: tunnels - enable module autoloading', which
is currently in net-next and which people may consider backporting if they
want tunneling support without compiling in the modules.

Early adopters may also use a module-load.d snippet and order
systemd-modules-load.service before networkd to force the module
loading of tunneling modules.

This sholud fix the various build issues people have reported.

1 files changed, 1 insertions, 2 deletions

diff --git a/src/network/networkd.c b/src/network/networkd.c
index cd7dd3ca0f..d8f31a490d 100644
--- a/src/network/networkd.c
+++ b/src/network/networkd.c
@@ -71,8 +71,7 @@ int main(int argc, char *argv[]) {
                             (1ULL << CAP_NET_ADMIN) |
                             (1ULL << CAP_NET_BIND_SERVICE) |
                             (1ULL << CAP_NET_BROADCAST) |
-                            (1ULL << CAP_NET_RAW) |
-                            (1ULL << CAP_SYS_MODULE));
+                            (1ULL << CAP_NET_RAW));
         if (r < 0)
                 goto out;