"Masked" means systemd pretends that the unit outright does not exist.
(See the 'LoadError=' field in your systemctl show output.) So it does
not actually load any of the unit's parameters and reports only the
generic defaults. I'm guessing the unit might still have been loaded
after masking when you were running 257.8 but was flushed when exec'ing
systemd 257.13... either way, I don't think that inspecting a masked
service was ever supposed to work.
On 20/05/2026 15.29, Leo Rydh wrote:
Hi,
I had some "issues?" where, when upgrading systemd from 1.257.8 to
1.257.13 I get different capabilities when I try to find out the
capabilities of a service. Note as that the service is masked. I read
trough some of the release notes and could not really find anything
documenting this, so I was unsure if I should create an Issue, or if
there is some reason for this change.
How to reproduce:
Using systemd 1.257.8
Mask a service and run something like:
systemctl show my-service | grep
-E'^User=|^Group=|^CapabilityBoundingSet=|^PrivateNetwork=|^AmbientCapabilities=|^DynamicUser='
Then do the same thing but when running systemd 1.257.13.
When I do this I get the same capabilities masked and unmasked on
1.257.8, but when I switch to 1.257.13, I get additional network
capabilities when trying on the masked service, but when the service
is not masked, I get the "correct" capabilities.
Please let me know if I should add further details or if I am in the
wrong place or need to do anyhing differntly.
Regards,
Leo
