From fa54516f8c51635972f3375326a97609f92de4cc Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 22 Jul 2026 09:09:25 +0100 Subject: [PATCH] Explain the missing CAP_NET_RAW grant when ICMP probes are blocked In-place updates never rewrite the systemd unit, so installs upgraded past v6.1.0-rc.1 keep a unit without AmbientCapabilities=CAP_NET_RAW and every ICMP probe fails with ping's raw stderr. Detect the capability failure and point at the unit and its fix instead (#1554). --- internal/monitoring/availability_poller.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/monitoring/availability_poller.go b/internal/monitoring/availability_poller.go index e8598834a..7320d8e14 100644 --- a/internal/monitoring/availability_poller.go +++ b/internal/monitoring/availability_poller.go @@ -453,6 +453,12 @@ func probeICMP(ctx context.Context, target config.AvailabilityTarget) error { if details == "" { return fmt.Errorf("icmp probe failed: %w", err) } + // Units written before v6.1.0-rc.1 lack AmbientCapabilities=CAP_NET_RAW and + // in-place updates never rewrite the unit, so ping fails like this on every + // upgraded install (#1554). Point at the unit instead of echoing ping stderr. + if strings.Contains(details, "Operation not permitted") || strings.Contains(details, "cap_net_raw") { + return fmt.Errorf("icmp probe blocked. The Pulse service unit does not grant CAP_NET_RAW, so ping cannot open a socket. Re-run the Pulse installer to regenerate the unit, or add a systemd override with AmbientCapabilities=CAP_NET_RAW and CapabilityBoundingSet=CAP_NET_RAW, then restart the service") + } if len(details) > 240 { details = details[:240] }