From 9a49e60e28ffda4673edbcba393129c2dc69deb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20J=C3=A4ger?=
 <34212061+linus307@users.noreply.github.com>
Date: Mon, 6 Jul 2026 07:18:33 +0200
Subject: [PATCH] nixos/security.wrappers: include CAP_LAST_CAP when raising
 ambient capabilities

(cherry picked from commit dfba3a7bc1faf13a531e9f4249df3e93a25d228c)
---
 nixos/modules/security/wrappers/wrapper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c
index 6d0be0879440..c2fd8a02a193 100644
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@@ -116,7 +116,7 @@ static int make_caps_ambient(const char *self_path) {
         return 1;
     }
     uint64_t set = user_data[0].permitted | (uint64_t)user_data[1].permitted << 32;
-    for (unsigned cap = 0; cap < last_cap; cap++) {
+    for (unsigned cap = 0; cap <= last_cap; cap++) {
         if (!(set & (1ULL << cap))) {
             continue;
         }