LizardByte · ReenigneArcher · Jan 24, 2026 · Jan 23, 2026 · Jan 23, 2026 · Jan 23, 2026
diff --git a/cmake/packaging/linux.cmake b/cmake/packaging/linux.cmake
@@ -18,6 +18,8 @@ if(${SUNSHINE_BUILD_APPIMAGE} OR ${SUNSHINE_BUILD_FLATPAK})
             DESTINATION "${SUNSHINE_ASSETS_DIR}/modules-load.d")
     install(FILES "${CMAKE_CURRENT_BINARY_DIR}/sunshine.service"
             DESTINATION "${SUNSHINE_ASSETS_DIR}/systemd/user")
+    install(FILES "${CMAKE_CURRENT_BINARY_DIR}/sunshine-kms.service"
+            DESTINATION "${SUNSHINE_ASSETS_DIR}/systemd/user")
 else()
     find_package(Systemd)
     find_package(Udev)
@@ -29,6 +31,8 @@ else()
     if(SYSTEMD_FOUND)
         install(FILES "${CMAKE_CURRENT_BINARY_DIR}/sunshine.service"
                 DESTINATION "${SYSTEMD_USER_UNIT_INSTALL_DIR}")
+        install(FILES "${CMAKE_CURRENT_BINARY_DIR}/sunshine-kms.service"
+                DESTINATION "${SYSTEMD_USER_UNIT_INSTALL_DIR}")
         install(FILES "${SUNSHINE_SOURCE_ASSETS_DIR}/linux/misc/60-sunshine.conf"
                 DESTINATION "${SYSTEMD_MODULES_LOAD_DIR}")
     endif()
@@ -62,6 +66,10 @@ if(FREEBSD)
     list(APPEND CPACK_POST_BUILD_SCRIPTS "${CMAKE_MODULE_PATH}/packaging/freebsd_custom_cpack.cmake")
 endif()
 
+# Apply setcap for RPM
+# https://github.com/coreos/rpm-ostree/discussions/5036#discussioncomment-10291071
+set(CPACK_RPM_USER_FILELIST "%caps(cap_sys_admin+p) ${SUNSHINE_EXECUTABLE_PATH}")
+
 # Dependencies
 set(CPACK_DEB_COMPONENT_INSTALL ON)
 set(CPACK_DEBIAN_PACKAGE_DEPENDS "\

diff --git a/cmake/prep/special_package_configuration.cmake b/cmake/prep/special_package_configuration.cmake
@@ -26,6 +26,7 @@ elseif(UNIX)
 
     # configure service
     configure_file(packaging/linux/sunshine.service.in sunshine.service @ONLY)
+    configure_file(packaging/linux/sunshine-kms.service.in sunshine-kms.service @ONLY)
 
     # configure the arch linux pkgbuild
     if(${SUNSHINE_CONFIGURE_PKGBUILD})

diff --git a/docs/building.md b/docs/building.md
@@ -50,12 +50,12 @@ pkg install -y \
 #### Linux
 Dependencies vary depending on the distribution. You can reference our
 [linux_build.sh](https://github.com/LizardByte/Sunshine/blob/master/scripts/linux_build.sh) script for a list of
-dependencies we use in Debian-based, Fedora-based and Arch-based distributions. Please submit a PR if you would like to
-extend the script to support other distributions.
+dependencies we use in Debian-based, Fedora-based and Arch-based distributions. Please submit a PR if you would like to extend the
+script to support other distributions.
 
 ##### KMS Capture
-If you are using KMS, patching the Sunshine binary with `setcap` is required. Some post-install scripts handle this.
-If building from source and using the binary directly, this will also work:
+If you are using KMS, patching the Sunshine binary with `setcap` is required. Some post-install scripts handle this. If building
+from source and using the binary directly, this will also work:
 
 ```bash
 sudo cp build/sunshine /tmp

diff --git a/docs/getting_started.md b/docs/getting_started.md
@@ -419,28 +419,11 @@ After adding yourself to the group, log out and log back in for the changes to t
 
 ### Linux
 
-#### KMS Capture
-
-> [!WARNING]
-> Capture of most Wayland-based desktop environments will fail unless this step is performed.
+#### Services
 
 > [!NOTE]
-> `cap_sys_admin` may as well be root, except you don't need to be root to run the program. This is necessary to
-> allow Sunshine to use KMS capture.
-
-##### Enable
-```bash
-sudo setcap cap_sys_admin+p $(readlink -f $(which sunshine))
-```
-
-#### X11/XDG Capture
-For X11 or XDG Portal capture to work, you may need to disable the capabilities that were set for KMS capture.
-
-```bash
-sudo setcap -r $(readlink -f $(which sunshine))
-```
-
-#### Service
+> Two service unit files are available. Pick "sunshine" for unprivileged XDG Portal or X11 capture, otherwise
+> pick "sunshine-kms" for privileged KMS capture.
 
 **Start once**
 ```bash

diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
@@ -160,10 +160,12 @@ sudo usermod -aG input $USER
 ```
 
 ### KMS Streaming fails
-If screencasting fails with KMS, you may need to run the following to force unprivileged screencasting.
+If screencasting fails with KMS, you may be using the unprivileged sunshine service unit. Switch to the privileged
+sunshine-kms service:
 
 ```bash
-sudo setcap -r $(readlink -f $(which sunshine))
+systemctl --user disable sunshine
+systemctl --user enable sunshine-kms --now
 ```
 
 > [!NOTE]

diff --git a/packaging/linux/AppImage/AppRun b/packaging/linux/AppImage/AppRun
@@ -58,6 +58,10 @@ function install() {
   cp -r "$SUNSHINE_SHARE_HERE/systemd/user/" ~/.config/systemd/
   # patch service executable path
   sed -i -e "s#$SUNSHINE_PATH#$(readlink -f $ARGV0)#g" ~/.config/systemd/user/sunshine.service
+  sed -i -e "s#$SUNSHINE_PATH#$(readlink -f $ARGV0)#g" ~/.config/systemd/user/sunshine-kms.service
+
+  # setcap
+  sudo setcap cap_sys_admin+p "$(readlink -f "$SUNSHINE_BIN_HERE")"
 }
 
 function remove() {
@@ -69,6 +73,7 @@ function remove() {
 
   # remove service
   sudo rm -f ~/.config/systemd/user/sunshine.service
+  sudo rm -f ~/.config/systemd/user/sunshine-kms.service
 }
 
 # process arguments

diff --git a/packaging/linux/Arch/sunshine.install b/packaging/linux/Arch/sunshine.install
@@ -1,3 +1,7 @@
+do_setcap() {
+  setcap cap_sys_admin+p $(readlink -f usr/bin/sunshine)
+}
+
 do_udev_reload() {
   udevadm control --reload-rules
   udevadm trigger --property-match=DEVNAME=/dev/uinput
@@ -7,11 +11,13 @@ do_udev_reload() {
 }
 
 post_install() {
+  do_setcap
   do_udev_reload
   modprobe uhid
 }
 
 post_upgrade() {
+  do_setcap
   do_udev_reload
   modprobe uhid
 }
diff --git a/packaging/linux/copr/Sunshine.spec b/packaging/linux/copr/Sunshine.spec
@@ -282,10 +282,6 @@ xvfb-run ./tests/test_sunshine
 cd %{_builddir}/Sunshine/build
 %make_install
 
-# setcap will break XDG Desktop Portal's security policy, so create a copy that can have elevated capabilities
-# this is only necessary for immutable distributions with rpm-ostree
-install -Dm755 %{_builddir}/Sunshine/build/sunshine %{buildroot}%{_bindir}/sunshine-kms
-
 %post
 # Note: this is copied from the postinst script
 
@@ -314,12 +310,12 @@ fi
 
 %files
 # Executables
-%{_bindir}/sunshine
-%{_bindir}/sunshine-%{build_version}
-%caps(cap_sys_admin+p) %{_bindir}/sunshine-kms
+%caps(cap_sys_admin+p) %{_bindir}/sunshine
+%caps(cap_sys_admin+p) %{_bindir}/sunshine-*
 
-# Systemd unit file for user services
+# Systemd unit files for user services
 %{_userunitdir}/sunshine.service
+%{_userunitdir}/sunshine-kms.service
 
 # Udev rules
 %{_udevrulesdir}/*-sunshine.rules

diff --git a/packaging/linux/flatpak/scripts/additional-install.sh b/packaging/linux/flatpak/scripts/additional-install.sh
@@ -3,8 +3,9 @@
 # User Service
 mkdir -p ~/.config/systemd/user
 cp "/app/share/sunshine/systemd/user/sunshine.service" "$HOME/.config/systemd/user/sunshine.service"
-echo "Sunshine User Service has been installed."
-echo "Use [systemctl --user enable sunshine] once to autostart Sunshine on login."
+cp "/app/share/sunshine/systemd/user/sunshine-kms.service" "$HOME/.config/systemd/user/sunshine-kms.service"
+echo "Sunshine User Services have been installed."
+echo "Use [systemctl --user enable sunshine] or [systemctl --user enable sunshine-kms] once to autostart Sunshine on login."
 
 # Load uhid (DS5 emulation)
 UHID=$(cat /app/share/sunshine/modules-load.d/60-sunshine.conf)

diff --git a/packaging/linux/flatpak/scripts/remove-additional-install.sh b/packaging/linux/flatpak/scripts/remove-additional-install.sh
@@ -3,8 +3,9 @@
 # User Service
 systemctl --user stop sunshine
 rm "$HOME/.config/systemd/user/sunshine.service"
+rm "$HOME/.config/systemd/user/sunshine-kms.service"
 systemctl --user daemon-reload
-echo "Sunshine User Service has been removed."
+echo "Sunshine User Services have been removed."
 
 # Remove rules
 flatpak-spawn --host pkexec sh -c "rm /etc/modules-load.d/60-sunshine.conf"

diff --git a/packaging/linux/sunshine-kms.service.in b/packaging/linux/sunshine-kms.service.in
@@ -0,0 +1,16 @@
+[Unit]
+Description=@PROJECT_DESCRIPTION@
+StartLimitIntervalSec=500
+StartLimitBurst=5
+Conflicts=sunshine.service
+
+[Service]
+# Avoid starting Sunshine before the desktop is fully initialized.
+ExecStartPre=/bin/sleep 5
+@SUNSHINE_SERVICE_START_COMMAND@
+@SUNSHINE_SERVICE_STOP_COMMAND@
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=xdg-desktop-autostart.target
diff --git a/packaging/linux/sunshine.service.in b/packaging/linux/sunshine.service.in
@@ -2,6 +2,7 @@
 Description=@PROJECT_DESCRIPTION@
 StartLimitIntervalSec=500
 StartLimitBurst=5
+Conflicts=sunshine-kms.service
 
 [Service]
 # Avoid starting Sunshine before the desktop is fully initialized.
@@ -10,6 +11,7 @@ ExecStartPre=/bin/sleep 5
 @SUNSHINE_SERVICE_STOP_COMMAND@
 Restart=on-failure
 RestartSec=5s
+NoNewPrivileges=true
 
 [Install]
 WantedBy=xdg-desktop-autostart.target
diff --git a/src_assets/linux/misc/postinst b/src_assets/linux/misc/postinst
@@ -8,6 +8,18 @@ modprobe uhid
 if [ ! -x "$(command -v rpm-ostree)" ]; then
   echo "Not in an rpm-ostree environment, proceeding with post install steps."
 
+  # Ensure Sunshine can grab images from KMS
+  path_to_setcap=$(which setcap)
+  path_to_sunshine=$(readlink -f "$(which sunshine)")
+  if [ -x "$path_to_setcap" ] ; then
+    echo "Setting CAP_SYS_ADMIN capability on Sunshine binary."
+    echo "$path_to_setcap cap_sys_admin+p $path_to_sunshine"
+    $path_to_setcap cap_sys_admin+p $path_to_sunshine
+    echo "CAP_SYS_ADMIN capability set on Sunshine binary."
+  else
+    echo "error: setcap not found or not executable."
+  fi
+
   # Trigger udev rule reload for /dev/uinput and /dev/uhid
   path_to_udevadm=$(which udevadm)
   if [ -x "$path_to_udevadm" ] ; then