diff --git a/BUILD.gn b/BUILD.gn
index 425753e81469fbac08c40cddeb6d28f598fc925d..cc3a1e8ce045f047afa83ee05e05563989fe1eca 100755
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -83,7 +83,11 @@ ohos_shared_library("appspawn_socket_client") {
 }
 
 ohos_prebuilt_etc("appspawn.rc") {
-  source = "appspawn.rc"
+  if (use_musl) {
+    source = "appspawn.cfg"
+  } else {
+    source = "appspawn.rc"
+  }
   relative_install_dir = "init"
   subsystem_name = "${subsystem_name}"
   part_name = "${part_name}"
diff --git a/OAT.xml b/OAT.xml
index aa01ceabe357535c840cb743727fb16106185a8e..96a1658a6bdfcc46f1f14af49ea84482a022a549 100644
--- a/OAT.xml
+++ b/OAT.xml
@@ -13,8 +13,6 @@
      See the License for the specific language governing permissions and
      limitations under the License.
 
-     Notes:
-     This is project config file for OpenHarmony OSS Audit Tool, if you have any questions or concerns, please email chenyaxun@huawei.com.
 -->
 <!-- OAT(OSS Audit Tool) configuration guide:
 basedir: Root dir, the basedir + project path is the real source file location.
diff --git a/appspawn.cfg b/appspawn.cfg
new file mode 100755
index 0000000000000000000000000000000000000000..dc40635ff69ce5afc0df373658b9977d84d9b52b
--- /dev/null
+++ b/appspawn.cfg
@@ -0,0 +1,18 @@
+{
+    "jobs" : [{
+            "name" : "late-fs",
+            "cmds" : [
+                "start appspawn"
+            ]
+        }
+    ],
+    "services" : [{
+            "name" : "appspawn",
+            "path" : ["/system/bin/appspawn"],
+            "importance" : -20,
+            "uid" : "root",
+            "gid" : ["root"]
+        }
+    ]
+}
+
diff --git a/include/appspawn_server.h b/include/appspawn_server.h
index c4ca90f445f0bed4b04eb155a9d378245a3be631..f914d45ed41888fc78f6eb42a3498bbaf5acf8bf 100644
--- a/include/appspawn_server.h
+++ b/include/appspawn_server.h
@@ -98,6 +98,11 @@ private:
      */
     int32_t SetProcessName(char *longProcName, int64_t longProcNameLen, const char *processName, int32_t len);
 
+    /**
+     * Sets keep capabilities.
+     */
+    int32_t SetKeepCapabilities();
+
     /**
      * Sets the uid and gid of an application process.
      *
@@ -118,6 +123,9 @@ private:
      */
     int32_t SetCapabilities();
 
+    /**
+     * Sets app process property.
+     */
     bool SetAppProcProperty(int connectFd, const ClientSocket::AppProperty *appProperty, char *longProcName,
         int64_t longProcNameLen, const int32_t fd[FDLEN2]);
 
diff --git a/include/appspawn_socket.h b/include/appspawn_socket.h
index 7a80c3cfbb8659466afe864d10fe573557f17816..f4436cdabf87a80bb91fabc92d08b41c9994046a 100644
--- a/include/appspawn_socket.h
+++ b/include/appspawn_socket.h
@@ -102,7 +102,11 @@ protected:
     std::string socketName_{};
     struct sockaddr_un socketAddr_ {};
     socklen_t socketAddrLen_ = 0;
+#ifdef __MUSL__
+    const std::string socketDir_ = "/dev/unix/socket/";
+#else
     const std::string socketDir_ = "/dev/socket/";
+#endif
     const unsigned int listenBacklog_ = 50;                   // 50: max num of clients
     static constexpr struct timeval SOCKET_TIMEOUT = {5, 0};  // 5, 0: { 5 sec, 0 msec } for timeout
 };
diff --git a/include/server_socket.h b/include/server_socket.h
index bba7a35e556f0092fa526543b608cb3bfc88125f..84c965cf7b1dff6b4f6b6e199bf61f332f80613b 100644
--- a/include/server_socket.h
+++ b/include/server_socket.h
@@ -97,8 +97,8 @@ public:
     using AppSpawnSocket::ReadSocketMessage;
     using AppSpawnSocket::WriteSocketMessage;
 
-    static constexpr uid_t AID_ROOT = 0;         // chown owner
-    static constexpr gid_t AID_SYSTEM = 1000;    // chown group
+    static constexpr uid_t APPSPAWN_ID_ROOT = 0;         // chown owner
+    static constexpr gid_t APPSPAWN_ID_SYSTEM = 1000;    // chown group
     static constexpr mode_t SOCKET_PERM = 0660;  // root system can read and write appspawn socket
 
 private:
diff --git a/ohos.build b/ohos.build
index b33b775eaa7e7f55e6a68d4f1b43a791b4da4d84..650790f177cf795221b4b140d5281b1123e176cf 100644
--- a/ohos.build
+++ b/ohos.build
@@ -23,6 +23,7 @@
           }
       ],
       "test_list": [
+        "//base/startup/appspawn_standard/test:unittest",
         "//base/startup/appspawn_standard/test:moduletest"
       ]
     }
diff --git a/src/appspawn_server.cpp b/src/appspawn_server.cpp
index 436f86529c87056df58e7b4fb272ba5fcaff8eab..e52a3fd333a305159fd886fde361080661de0d32 100644
--- a/src/appspawn_server.cpp
+++ b/src/appspawn_server.cpp
@@ -275,6 +275,19 @@ int32_t AppSpawnServer::SetProcessName(
     return ERR_OK;
 }
 
+/**
+ * Set keep capabilities.
+ */
+int32_t AppSpawnServer::SetKeepCapabilities()
+{
+    // keep capabilities when uid changed.
+    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
+        HiLog::Error(LABEL, "set keepcaps failed: %{public}s", strerror(errno));
+        return (-errno);
+    }
+    return ERR_OK;
+}
+
 int32_t AppSpawnServer::SetUidGid(
     const uint32_t uid, const uint32_t gid, const uint32_t *gitTable, const uint32_t gidCount)
 {
@@ -410,6 +423,17 @@ bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppPr
         return false;
     }
 
+    // set keep capabilities when user not root.
+    if (appProperty->uid != 0) {
+        ret = SetKeepCapabilities();
+        if (FAILED(ret)) {
+            HiLog::Error(LABEL, "SetKeepCapabilities error, ret %{public}d", ret);
+            write(fd[1], &ret, sizeof(ret));
+            close(fd[1]);
+            return false;
+        }
+    }
+
 #ifdef GRAPHIC_PERMISSION_CHECK
     // set uid gid
     ret = SetUidGid(appProperty->uid, appProperty->gid, appProperty->gidTable, appProperty->gidCount);
diff --git a/src/socket/server_socket.cpp b/src/socket/server_socket.cpp
index 5318369d36e0bfb9a67c6511b11cdab25c7fb630..a4daf97bbd51058670beada2228555ab02d3ca43 100644
--- a/src/socket/server_socket.cpp
+++ b/src/socket/server_socket.cpp
@@ -126,7 +126,7 @@ int ServerSocket::BindSocket(int connectFd)
         return -1;
     }
 
-    if (chown(socketAddr_.sun_path, AID_ROOT, AID_SYSTEM)) {
+    if (chown(socketAddr_.sun_path, APPSPAWN_ID_ROOT, APPSPAWN_ID_SYSTEM)) {
         HiLog::Error(LABEL, "Server: failed to chown socket fd %d, failed: %s", connectFd, strerror(errno));
         return -1;
     }