tor may need CAP_DAC_READ_SEARCH

Hmm. It seems tor in CentOS7 needs an additional CAP_DAC_READ_SEARCH in the CapabilityBoundingSet of the systemd service, in case a hidden service is going to be used :-/