core/exec-invoke: don't set $TMPDIR if sandboxing is disabled (#37637)

Follow-ups for #37271.

src/core/exec-invoke.c

@@ -2193,7 +2193,7 @@ static int build_environment(
         }
 
         assert(c->private_var_tmp >= 0 && c->private_var_tmp < _PRIVATE_TMP_MAX);
-        if (c->private_tmp != c->private_var_tmp) {
+        if (needs_sandboxing && c->private_tmp != c->private_var_tmp) {
                 assert(c->private_tmp == PRIVATE_TMP_DISCONNECTED);
                 assert(c->private_var_tmp == PRIVATE_TMP_NO);
 

src/test/test-execute.c

@@ -493,6 +493,10 @@ static void test_exec_privatetmp(Manager *m) {
                 test(m, "exec-privatetmp-yes.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED);
                 test(m, "exec-privatetmp-disabled-by-prefix.service", can_unshare ? 0 : MANAGER_IS_SYSTEM(m) ? EXIT_FAILURE : EXIT_NAMESPACE, CLD_EXITED);
 
+                (void) unlink("/tmp/test-exec_privatetmp_disconnected");
+                test(m, "exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service", 0, CLD_EXITED);
+                ASSERT_OK_ERRNO(access("/tmp/test-exec_privatetmp_disconnected", F_OK));
+
                 FOREACH_STRING(s,
                                "exec-privatetmp-disconnected.service",
                                "exec-privatetmp-disconnected-defaultdependencies-no.service",

test/test-execute/exec-privatetmp-disconnected-nodefaultdeps-nor-sandboxing.service

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+[Unit]
+Description=Test for PrivateTmp=disconnected with DefaultDependencies=no + no sandboxing
+DefaultDependencies=no
+
+[Service]
+ExecStart=+touch /tmp/test-exec_privatetmp_disconnected
+ExecStart=+sh -x -c 'test x$$TMPDIR = x'
+Type=oneshot
+PrivateTmp=disconnected