core: drop ambient capabilities in systemd-executor

Since the commit 963b6b906e ("core: drop ambient capabilities in
user manager") systemd running as the session manager has dropped ambient
capabilities retaining other sets allowing user services to be started
with elevated capabilities. This, worked fine until the introduction of
sd-executor. For a non-root process to be started with elevated
capabilities by a non-root parent it either needs file capabilities or
ambient capabilities in the parent process. Thus, systemd needs to allow
sd-executor to inherit its ambient capabilities and sd-executor should
drop them as systemd did before.

The ambient set is managed for both system and session managers, but
with the default set for PID#1 being empty, this code does not affect
operation of PID#1.

Fixes: bb5232b6a3 ("core: add systemd-executor binary")

src/core/executor.c

@@ -8,6 +8,7 @@
 #include "alloc-util.h"
 #include "argv-util.h"
 #include "build.h"
+#include "capability-util.h"
 #include "exec-invoke.h"
 #include "execute-serialize.h"
 #include "execute.h"
@@ -206,6 +207,11 @@ static int run(int argc, char *argv[]) {
         log_set_prohibit_ipc(false);
         log_open();
 
+        /* Clear ambient capabilities, so services do not inherit them implicitly. Dropping them does
+         * not affect the permitted and effective sets which are important for the executor itself to
+         * operate. */
+        capability_ambient_set_apply(0, /* also_inherit= */ false);
+
         /* This call would collect all passed fds and enable CLOEXEC. We'll unset it in exec_invoke (flag_fds)
          * for fds that shall be passed to the child.
          * The serialization fd is set to CLOEXEC in parse_argv, so it's also filtered. */