service: warn when capabilities cannot take effect

An ambient capability only reaches the effective set when euid is
non-zero, so a service that pairs `capabilities = { "^cap_..." }` with a
root user gets none of the restriction it asks for, and keeps the full
root set instead.  Finit read the list, applied it, and said nothing.  A
build without libcap dropped the list on the floor just as quietly.

Both now warn, naming the service:

    nginx: ambient capabilities ('^') have no effect as root, use a
    non-root user, or '%' and '!' entries

The ambient entries are read back from the parsed IAB value rather than
matched in the text, so inheritable ('%') and bounding ('!') entries stay
silent -- those work fine as root.

The warning repeats when the .conf files are re-read on runlevel change,
as parse warnings here already do.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

src/service.c

@@ -1537,11 +1537,26 @@ static void parse_caps(svc_t *svc, char *caps)
 		return;
 	}
 
+	if (!strcmp(svc->username, "root")) {
+		cap_value_t cap;
+
+		for (cap = 0; cap <= CAP_LAST_CAP; cap++) {
+			if (!cap_iab_get_vector(cap_iab, CAP_IAB_AMB, cap))
+				continue;
+
+			/* the ambient set only reaches effective when euid != 0 */
+			logit(LOG_WARNING, "%s: ambient capabilities ('^') have no effect"
+			      " as root, use a non-root user, or '%%' and '!' entries",
+			      svc_ident(svc, NULL, 0));
+			break;
+		}
+	}
+
 	cap_free(cap_iab);
 	strlcpy(svc->capabilities, caps, sizeof(svc->capabilities));
 #else
-	(void)svc;
-	(void)caps;
+	logit(LOG_WARNING, "%s: capabilities require Finit built with --enable-libcap,"
+	      " ignoring '%s'", svc_ident(svc, NULL, 0), caps);
 #endif
 }