capabilities: Log warning if UID changes and no capability backend is compiled in

In this case, we preserve the complete set of capabilities not just the
ones we actually need.  Removing the `prctl()` call isn't an option as
the daemon wouldn't be functional without the capabilities.  But we now
warn users about this.  We also only call `prctl()` if we actually switch
to a non-zero UID, `has_capability()` in turn already checks that we are
running as root in the `!CAPABILITIES` case.

A similar warning has been added to the configure script if a user has
been set at compile time.

configure.ac

@@ -1297,6 +1297,12 @@ if test x$capabilities = xlibcap; then
 	AC_DEFINE([CAPABILITIES_LIBCAP], [], [have libpcap library])
 fi
 
+if test x$capabilities = xno -a x$ac_cv_func_prctl = xyes -a "x$ipsecuser" != xroot; then
+	AC_MSG_WARN(m4_normalize([
+		no capability backend selected, the daemon will be unable to restrict
+		root-derived capabilities when changing to an unprivileged user]))
+fi
+
 if test x$selinux = xtrue; then
 	PKG_CHECK_MODULES(selinux, [libselinux])
 	AC_SUBST(selinux_CFLAGS)

src/libstrongswan/utils/capabilities.c

@@ -422,9 +422,13 @@ METHOD(capabilities_t, drop, bool,
 {
 #ifndef WIN32
 #ifdef HAVE_PRCTL
-	if (has_capability(this, CAP_SETPCAP, NULL))
+	if (this->uid && has_capability(this, CAP_SETPCAP, NULL))
 	{
 		prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+#ifndef CAPABILITIES
+		DBG0(DBG_LIB, "no capability backend compiled in, privilege drop will "
+			 "preserve root-derived permitted capabilities");
+#endif
 	}
 #endif