core/exec-invoke: gracefully handle lack of privilege for initgroups() in user mode

Otherwise specifying User=SELF also fails because we got
no privilege to call setgroups().

Fixes #39038

diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index aaa9a0e8bd98b551b4858a4a4b5f08c4b3aadb13..b930b1037d369cd0f47b4f9d8f20a18657088f44 100644 (file)
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -902,8 +902,16 @@ static int get_supplementary_groups(
         bool keep_groups = false;
         if (user && gid_is_valid(gid) && gid != 0) {
                 /* First step, initialize groups from /etc/groups */
-                if (initgroups(user, gid) < 0)
-                        return -errno;
+                if (initgroups(user, gid) < 0) {
+                        /* If our primary gid is already the one specified in Group= (i.e. we're running in
+                         * user mode), gracefully handle the case where we have no privilege to re-initgroups().
+                         *
+                         * Note that group memberships of the current user might have been modified, but
+                         * the change will only take effect after re-login. It's better to continue on with
+                         * existing credentials rather than erroring out. */
+                        if (!ERRNO_IS_PRIVILEGE(errno) || gid != getgid())
+                                return -errno;
+                }
 
                 keep_groups = true;
         }