execute: Cleanup the environment early

By cleaning up before setting up PAM we maintain control of overriding
behavior in setting variables. Otherwise, pam_putenv is in control.
This also makes sure we use a cleaned up environment in replacing
variables in argv.

diff --git a/src/core/execute.c b/src/core/execute.c
index 8cb18dbd5b5c4fca55cda809b6c8af2aab02e03b..1a7620b0848c56882c7103260d8dccfb93fb3ba8 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1858,6 +1858,7 @@ static int exec_child(
                 *exit_status = EXIT_MEMORY;
                 return -ENOMEM;
         }
+        accum_env = strv_env_clean(accum_env);
 
         umask(context->umask);
 
@@ -2166,8 +2167,6 @@ static int exec_child(
                 return -ENOMEM;
         }
 
-        accum_env = strv_env_clean(accum_env);
-
         if (_unlikely_(log_get_max_level() >= LOG_DEBUG)) {
                 _cleanup_free_ char *line;