orchestrator: warn when elevated privileges discard the environment

A privilege-gaining exec — set-uid, set-gid, or one carrying file
capabilities — has its KASLD_* settings dropped before main() runs, and
nothing in the run said so. The difference is not cosmetic: a discarded
KASLD_SYSROOT means the readout describes the machine doing the analysis
while the caller named a captured tree, and the default output mentions
no sysroot at all, so there was nothing to notice. The same command
against the same absent sysroot resolves 3 facts unprivileged and 141
set-gid, the gap being the whole live host.

Print one line on stderr beside the environment snapshot when the exec
gained privilege, naming the consequence rather than only the cause: this
readout describes the local system. It goes out even under --quiet, which
suppresses progress noise rather than a caveat on the answer, matching
the component-limit warning already there.

Unconditional on a privileged exec, because the variables are gone by the
time main() could ask which of them were set, and true whichever were:
the sysroot is dropped on every such run. kasld(1) records that the run
reports this, beside the env_reset note it already carried.

Author: bcoles

man/kasld.1

@@ -193,7 +193,7 @@ privilege-gaining \(em a set-uid or set-gid binary, or one carrying file
 capabilities \(em every
 .B KASLD_*
 variable is dropped before it is read, and the run proceeds on its own
-configuration.
+configuration, reporting that it did so on standard error.
 .TP
 .B KASLD_COMPONENT_DIR
 Directory to load component binaries from, overriding the default search

src/orchestrator.c

@@ -4749,6 +4749,20 @@ int main(int argc, char *argv[]) {
       color_output = isatty(STDOUT_FILENO);
   }
 
+  /* A privilege-gaining exec had its KASLD_* settings dropped before main()
+   * ran. Nothing else in the run says so, and the difference is not cosmetic:
+   * a discarded KASLD_SYSROOT means the readout describes this machine rather
+   * than the captured tree the caller named.
+   *
+   * Printed even under --quiet, which suppresses progress noise rather than a
+   * caveat on the answer, and unconditional because the variables are gone by
+   * the time this could ask which of them were set. */
+  if (kasld_exec_gained_privilege())
+    fprintf(stderr,
+            "warning: elevated privileges (set-uid, set-gid or file "
+            "capabilities); KASLD_* environment settings are not honoured, so "
+            "this readout describes the local system\n");
+
   /* Take the environment before anything else looks at the system: every
    * format's readout, the "KASLR disabled" branch and the hardening advisor
    * read it, and the advisor weighs a component's denial against the settings