libstore: fix builder launch failure on older kernels

Since commit ac64c727b5, during launch of the
builder it is attempted to raise all capabilities into the ambient set.
Specifically, what "all" means here is determined by the Linux API headers Lix
was built against.

Occasionally, new capabilities are added in the Linux kernel, leading to
PR_CAP_AMBIENT_RAISE failing with EINVAL on the newly added capabilities if the
API headers are from after the change but the running kernel is from before.
Similarly to how capset already silently ignores nonexistent capabilities, we
ignore this error so the builder doesn't fail to launch unnecessarily.

Unfortunately it is very hard to test for this situation currently, since the
last time a capability was added was CAP_CHECKPOINT_RESTORE in Linux 5.9, and
all kernel versions in nixpkgs are newer than that.

Change-Id: Ibeb2f0757729b877bd3ca9f02e1aa4536a6a6964

lix/libstore/platform/linux.cc

@@ -230,7 +230,10 @@ static void raiseAmbientCaps(std::span<const unsigned> caps)
     }
 
     for (auto cap : caps) {
-        if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0) {
+        // We might be running on a kernel older than the API headers, lacking some capabilities.
+        // While capset will silently ignore them, PR_CAP_AMBIENT_RAISE fails with EINVAL.
+        // Swallow the error ourselves to not introduce unnecessary failures.
+        if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0 && errno != EINVAL) {
             throw SysError("couldn't set ambient caps");
         }
     }