[Heartbeat] Drop only inheritable cap set and defer setuid to node fork

[emilioalvap]

What does this PR do?

Fixes #33292.

Only drop inheritable cap set and move setuid/setgid to node fork.

Still need to validate with inline and zip urls.

Process tree:

Caps:

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Build heartbeat locally and mount it into an elastic-agent-complete container.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @emilioalvap? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-01-24T14:40:32.401+0000

• Duration: 49 min 13 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1889
Skipped	25
Total	1914

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[emilioalvap]

Pdeathsig is Linux only, removing darwin from build tags to reflect that

[elasticmachine]

Pinging @elastic/uptime (Team:Uptime)

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
4.8% Duplication

[emilioalvap]

/test

[emilioalvap]

/test

[emilioalvap]

Tested the following scenarios:

• Heartbeat docker - root -> Monitors cannot be run as root err msg:

io:job could not be initialized: script monitors cannot be run as root

• Heartbeat docker - non root -> No changes to process euid, dropping limited caps.

root@30728e612bb0:/usr/share/heartbeat# cat /proc/{8,23}/status | grep -E 'Name|Cap|Uid|Groups|Umask'
Name:   heartbeat
Uid:    1000    1000    1000    1000
Groups: 0 1000
CapInh: 0000000000000000
CapPrm: 0000000000002000
CapEff: 0000000000002000
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000
Name:   node
Uid:    1000    1000    1000    1000
Groups: 0 1000
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000

• Elastic agent docker - root -> All caps dropped, effective euid for node includes root (0):

root@dc536c6b5a5b:/usr/share/elastic-agent# cat /proc/{44,120}/status | grep -E 'Name|Cap|Uid|Groups|Umask'
Name:   heartbeat
Umask:  0007
Uid:    0       0       0       0
Groups: 0
CapInh: 0000000000000000
CapPrm: 00000000a80425fb
CapEff: 00000000a80425fb
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000
Name:   node
Umask:  0007
Uid:    1000    1000    1000    1000
Groups: 0
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000

• Elastic agent docker - non-root -> No changes to process euid, dropping limited caps.

root@ad2b16ed53b1:/usr/share/elastic-agent# cat /proc/{44,121}/status | grep -E 'Name|Cap|Uid|Groups|Umask'
Name:   heartbeat
Umask:  0007
Uid:    1000    1000    1000    1000
Groups: 0 1000
CapInh: 0000000000000000
CapPrm: 0000000000002080
CapEff: 0000000000002080
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000
Name:   node
Umask:  0007
Uid:    1000    1000    1000    1000
Groups: 0 1000
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000

cc @andrewvc @v, this should be green for review.

[andrewvc]

LGTM