At boot, init drops its own capabilities and usermode helpers' according to the CapabilityBoundingSet option in systemd/system.conf. Unfortunately, to modify files in /proc/sys/kernel/usermodehelper you need CAP_SYS_MODULE: if you don't include CAP_SYS_MODULE in the bounding set, boot fails with "Failed to drop capability bounding set of usermode helpers".

I think being able to drop CAP_SYS_MODULE is one of the most useful uses of that option. To fix this, capabilities should be dropped in reverse order: first those of usermodehelper, then those of systemd's init.

It should be a trivial change to main.c (just search for the error message and you'll see what I mean).