specgen: add support for ambient capabilities

if the kernel supports ambient capabilities (Linux 4.3+), also set
them when running with euid != 0.

This is different that what Moby does, as ambient capabilities are
never set.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/pkg/specgen/generate/config_linux.go b/pkg/specgen/generate/config_linux.go
index fcb7641d2..2d40dba8f 100644
--- a/pkg/specgen/generate/config_linux.go
+++ b/pkg/specgen/generate/config_linux.go
@@ -350,3 +350,8 @@ func deviceFromPath(path string) (*spec.LinuxDevice, error) {
 		Minor:    int64(unix.Minor(devNumber)),
 	}, nil
 }
+
+func supportAmbientCapabilities() bool {
+	err := unix.Prctl(unix.PR_CAP_AMBIENT, unix.PR_CAP_AMBIENT_IS_SET, 0, 0, 0)
+	return err == nil
+}