capabilities: always set ambient and inheritable

[giuseppe]

change capabilities handling to reflect what docker does.

Bounding: set to caplist
Inheritable: set to caplist
Effective: if uid != 0 then clear; else set to caplist
Permitted: if uid != 0 then clear; else set to caplist
Ambient: clear

Signed-off-by: Giuseppe Scrivano [email protected]

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[giuseppe]

the test failure seems correct to me, why would we allow chown to work with -u USER and no caps added?

		setup := podmanTest.RunTopContainer("testctr")
		setup.WaitWithDefaultTimeout()
		Expect(setup.ExitCode()).To(Equal(0))

		session = podmanTest.Podman([]string{"exec", "-u", "testuser", "testctr", "touch", "testfile"})
		session.WaitWithDefaultTimeout()
		Expect(session.ExitCode()).To(Equal(0))

[TomSweeneyRedHat]

LGTM
assuming happy tests

[rhatdan]

/lgtm
/hold

[rhatdan]

/lgtm

[giuseppe]

/hold

let's make sure tests are still passing :-)

[baude]

/hold cancel

[lsm5]

@giuseppe this likely needs to be backported to v2.1

[giuseppe]

backport: #7898