Don't set ambient caps; switch to moby/sys/capability

[kolyshkin]

github.com/moby/sys/capability is a fork of the (no longer maintained) github.com/syndtr/gocapability package.

For the list of changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

What type of PR is this?

/kind other

What this PR does / why we need it:

How to verify it

Which issue(s) this PR fixes:

Special notes for your reviewer:

Note that removing the AMBENT caps from chroot is a no-op -- since ambient caps couldn't be set without inheritable, practically they were not set since commit e7e55c9.

See also

• pgk/capabilities: modernize, switch to github.com/moby/sys/capability common#2167
• Switch to github.com/moby/sys/capability storage#2103
• Switch to github.com/moby/sys/capability opencontainers/runtime-tools#777

Does this PR introduce a user-facing change?

none

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kolyshkin
Once this PR has been reviewed and has the lgtm label, please assign rhatdan for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[packit-as-a-service]

Ephemeral COPR build failed. @containers/packit-build please check.

[kolyshkin]

I think I found a bug :)

[kir@kir-tp1 chroot]$ go test -run TestNoop -exec sudo  -v
=== RUN   TestNoop
    run_test.go:121: run: exit status 1: error setting capabilities for process: setting capabilities: operation not permitted
        subprocess exited with status 1
--- FAIL: TestNoop (0.08s)
FAIL
exit status 1
FAIL	github.com/containers/buildah/chroot	0.107s

One of the most important fixes in the capability package fork was this one: kolyshkin/capability@4d79446

Essentially, an error from setting ambient capabilities was ignored. Now it is not.

Most probably ambient capabilities are set without setting inheritable ones. We found the same issue in runc.

[kolyshkin]

Most probably ambient capabilities are set without setting inheritable ones. We found the same issue in runc.

Right. Added a commit that fixes that.

[rhatdan]

LGTM