Support prctls PR_CAP_AMBIENT + PR_SET_SECUREBITS

[bnoordhuis]

Description

We have code to drop ambient capabilities that looks like this:

prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS_LOCKED | SECBIT_NOROOT /* | etc */);

Works great everywhere except under gVisor, where the prctls fail with EINVAL.

Environment

Whatever version of gVisor GCP's Cloud Run uses. A quick skim of the master branch suggests they're not supported there, either.

[ianlewis]

gVisor currently doesn't support ambient capabilities so we'd likely need to support them before supporting PR_CAP_AMBIENT
#3166

[github-actions]

A friendly reminder that this issue had no activity for 120 days.

[github-actions]

This issue has been closed due to lack of activity.

[github-actions]

A friendly reminder that this issue had no activity for 120 days.