SETUID/SETGID not required for changing user

[bernerdschaefer]

With this changeset, providing a user in container configuration does not require that you also grant SETUID and SETGID capabilities to the contained process.

It accomplishes this by:

• dropping the bounding set while still fully privileged
• calling prctl(PR_SET_KEEPCAPS, 1), to preserve capabilities while changing users
• changing user (unchanged)
• calling prctl(PR_SET_KEEPCAPS, 0) to clear the setting
• dropping capabilities (unchanged)

---

before

> grep capabilities container.json
  "capabilities": ["SETUID", "SETGID"],
> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh: 00000000000000c0
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000000000c0

> grep capabilities container.json
  "capabilities": [],
>  sudo nsinit exec /bin/grep Cap /proc/self/status
2014/05/28 15:00:43 unable to initialize for container: finalize namespace setup user setgroups operation not permitted

after

> grep capabilities container.json
  "capabilities": ["SETUID", "SETGID"],
> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh: 00000000000000c0
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000000000c0

> grep capabilities container.json
  "capabilities": [],

> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000000000000000

Fixes #4556

[vmarmol]

LGTM. Great change :) thanks for the followup! @crosbymichael for pkg/system and the second on libcontainer.

[crosbymichael]

LGTM

[vieux]

LGTM