Re: [libvirt] PATCH: Fix LXC container capabilities

My previous change to LXC container capabilties setup has a fairly stupid bug in it. The container init process starts off with no capabilities whatsoever :-( This was caused by a bogus capng_lock() call which meant that all capabilities were cleared when the init process was exec'd. The capng_lock call sets NOROOT & NROOT_LOCKED flags in the process secure bits. This is not neccessary for the init process - we have reduced the bounding set which is sufficient for our security goals. With the capng_lock() call removed, the init process gets its permitted and effective sets filled to match the bounding set which is the desired scenario.