sandbox: support privileged container

Signed-off-by: Ophestra <cat@gensokyo.uk>

sandbox/syscall.go

@@ -11,6 +11,7 @@ const (
 	PR_SET_NO_NEW_PRIVS = 0x26
 
 	CAP_SYS_ADMIN = 0x15
+	CAP_SETPCAP   = 0x8
 )
 
 const (
@@ -30,10 +31,9 @@ func SetDumpable(dumpable uintptr) error {
 const (
 	_LINUX_CAPABILITY_VERSION_3 = 0x20080522
 
-	PR_CAP_AMBIENT           = 47
-	PR_CAP_AMBIENT_CLEAR_ALL = 4
-
-	CAP_SETPCAP = 8
+	PR_CAP_AMBIENT           = 0x2f
+	PR_CAP_AMBIENT_RAISE     = 0x2
+	PR_CAP_AMBIENT_CLEAR_ALL = 0x4
 )
 
 type (
@@ -49,6 +49,12 @@ type (
 	}
 )
 
+// See CAP_TO_INDEX in linux/capability.h:
+func capToIndex(cap uintptr) uintptr { return cap >> 5 }
+
+// See CAP_TO_MASK in linux/capability.h:
+func capToMask(cap uintptr) uint32 { return 1 << uint(cap&31) }
+
 func capset(hdrp *capHeader, datap *[2]capData) error {
 	if _, _, errno := syscall.Syscall(syscall.SYS_CAPSET,
 		uintptr(unsafe.Pointer(hdrp)),