class FileCapTest_FileCapabilityCoercionInsideUserNamespace_Test

From

<https

://man7.org/linux/man-pages/man7/capabilities.7.html>:

Starting with Linux 4.14, a security.capability extended attribute is

automatically created as (or converted to) a version 3 (VFS_CAP_REVISION_3)

attribute if both of the following are true:

• The thread writing the attribute resides in a noninitial user

namespace.

• The thread has the CAP_SETFCAP capability over the file inode [...].

When a VFS_CAP_REVISION_3 security.capability extended attribute is

created, the root user ID of the creating thread's user namespace is saved

in the extended attribute.

Correspondingly, when a version 3 security.capability attribute is

retrieved (getxattr(2)) by a process that resides inside a user namespace

that was created by the root user ID (or a descendant of that user

namespace), the returned attribute is (automatically) simplified to appear

as a version 2 attribute (i.e., the returned value is the size of a

version 2 attribute and does not include the root user ID).

Verifies V3-to-V2 coercion inside a matching user namespace, automatic

conversion of V2 writes inside a non-initial user namespace to V3 on disk,

and that reading a V3 attribute whose rootid cannot be mapped into the

reader's user namespace fails with EOVERFLOW.