Comment 1 for bug 1641549

Again, avila's kernel is pretty outdated, and its user namespace support is so poor that it's actually mis-behave on a certain security related operations.

In security/commoncap.c, function cap_prctl_drop, it should check `ns_capable(...)`, not just `capable(...)`. See https://github.com/lxc/lxd/issues/2039 . At lease commit 160da84 "userns: Allow PR_CAPBSET_DROP in a user namespace" has to be cherry-picked, but besides that, I also found a lot similar places to be fixed.