fix: allow CAP_CHOWN in Ambient set

Author: pkoutsovasilis

internal/pkg/agent/cmd/container_init_linux.go

@@ -120,7 +120,7 @@ func getAmbientCapabilitiesFromEffectiveSet() ([]cap.Value, error) {
 	for capVal := cap.Value(0); capVal < cap.MaxBits(); capVal++ {
 
 		switch capVal {
-		case cap.CHOWN, cap.SETPCAP, cap.SETFCAP:
+		case cap.SETPCAP, cap.SETFCAP:
 			// don't set these as they shouldn't be required by any exec'ed child process
 			continue
 		default:

internal/pkg/agent/cmd/container_init_test.go

@@ -173,13 +173,13 @@ func Test_getAmbientCapabilitiesFromEffectiveSet(t *testing.T) {
 	}{
 		{
 			name:         "no ambient caps",
-			procCaps:     []cap.Value{cap.CHOWN, cap.SETPCAP, cap.SETFCAP},
+			procCaps:     []cap.Value{cap.SETPCAP, cap.SETFCAP},
 			expectedCaps: []cap.Value(nil),
 		},
 		{
 			name:         "no ambient caps",
 			procCaps:     []cap.Value{cap.CHOWN, cap.SETPCAP, cap.SETFCAP, cap.BPF},
-			expectedCaps: []cap.Value{cap.BPF},
+			expectedCaps: []cap.Value{cap.CHOWN, cap.BPF},
 		},
 	}