runc aways open "/proc/sys/kernel/cap_last_cap"

Description

runc aways open "/proc/sys/kernel/cap_last_cap" because it it done it init().

func init() {
	var hdr capHeader
	capget(&hdr, nil)
	capVers = hdr.version

	if initLastCap() == nil {
		CAP_LAST_CAP = capLastCap
		if capLastCap > 31 {
			capUpperMask = (uint32(1) << (uint(capLastCap) - 31)) - 1
		} else {
			capUpperMask = 0
		}
	}
}

func initLastCap() error {
	if capLastCap != 0 {
		return nil
	}

	f, err := os.Open("/proc/sys/kernel/cap_last_cap")
	if err != nil {
		return err
	}
	defer f.Close()

	var b []byte = make([]byte, 11)
	_, err = f.Read(b)
	if err != nil {
		return err
	}

	fmt.Sscanf(string(b), "%d", &capLastCap)

	return nil
}

Steps to reproduce the issue

1.runc --help will read /proc/sys/kernel/cap_last_cap

Describe the results you received and expected

read /proc/sys/kernel/cap_last_cap when needed

What version of runc are you using?

1.1.12

Host OS information

linux

Host kernel information

any

Start by tracing the Go package initialization through init() and initLastCap(), focusing on why runc --help opens /proc/sys/kernel/cap_last_cap. Reproduce the access with runc --help and inspect the surrounding capability code. Done means the file is read only when capability information is needed, while normal help behavior no longer opens it.