minijail: Read the last valid cap value earlier.

The maximum valid capability of the kernel is read from /proc.
However since the ability to change mount namespaces and pivot root were
added, /proc might not be available when running drop_caps.  To allow
capabilities to be dropped even if entering a new mount namespace, cache
the last valid cap earlier and pass it to drop_caps.

Change-Id: I7adc017f0cdaa242d9348495815bbb4e70a74463
Signed-off-by: Dylan Reid <>
1 file changed