Some distros put sys/capability.h into libcap-dev or
similiar, which is a bit unforunate, we don't need
libcap-dev or anything like that.
Since we anyway only used the capget()/capset(), we can
just define a simple wrapper and call the syscall directly
and therefore avoid above mentioned issue.
We cannot assume that landlock is enabled if we can compile it.
Even if it's enabled in the kernel it may still not be loaded.
We fill fallback to chroot/bind-mounts if we can.
If we can't (because path policies have landlock-specific options),
we can't do that either.
Closes: #21
89749bd03b，至371c6a94b6比较371c6a94b6，至ac3e84ed16比较Test for blacklist:
WIP low-level seccomp arg filter interface为 WIP pledge/low-level seccomp arg filter interface7bfa7f5961，至08a2445c26比较fa473601d3，至eca3b3d622比较eca3b3d622，至c7991ceefa比较9a95ad0c6a，至34b58c5b32比较45f5f16bb8，至d742397b52比较beeae95fe1，至72ee3b3d74比较72ee3b3d74，至a7a9c6962a比较3e4ae74203，至ca0f82790c比较Merged
合并请求已关闭