Fix ordering for AttachRequest as well

Author: bleggett

rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.89.0"
+channel = "1.95.0"
 components = ["rustfmt", "rust-std", "clippy"]

src/wrap.rs

@@ -844,8 +844,6 @@ impl Wrappable for AttachRequest {
             warn!("unable to set process limits");
         }
 
-        apply_capabilities(self.capabilities.as_ref())?;
-
         // Ensure the process receives the desired out-of-memory score adjustment.
         if let Some(score) = self.exec.oom_score_adj {
             fs::write("/proc/self/oom_score_adj", score.to_string())?;
@@ -854,11 +852,18 @@ impl Wrappable for AttachRequest {
         debug!("all namespaces joined -- forking child");
         fork_and_wait()?;
 
+        // Mirror CreateRequest ordering: SECBIT_NO_SETUID_FIXUP first so a UID
+        // change from 0 to non-zero doesn't clear the permitted/effective cap
+        // sets, then change UID/GID, then apply caps as the final step before
+        // exec. Applying caps before the UID change would silently drop any
+        // raised caps for non-root targets.
+        set_keep_caps()?;
         apply_gid_uid(
             self.exec.gid,
             self.exec.uid,
             self.exec.supplemental_gids.as_ref(),
         )?;
+        apply_capabilities(self.capabilities.as_ref())?;
 
         self.exec.execute()
     }