upstream addition of masking all capabilities above CAP_LAST_CAP did not account for linux-vserver CAP_CONTEXT https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.14.y&id=1ae2c97a0a284ca73754acd2b3be33fe4f2505b2 diff -urNpd linux-3.14.22-vs2.3.6.13~/include/linux/capability.h linux-3.14.22-vs2.3.6.13/include/linux/capability.h --- linux-3.14.22-vs2.3.6.13~/include/linux/capability.h 2014-10-15 01:42:04.000000000 -0500 +++ linux-3.14.22-vs2.3.6.13/include/linux/capability.h 2014-10-15 22:00:45.000000000 -0500 @@ -79,7 +79,8 @@ extern const kernel_cap_t __cap_init_eff #else /* HAND-CODED capability initializers */ #define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1) -#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1) +#define CAP_LAST_U32_VALID_MASK ((CAP_TO_MASK(CAP_LAST_CAP + 1) -1) \ + | CAP_TO_MASK(CAP_CONTEXT)) # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) # define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})