projectatomic/rpm-ostree — pull request #14 by cgwalters (2014-07-02 00:38:55+00:00)
Title: compose tree: Read in security.capability xattrs

Per http://fedoraproject.org/wiki/Features/RemoveSETUID
many programs (famously /usr/bin/ping) switched to using
"file capabilities" instead of setuid.

rpm-ostree had code to specially handle SELinux labels, but was
discarding other xattrs. Let's just whitelist reading in
security.capability.