Bug 1765417

Description of problem:
When runing podman container that  specifies --cap-add CAP_SYS_ADMIN(This option specifies that perform a range of system administration operations [1])  and performing nfs mount in it, but the result fails. which is a different behavior from docker that specifiles "--cap-add  SYS_ADMIN" . ( If this behavior is your expected.)

Version-Release number of selected component (if applicable):
kernel-4.18.0-147.el8.x86_64

Steps to Reproduce:
[root@xxx ~]# uname -r
4.18.0-147.el8.x86_64
[root@SERVER ~]# mkdir /export
mkdir: cannot create directory ‘/export’: File exists
[root@SERVER ~]# echo "/export *(rw,no_root_squash)" > /etc/exports
[root@SERVER ~]# systemctl restart nfs-server
[root@SERVER ~]#  exportfs -v
/export       <world>(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
###############
Test in podman:
###############
[root@SERVER ~]# podman run --cap-add CAP_SYS_ADMIN -it centos:8
                                     ^^^^^^^^^^^^^^^   This option specifies that perform a range of system administration operations  
[root@a179291fad10 /]# yum install -y nfs-utils &> /dev/null
[root@a179291fad10 /]# showmount -e $SERVER           
Export list for $SERVER:
/export *
[root@a179291fad10 /]# mount $SERVER:/export /mnt -vvv
mount.nfs: timeout set for Thu Oct 24 02:59:30 2019
mount.nfs: trying text-based options 'vers=4.2,addr=10.73.4.209,clientaddr=10.88.0.5'
mount.nfs: mount(2): No such device      <<<<<<<<<<<<<<<<<  fail 
mount.nfs: No such device                                                                                                   
(If this is your expectation, do you need to return a clear prompt so that the customer can easily understand the cause of the error)


###############
Test in docker:
###############
[root@SERVER ~]# docker run  --cap-add SYS_ADMIN -it centos:8
                                       ^^^^^^^^^
[root@0d85c14ee55c /]# showmount -e $SERVER
Export list for $SERVER:
/export *
[root@0d85c14ee55c /]# mount $SERVER:/export /mnt -vvv                <<<<<<<<<<< pass
mount.nfs: timeout set for Thu Oct 24 03:18:43 2019
mount.nfs: trying text-based options 'vers=4.2,addr=10.73.4.169,clientaddr=172.17.0.2'
[root@0d85c14ee55c /]# df -h | grep /mnt
Filesystem                                     1K-blocks    Used Available Use% Mounted on
$SERVER:/export  52399104 4132864  48266240   8% /mnt


Additional info:

[1] http://man7.org/linux/man-pages/man7/capabilities.7.html
>   CAP_SYS_ADMIN
              Note: this capability is overloaded; see Notes to kernel
              developers, below.

              * Perform a range of system administration operations
                including: quotactl(2), mount(2), umount(2), pivot_root(2),
                setdomainname(2);
...
Don't choose CAP_SYS_ADMIN if you can possibly avoid it!  A vast
proportion of existing capability checks are associated with this
capability (see the partial list above).  It can plausibly be
called "the new root", since on the one hand, it confers a wide
range of powers, and on the other hand, its broad scope means that
this is the capability that is required by many privileged
programs.