Description of problem:

Attempt to start /bin/dbus-daemon --system --fork in a container leaves no process running. Stracing the process shows message Failed to drop capabilities: Operation not permitted.

Version-Release number of selected component (if applicable):

3.10.0-123.el7.x86_64 on the host
docker-0.11.1-22.el7.x86_64 on the host
dbus-1.6.12-8.el7.x86_64 in the container

How reproducible:

Deterministic.

Steps to Reproduce:
1. Run strace -s 500 -f -o /tmp/dbus.strace /bin/dbus-daemon --system --fork
2. Check /tmp/dbus.strace

Actual results:

54    geteuid()                         = 0
54    capget({0 /* _LINUX_CAPABILITY_VERSION_??? */, 0}, NULL) = 0
54    gettid()                          = 54
54    prctl(PR_SET_KEEPCAPS, 1)         = 0
54    capset({_LINUX_CAPABILITY_VERSION_3, 54}, {CAP_SETGID|CAP_SETUID|CAP_AUDIT_WRITE, CAP_SETGID|CAP_SETUID|CAP_AUDIT_WRITE, 0}) = -1 EPERM (Operation not permitted)
54    epoll_ctl(3, EPOLL_CTL_DEL, 4, {0, {u32=0, u64=0}}) = 0
54    close(4)                          = 0
54    unlink("/var/run/dbus/system_bus_socket") = 0
54    unlink("/var/run/messagebus.pid") = 0
54    write(2, "Failed to start message bus: Failed to drop capabilities: Operation not permitted\n\n", 83) = 83
54    exit_group(1)                     = ?

The matching piece of source seems to be

      capng_clear (CAPNG_SELECT_BOTH);
      capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
                    CAP_AUDIT_WRITE);
      rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP);
      if (rc)
        {
          switch (rc) {
            default:
              dbus_set_error (error, DBUS_ERROR_FAILED,
                              "Failed to drop capabilities: %s\n",
                              _dbus_strerror (errno));
              break;

Expected results:

Dropping capabilities seems like an operation that should pass in a container.

Additional info: