capability.LastCap fails when /proc/sys/kernel/cap_last_cap is unavailable #265

capability.LastCap() returns an error when /proc/sys/kernel/cap_last_cap is unavailable. This can cause callers to fail after entering a rootfs that does not contain a /proc mount.

I encountered this through runc 1.3.4. With an OCI configuration containing mounts: [] and five explicitly empty capability sets, runc create failed 5/5 times with:

open /proc/sys/kernel/cap_last_cap: no such file or directory
The workload was /bin/true, so it did not access /proc. Adding only a private /proc mount made runc succeed 5/5 times. crun and youki accepted the original configuration.
It appears that ListSupported() calls LastCap(), which directly opens /proc/sys/kernel/cap_last_cap and returns the error without a fallback.
I expected capability handling, especially for empty capability sets, not to require this file to exist inside the current rootfs.
Original runc report and full reproducer:
opencontainers/runc#5551