title: setcap cap_net_admin in linux containers prevents user access to every file
body: <p>I have a tcpdump application in a CentOS container.  I was trying to run tcpdump as nonroot.  Following this forum post: <a href="https://askubuntu.com/questions/530920/tcpdump-permissions-problem">https://askubuntu.com/questions/530920/tcpdump-permissions-problem</a> (and some other documentation that reinforced this), I tried to use setcap cap_net_admin+eip /path/to/tcpdump in the container.</p>
  
  <p>After running this, I tried to run tcpdump as a different user (with permissions to tcpdump) and I got "Operation Not Permitted".  I then tried to run it as root which had previously been working and also got, "Operation Not Permitted".  After running getcap, I verified that the permissions were what they should be.  I thought it may be my specific use case so I tried running the setcap command against several other executables.  Every single executable returned "Operation Not Permitted" until I ran setcap -r /filepath.</p>
  
  <p>Any ideas on how I can address this issue, or even work around it without using root to run tcpdump?</p>