This was first reported as https://bugzilla.redhat.com/show_bug.cgi?id=2062648

The glibc wrapper prctl() returns -1 and sets the errno in case of error. In various functions libcap overwrites the errno value using the value returned by prctl(), making all errors to be reported as EPERM (which is 1).

For example in cap_proc.c:

int cap_get_bound(cap_value_t cap)
{
    int result;

    result = prctl(PR_CAPBSET_READ, pr_arg(cap), pr_arg(0));
    if (result < 0) {
	errno = -result;
	return -1;
    }
    return result;
}