cap_ambient_invariant_ok
if (WARN_ON(!cap_ambient_invariant_ok(new)))
if (WARN_ON(!cap_ambient_invariant_ok(old)))