feat(decl/proc-chain): add user and capabilities support

go.mod

@@ -29,6 +29,7 @@ require (
 	k8s.io/cli-runtime v0.31.1
 	k8s.io/client-go v0.31.1
 	k8s.io/kubectl v0.31.1
+	kernel.org/pub/linux/libs/security/libcap/cap v1.2.72
 )
 
 // avoid indirect dependency mergo error:
@@ -122,6 +123,7 @@ require (
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240903163716-9e1beecbcb38 // indirect
 	k8s.io/utils v0.0.0-20240902221715-702e33fdd3c3 // indirect
+	kernel.org/pub/linux/libs/security/libcap/psx v1.2.72 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/kustomize/api v0.17.3 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.17.2 // indirect

go.sum

@@ -416,6 +416,10 @@ k8s.io/kubectl v0.31.1 h1:ih4JQJHxsEggFqDJEHSOdJ69ZxZftgeZvYo7M/cpp24=
 k8s.io/kubectl v0.31.1/go.mod h1:aNuQoR43W6MLAtXQ/Bu4GDmoHlbhHKuyD49lmTC8eJM=
 k8s.io/utils v0.0.0-20240902221715-702e33fdd3c3 h1:b2FmK8YH+QEwq/Sy2uAEhmqL5nPfGYbJOcaqjeYYZoA=
 k8s.io/utils v0.0.0-20240902221715-702e33fdd3c3/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.72 h1:SqLZbTqwcNxctcdM5yb6OcO3lFJNtRgDJoFeca+5hP0=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.72/go.mod h1:DqOj+O+b5nV0YW49IVU6WlhVw0oHpC1LmerDRHvcbjE=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.72 h1:Lnu8woGlvNdwCbBa5urxGO+L5gp647lIZMg0vP+upuU=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.72/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kustomize/api v0.17.3 h1:6GCuHSsxq7fN5yhF2XrC+AAr8gxQwhexgHflOAD/JJU=

pkg/capability/capability.go

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2024 The Falco Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package capability
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+
+	"golang.org/x/sys/unix"
+	"kernel.org/pub/linux/libs/security/libcap/cap"
+)
+
+// Parse the provided capabilities string and returns the parsed capability state. The provided capabilities must be
+// encoded using the syntax specified in cap_from_text(3).
+func Parse(capabilities string) (*cap.Set, error) {
+	return cap.FromText(capabilities)
+}
+
+// RunWithSecBitNoRootEnabled runs the provided function with the thread secure bit SECBIT_NOROOT enabled.
+func RunWithSecBitNoRootEnabled(f func() error) error {
+	runtime.LockOSThread()
+	secureBits, err := unix.PrctlRetInt(unix.PR_GET_SECUREBITS, 0, 0, 0, 0)
+	if err != nil {
+		return fmt.Errorf("error retrieving thread secure bits: %w", err)
+	}
+
+	secureBitsPlusSecBitNoRoot := secureBits | int(cap.SecbitNoRoot)
+	return runWithSecBits(f, secureBits, secureBitsPlusSecBitNoRoot)
+}
+
+// RunWithSecBitNoRootDisabled runs the provided function with the thread secure bit SECBIT_NOROOT disabled.
+func RunWithSecBitNoRootDisabled(f func() error) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	secureBits, err := unix.PrctlRetInt(unix.PR_GET_SECUREBITS, 0, 0, 0, 0)
+	if err != nil {
+		return fmt.Errorf("error retrieving thread secure bits: %w", err)
+	}
+
+	secureBitsMinusSecBitNoRoot := secureBits & ^int(cap.SecbitNoRoot)
+	return runWithSecBits(f, secureBits, secureBitsMinusSecBitNoRoot)
+}
+
+// runWithSecBits runs the provided function with the new secure bits set, and restores the old secure bits set at the
+// end of its execution.
+func runWithSecBits(f func() error, oldSecBits, newSecBits int) (err error) {
+	if oldSecBits == newSecBits {
+		return runFuncAndWrapErr(f)
+	}
+
+	if err := unix.Prctl(unix.PR_SET_SECUREBITS, uintptr(newSecBits), 0, 0, 0); err != nil {
+		if errors.Is(err, unix.EPERM) {
+			err = fmt.Errorf("%w (consider adding the CAP_SETPCAP capability)", err)
+		}
+		return fmt.Errorf("error setting thread secure bits: %w", err)
+	}
+	defer func() {
+		if e := unix.Prctl(unix.PR_SET_SECUREBITS, uintptr(oldSecBits), 0, 0, 0); e != nil {
+			if errors.Is(e, unix.EPERM) {
+				e = fmt.Errorf("%w (consider adding the CAP_SETPCAP capability)", e)
+			}
+			e = fmt.Errorf("error restoring thread secure bits: %w", e)
+			if err != nil {
+				err = fmt.Errorf("%w; %w", err, e)
+			} else {
+				err = e
+			}
+		}
+	}()
+
+	return runFuncAndWrapErr(f)
+}
+
+// runFuncAndWrapErr runs the provided function and wraps the returned error with FuncError.
+func runFuncAndWrapErr(f func() error) error {
+	if err := f(); err != nil {
+		return &FuncError{err: err}
+	}
+	return nil
+}
+
+// FuncError wraps the error produced by the execution of the function provided to RunWithSecBitNoRootEnabled and
+// RunWithSecBitNoRootDisabled.
+type FuncError struct {
+	err error
+}
+
+func (e *FuncError) Error() string {
+	return e.err.Error()
+}

pkg/capability/doc.go

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2024 The Falco Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package capability provides utilities for capabilities manipulation.
+package capability