linux capabilities: normalization and auditbeat process support

auditbeat/docs/fields.asciidoc

@@ -18925,6 +18925,28 @@ type: keyword
 --
 
 
+*`process.thread.capabilities.effective`*::
++
+--
+This is the set of capabilities used by the kernel to perform permission checks for the thread.
+
+type: keyword
+
+example: ["CAP_BPF", "CAP_SYS_ADMIN"]
+
+--
+
+*`process.thread.capabilities.permitted`*::
++
+--
+This is a limiting superset for the effective capabilities that the thread may assume.
+
+type: keyword
+
+example: ["CAP_BPF", "CAP_SYS_ADMIN"]
+
+--
+
 [float]
 === hash
 

filebeat/input/journald/pkg/journalfield/conv.go

@@ -19,11 +19,11 @@
 
 import (
 	"fmt"
-	"math/bits"
 	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/elastic/beats/v7/libbeat/common/capabilities"
 	"github.com/elastic/elastic-agent-libs/logp"
 	"github.com/elastic/elastic-agent-libs/mapstr"
 )
@@ -190,72 +190,13 @@
 	if !ok {
 		return
 	}
-	w, err := strconv.ParseUint(c, 16, 64)
-	if err != nil {
-		return
-	}
-	if w == 0 {
+	caps, err := capabilities.FromString(c, 16)
+	if err != nil || len(caps) == 0 {
 		return
 	}
-	caps := make([]string, 0, bits.OnesCount64(w))
-	for i := 0; w != 0; i++ {
-		if w&1 != 0 {
-			if i < len(capTable) {
-				caps = append(caps, capTable[i])
-			} else {
-				caps = append(caps, strconv.Itoa(i))
-			}
-		}
-		w >>= 1
-	}
 	fields.Put("process.thread.capabilities.effective", caps)
 }
 
-// include/uapi/linux/capability.h
-var capTable = [...]string{
-	0:  "CAP_CHOWN",
-	1:  "CAP_DAC_OVERRIDE",
-	2:  "CAP_DAC_READ_SEARCH",
-	3:  "CAP_FOWNER",
-	4:  "CAP_FSETID",
-	5:  "CAP_KILL",
-	6:  "CAP_SETGID",
-	7:  "CAP_SETUID",
-	8:  "CAP_SETPCAP",
-	9:  "CAP_LINUX_IMMUTABLE",
-	10: "CAP_NET_BIND_SERVICE",
-	11: "CAP_NET_BROADCAST",
-	12: "CAP_NET_ADMIN",
-	13: "CAP_NET_RAW",
-	14: "CAP_IPC_LOCK",
-	15: "CAP_IPC_OWNER",
-	16: "CAP_SYS_MODULE",
-	17: "CAP_SYS_RAWIO",
-	18: "CAP_SYS_CHROOT",
-	19: "CAP_SYS_PTRACE",
-	20: "CAP_SYS_PACCT",
-	21: "CAP_SYS_ADMIN",
-	22: "CAP_SYS_BOOT",
-	23: "CAP_SYS_NICE",
-	24: "CAP_SYS_RESOURCE",
-	25: "CAP_SYS_TIME",
-	26: "CAP_SYS_TTY_CONFIG",
-	27: "CAP_MKNOD",
-	28: "CAP_LEASE",
-	29: "CAP_AUDIT_WRITE",
-	30: "CAP_AUDIT_CONTROL",
-	31: "CAP_SETFCAP",
-	32: "CAP_MAC_OVERRIDE",
-	33: "CAP_MAC_ADMIN",
-	34: "CAP_SYSLOG",
-	35: "CAP_WAKE_ALARM",
-	36: "CAP_BLOCK_SUSPEND",
-	37: "CAP_AUDIT_READ",
-	38: "CAP_PERFMON",
-	39: "CAP_BPF",
-	40: "CAP_CHECKPOINT_RESTORE",
-}
-
 func getStringFromFields(key string, fields mapstr.M) string {
 	value, _ := fields.GetValue(key)
 	str, _ := value.(string)
@@ -276,7 +217,7 @@
 }
 
 // helpers for creating a field conversion table.
 var ignoredField = Conversion{Dropped: true}
 
 func text(names ...string) Conversion {
 	return Conversion{Names: names, IsInteger: false, Dropped: false}

filebeat/input/journald/pkg/journalfield/conv_expand_test.go

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+//go:build linux && cgo
+
 package journalfield
 
 import (
@@ -121,47 +123,7 @@ var expandCapabilitiesTests = []struct {
 				"thread": mapstr.M{
 					"capabilities": mapstr.M{
 						"effective": []string{
-							"CAP_CHOWN",
-							"CAP_DAC_OVERRIDE",
-							"CAP_DAC_READ_SEARCH",
-							"CAP_FOWNER",
-							"CAP_FSETID",
-							"CAP_KILL",
-							"CAP_SETGID",
-							"CAP_SETUID",
-							"CAP_SETPCAP",
-							"CAP_LINUX_IMMUTABLE",
-							"CAP_NET_BIND_SERVICE",
-							"CAP_NET_BROADCAST",
-							"CAP_NET_ADMIN",
-							"CAP_NET_RAW",
-							"CAP_IPC_LOCK",
-							"CAP_IPC_OWNER",
-							"CAP_SYS_MODULE",
-							"CAP_SYS_RAWIO",
-							"CAP_SYS_CHROOT",
-							"CAP_SYS_PTRACE",
-							"CAP_SYS_PACCT",
-							"CAP_SYS_ADMIN",
-							"CAP_SYS_BOOT",
-							"CAP_SYS_NICE",
-							"CAP_SYS_RESOURCE",
-							"CAP_SYS_TIME",
-							"CAP_SYS_TTY_CONFIG",
-							"CAP_MKNOD",
-							"CAP_LEASE",
-							"CAP_AUDIT_WRITE",
-							"CAP_AUDIT_CONTROL",
-							"CAP_SETFCAP",
-							"CAP_MAC_OVERRIDE",
-							"CAP_MAC_ADMIN",
-							"CAP_SYSLOG",
-							"CAP_WAKE_ALARM",
-							"CAP_BLOCK_SUSPEND",
-							"CAP_AUDIT_READ",
-							"CAP_PERFMON",
-							"CAP_BPF",
-							"CAP_CHECKPOINT_RESTORE",
+							"CAP_ALL",
 						},
 					},
 				},
@@ -228,8 +190,8 @@ var expandCapabilitiesTests = []struct {
 							"CAP_PERFMON",
 							"CAP_BPF",
 							"CAP_CHECKPOINT_RESTORE",
-							"41",
-							"42",
+							"CAP_41",
+							"CAP_42",
 						},
 					},
 				},

libbeat/common/capabilities/capabilities_linux.go

@@ -0,0 +1,209 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build linux
+
+package capabilities
+
+import (
+	"errors"
+	"math/bits"
+	"strconv"
+	"strings"
+
+	"kernel.org/pub/linux/libs/security/libcap/cap"
+)
+
+var (
+	// Tried to map an invalid capability ID: x < 0 || x >= 64.
+	errInvalidCapability = errors.New("invalid capability")
+
+	// Capabilities are linux only and this is returned on other
+	// systems for all the public functions. There is a generic
+	// errors.ErrUnsupported present in golang 1.21, but we still
+	// support 1.20.
+	ErrUnsupported = errors.New("capabilities are only supported in linux")
+
+	// The mask when all known capabilities are set.
+	allMask = (uint64(1) << uint64(cap.MaxBits())) - 1
+)
+
+// The capability set flag/vector, re-exported from
+// libcap(3). Inherit, Bound & Ambient not exported since we have no
+// use for it yet.
+type Flag = cap.Flag
+
+const (
+	// aka CapEff
+	Effective = cap.Effective
+	// aka CapPrm
+	Permitted = cap.Permitted
+)
+
+// True if sets are equal for the given flag/vector, errors out in
+// case any of the sets is malformed.
+func isEqual(flag Flag, a *cap.Set, b *cap.Set) (bool, error) {
+	d, err := a.Cf(b)
+	if err != nil {
+		return false, err
+	}
+
+	return !d.Has(flag), nil
+}
+
+// Convert the capability ID to a string suitable to be used in
+// ECS.
+// If capabiliy ID X is unknown, but valid (0 <= X < 64), "CAP_X"
+// will be returned instead. Fetches from an internal table built at
+// startup.
+var toECS = makeToECS()
+
+// Make toECS() which creates a map of every possible valid capability
+// ID on startup. Returns errInvalidCapabilty for an invalid ID.
+func makeToECS() func(int) (string, error) {
+	ecsNames := make(map[int]string)
+
+	for i := 0; i < 64; i++ {
+		c := cap.Value(i)
+		if i < int(cap.MaxBits()) {
+			ecsNames[i] = strings.ToUpper(c.String())
+		} else {
+			ecsNames[i] = strings.ToUpper("CAP_" + c.String())
+		}
+	}
+
+	return func(b int) (string, error) {
+		s, ok := ecsNames[b]
+		if !ok {
+			return "", errInvalidCapability
+		}
+		return s, nil
+	}
+}
+
+// True if the set has all the capabilities set for the given
+// flag/vector, see FromUint64 for a CAP_ALL explanation.
+var isAll = makeIsAll()
+
+// Make isAll(), there is no direct way to get a full capability set,
+// so we have to build one. Instead of building it for every call,
+// build it once on startup and don't expose it.
+func makeIsAll() func(Flag, *cap.Set) (bool, error) {
+	all := cap.NewSet()
+	for i := 0; i < int(cap.MaxBits()); i++ {
+		all.SetFlag(cap.Effective, true, cap.Value(i))
+		all.SetFlag(cap.Permitted, true, cap.Value(i))
+		all.SetFlag(cap.Inheritable, true, cap.Value(i))
+	}
+
+	return func(flag Flag, set *cap.Set) (bool, error) {
+		return isEqual(flag, set, all)
+	}
+}
+
+// Like isAll(), but for the empty set, here for symmetry.
+var isEmpty = makeIsEmpty()
+
+// Make isEmpty(), the corollary to makeIsFull.
+func makeIsEmpty() func(Flag, *cap.Set) (bool, error) {
+	empty := cap.NewSet()
+
+	return func(flag Flag, set *cap.Set) (bool, error) {
+		return isEqual(flag, set, empty)
+	}
+}
+
+// Fetch the capabilities of pid for a given flag/vector and convert
+// it to the representation used in ECS. cap.GetPID() fetches it with
+// SYS_CAPGET. Check FromUint64 for a definition of []{"CAP_ALL"}.
+// May return ErrUnsupported on "not linux".
+func FromPid(flag Flag, pid int) ([]string, error) {
+	set, err := cap.GetPID(pid)
+	if err != nil {
+		return []string{}, err
+	}
+	empty, err := isEmpty(flag, set)
+	if err != nil || empty {
+		return []string{}, err
+	}
+	all, err := isAll(flag, set)
+	if err != nil {
+		return []string{}, err
+	}
+	if all {
+		return []string{"CAP_ALL"}, nil
+	}
+
+	var sl []string
+	for i := 0; i < int(cap.MaxBits()); i++ {
+		c := cap.Value(i)
+		v, err := set.GetFlag(flag, c)
+		if err != nil {
+			return []string{}, err
+		}
+		if !v {
+			continue
+		}
+		s, err := toECS(i)
+		// impossible since MaxBits <= 64
+		if err != nil {
+			return []string{}, err
+		}
+		sl = append(sl, s)
+	}
+
+	return sl, err
+}
+
+// Convert a uint64 to the capabilities representation used in ECS. If
+// all bits are set, []{"CAP_ALL"} is returned. The definition of what
+// CAP_ALL is depends on the host as libcap(3) will probe the maximum
+// number of capabilities on startup via cap.MaxBits().
+// May return ErrUnsupported on "not linux".
+func FromUint64(w uint64) ([]string, error) {
+	if w == allMask {
+		return []string{"CAP_ALL"}, nil
+	}
+
+	sl := make([]string, 0, bits.OnesCount64(w))
+	for i := 0; w != 0; i++ {
+		if w&1 != 0 {
+			s, err := toECS(i)
+			// impossible since MaxBits <= 64
+			if err != nil {
+				return []string{}, err
+			}
+			sl = append(sl, s)
+		}
+		w >>= 1
+	}
+
+	return sl, nil
+}
+
+// Convert a string to the capabilities representation used in
+// ECS. Example input: "1ffffffffff", 16. See FromUint64 for details
+// about CAP_ALL.
+// May return ErrUnsupported on "not linux".
+func FromString(s string, base int) ([]string, error) {
+	w, err := strconv.ParseUint(s, 16, 64)
+	if err != nil {
+		return []string{}, err
+	}
+
+	return FromUint64(w)
+}