linux capabilities: normalization and auditbeat process support

CHANGELOG.next.asciidoc

@@ -154,6 +154,7 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 
 - Add `ignore_errors` option to audit module. {issue}15768[15768] {pull}36851[36851]
 - Fix copy arguments for strict aligned architectures. {pull}36976[36976]
+- Add linux capabilities to processes in the system/process. {pull}37453[37453]
 
 *Filebeat*
 

auditbeat/docs/fields.asciidoc

@@ -18925,6 +18925,28 @@ type: keyword
 --
 
 
+*`process.thread.capabilities.effective`*::
++
+--
+This is the set of capabilities used by the kernel to perform permission checks for the thread.
+
+type: keyword
+
+example: ["CAP_BPF", "CAP_SYS_ADMIN"]
+
+--
+
+*`process.thread.capabilities.permitted`*::
++
+--
+This is a limiting superset for the effective capabilities that the thread may assume.
+
+type: keyword
+
+example: ["CAP_BPF", "CAP_SYS_ADMIN"]
+
+--
+
 [float]
 === hash
 

filebeat/input/journald/pkg/journalfield/conv.go

@@ -19,11 +19,11 @@
 
 import (
 	"fmt"
-	"math/bits"
 	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/elastic/beats/v7/libbeat/common/capabilities"
 	"github.com/elastic/elastic-agent-libs/logp"
 	"github.com/elastic/elastic-agent-libs/mapstr"
 )
@@ -190,72 +190,13 @@
 	if !ok {
 		return
 	}
-	w, err := strconv.ParseUint(c, 16, 64)
-	if err != nil {
-		return
-	}
-	if w == 0 {
+	caps, err := capabilities.FromString(c, 16)
+	if err != nil || len(caps) == 0 {
 		return
 	}
-	caps := make([]string, 0, bits.OnesCount64(w))
-	for i := 0; w != 0; i++ {
-		if w&1 != 0 {
-			if i < len(capTable) {
-				caps = append(caps, capTable[i])
-			} else {
-				caps = append(caps, strconv.Itoa(i))
-			}
-		}
-		w >>= 1
-	}
 	fields.Put("process.thread.capabilities.effective", caps)
 }
 
-// include/uapi/linux/capability.h
-var capTable = [...]string{
-	0:  "CAP_CHOWN",
-	1:  "CAP_DAC_OVERRIDE",
-	2:  "CAP_DAC_READ_SEARCH",
-	3:  "CAP_FOWNER",
-	4:  "CAP_FSETID",
-	5:  "CAP_KILL",
-	6:  "CAP_SETGID",
-	7:  "CAP_SETUID",
-	8:  "CAP_SETPCAP",
-	9:  "CAP_LINUX_IMMUTABLE",
-	10: "CAP_NET_BIND_SERVICE",
-	11: "CAP_NET_BROADCAST",
-	12: "CAP_NET_ADMIN",
-	13: "CAP_NET_RAW",
-	14: "CAP_IPC_LOCK",
-	15: "CAP_IPC_OWNER",
-	16: "CAP_SYS_MODULE",
-	17: "CAP_SYS_RAWIO",
-	18: "CAP_SYS_CHROOT",
-	19: "CAP_SYS_PTRACE",
-	20: "CAP_SYS_PACCT",
-	21: "CAP_SYS_ADMIN",
-	22: "CAP_SYS_BOOT",
-	23: "CAP_SYS_NICE",
-	24: "CAP_SYS_RESOURCE",
-	25: "CAP_SYS_TIME",
-	26: "CAP_SYS_TTY_CONFIG",
-	27: "CAP_MKNOD",
-	28: "CAP_LEASE",
-	29: "CAP_AUDIT_WRITE",
-	30: "CAP_AUDIT_CONTROL",
-	31: "CAP_SETFCAP",
-	32: "CAP_MAC_OVERRIDE",
-	33: "CAP_MAC_ADMIN",
-	34: "CAP_SYSLOG",
-	35: "CAP_WAKE_ALARM",
-	36: "CAP_BLOCK_SUSPEND",
-	37: "CAP_AUDIT_READ",
-	38: "CAP_PERFMON",
-	39: "CAP_BPF",
-	40: "CAP_CHECKPOINT_RESTORE",
-}
-
 func getStringFromFields(key string, fields mapstr.M) string {
 	value, _ := fields.GetValue(key)
 	str, _ := value.(string)
@@ -276,7 +217,7 @@
 }
 
 // helpers for creating a field conversion table.
 var ignoredField = Conversion{Dropped: true}
 
 func text(names ...string) Conversion {
 	return Conversion{Names: names, IsInteger: false, Dropped: false}

filebeat/input/journald/pkg/journalfield/conv_expand_test.go

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+//go:build linux && cgo
+
 package journalfield
 
 import (
@@ -121,47 +123,7 @@ var expandCapabilitiesTests = []struct {
 				"thread": mapstr.M{
 					"capabilities": mapstr.M{
 						"effective": []string{
-							"CAP_CHOWN",
-							"CAP_DAC_OVERRIDE",
-							"CAP_DAC_READ_SEARCH",
-							"CAP_FOWNER",
-							"CAP_FSETID",
-							"CAP_KILL",
-							"CAP_SETGID",
-							"CAP_SETUID",
-							"CAP_SETPCAP",
-							"CAP_LINUX_IMMUTABLE",
-							"CAP_NET_BIND_SERVICE",
-							"CAP_NET_BROADCAST",
-							"CAP_NET_ADMIN",
-							"CAP_NET_RAW",
-							"CAP_IPC_LOCK",
-							"CAP_IPC_OWNER",
-							"CAP_SYS_MODULE",
-							"CAP_SYS_RAWIO",
-							"CAP_SYS_CHROOT",
-							"CAP_SYS_PTRACE",
-							"CAP_SYS_PACCT",
-							"CAP_SYS_ADMIN",
-							"CAP_SYS_BOOT",
-							"CAP_SYS_NICE",
-							"CAP_SYS_RESOURCE",
-							"CAP_SYS_TIME",
-							"CAP_SYS_TTY_CONFIG",
-							"CAP_MKNOD",
-							"CAP_LEASE",
-							"CAP_AUDIT_WRITE",
-							"CAP_AUDIT_CONTROL",
-							"CAP_SETFCAP",
-							"CAP_MAC_OVERRIDE",
-							"CAP_MAC_ADMIN",
-							"CAP_SYSLOG",
-							"CAP_WAKE_ALARM",
-							"CAP_BLOCK_SUSPEND",
-							"CAP_AUDIT_READ",
-							"CAP_PERFMON",
-							"CAP_BPF",
-							"CAP_CHECKPOINT_RESTORE",
+							"CAP_ALL",
 						},
 					},
 				},
@@ -228,8 +190,8 @@ var expandCapabilitiesTests = []struct {
 							"CAP_PERFMON",
 							"CAP_BPF",
 							"CAP_CHECKPOINT_RESTORE",
-							"41",
-							"42",
+							"CAP_41",
+							"CAP_42",
 						},
 					},
 				},