feat(enforcer) : Capabilities support

[Aryan-sharma11]

Feature Request

Short Description
Currently, we do not support capabilities with BPFLSM enforcer.

Task lists

• Support for enforcement of capabilities rules - ( using CAPABLE hook ) feat: Add capabilities support for BPFLSM #1543
• Implement observability for Linux capabilities in ebpf monitor (probing cap_capable( ) function to trace capabilities)

[nyrahul]

• list of all the caps that will be supported? ( Should be supporting all the Linux capabilities ( around 40 ) .
• sample policies to be fulfilled. Policy
• high level design to achieve

[Aryan-sharma11]

We have implemented the capable hook for the enforcement of capabilities rules in BPFLSM in #1543, although for Observability right now we are keeping this on hold, as while implementing the Kprobe to trace capabiliities we observed that a lot of events were being generated, which was causing a lot of events being lost. Keeping this in mind and also the performance impact a new design discussion to handle this amount of events will be done with the team.