Detect kernel support of PR_CAP_AMBIENT at runtime

[ntkme]

The issue I'm facing is that I have containers build with 5.x kernel headers, and the kernel versions I need to support for actual deployment is ranging between 4.1 - 5.x, which is a mix of kernels that may and may not support PR_CAP_AMBIENT.

Building the support of PR_CAP_AMBIENT then run libcap-ng on kernel without actual support would fail almost every function. Build different versions of containers with different kernel headers is not ideal.

If we can detect the support of PR_CAP_AMBIENT at runtime instead of compile time then we can conditionally run code related to PR_CAP_AMBIENT, thus a single build of libcap-ng using new kernel headers can run on both old and new kernel without causing problem.

I'm not really a C programmer, but I imagine we can do something like this:

#ifdef PR_CAPBSET_DROP
int has_capbset_drop = 1;
rc = prctl(PR_CAPBSET_READ, 0, 0, 0, 0);
if (rc < 0 && errno == EINVAL) { // EINVAL -> kernel does not support PR_CAPBSET_DROP
  has_capbset_drop = 0;
}
if (has_capbset_drop) {
  ...
}
#endif

#ifdef PR_CAP_AMBIENT
int has_ambient = 1;
rc = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, 0, 0, 0);
if (rc < 0 && errno == EINVAL) { // EINVAL -> kernel does not support PR_CAP_AMBIENT
  has_ambient = 0;
}
if (has_ambient) {
  ...
}
#endif

I'd happy to make a PR, but I want to hear some thoughts before I proceed.

[stevegrubb]

Hi, thanks for the patch. I'll look into this in a couple days. I agree that runtime detection might be a better way to go.

[stevegrubb]

I am readying a new libcap-ng release. I looked at the patch. I would do a couple things different such as declaring the variables static rather than hidden. And there are some style issues such as using all caps for defines rather than variables. Aside from that, I think the patch looks generally good. What I'm considering doing is to just apply the patch "as is" and then put another patch over it fixing the style issues.

[ntkme]

Sounds good. Thanks for looking at this!

[stevegrubb]

The patch has been applied. Thanks!

[agnostic-apollo]

Thank you both for this. Solved issues for android/termux as well. termux/termux-packages#8198