check CAP_BPF should use bit shift

[hengyoush]

Describe the bug
Current code:

ecapture/cli/cmd/env_detection.go

Lines 46 to 61 in 91b8be1

	func detectBpfCap() error {
	// BPF 权限检测
	hdr := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
	var data [2]unix.CapUserData // why 2? pls check https://github.com/golang/go/issues/44312
	err := unix.Capget(&hdr, &data[0])
	if err != nil {
	return fmt.Errorf("failed to get the capabilities of the current process: %v", err)
	}
	haveBpfCap := data[0].Permitted&unix.CAP_BPF != 0
	if !haveBpfCap {
	return fmt.Errorf("the current user does not have CAP_BPF to load bpf programs. Please run as root or use sudo or add the --privileged=true flag for Docker.")
	}
	return nil
	}

Use haveBpfCap := data[0].Permitted&unix.CAP_BPF != 0 .
But according to the linux man pages: https://man7.org/linux/man-pages/man2/capset.2.html:

Note that the CAP_* values are bit indexes and need to be bit-shifted before ORing into the bit fields.

It should change to haveBpfCap := data[0].Permitted&(1<<unix.CAP_BPF) != 0.

If this is indeed a mistake, i can submit a pr to fix it.

[dosubot]

The current implementation haveBpfCap := data[0].Permitted&unix.CAP_BPF != 0 is incorrect because CAP_* values are bit indexes and should be bit-shifted before being used in bitwise operations. The correct implementation should be haveBpfCap := data[0].Permitted&(1<<unix.CAP_BPF) != 0, as per the Linux man pages ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[Asphaltt]

If this is indeed a mistake, i can submit a pr to fix it.

Indeed. Pls send a PR to fix it.

https://github.com/torvalds/linux/blob/0bc21e701a6ffacfdde7f04f87d664d82e8a13bf/include/uapi/linux/capability.h#L383-L412

If CAP_BPF is not available, pls check CAP_SYS_ADMIN instead.

[hengyoush]

Okay, i will send a pr later today.

[Asphaltt]

More hint for you:

static inline bool bpf_capable(void)
{
	return capable(CAP_BPF) || capable(CAP_SYS_ADMIN);
}

From commit torvalds/linux@a17b53c ("bpf, capability: Introduce CAP_BPF") v5.8 kernel.

[Asphaltt]

The way to check whether CAP_BPF is available is to read /proc/sys/kernel/cap_last_cap.