feat: add support to add and drop linux capabilities

[maxgio92]

This commit adds the configuration to add and drop Linux capabilies to the container for bubblewrap and docker runners, enabling a declarative way to do least privilege. The capabilities added or dropped are relative to the minimum set of capabilities Docker sets. They are applied to all both build and test pipelines.

Furthermore, the minimum set of process capabilities in Bubblewrap container is now the same of Docker default capabilities, to improve result consistency.

Fixes #1703

Melange Pull Request Template

Functional Changes

• This change can build all of Wolfi without errors (describe results in notes)

Notes:

SCA Changes

• Examining several representative APKs show no regression / the desired effect (details in notes)

Notes:

Linter

• The new check is clean across Wolfi
• The new check is opt-in or a warning

Notes:

[maxgio92]

This is the cost of tracking and aligning to Docker default capabilities.

[maxgio92]

Capability drop instead I think should be responsibility of the single runner (e.g. always dropping cap_sys_admin).

[jonjohnsonjr]

Can we fold this into the Capabilities field above?

[maxgio92]

Sure @jonjohnsonjr. Addressed with f2a5a53

[jonjohnsonjr]

Can you introduce a new Capabilities object to track what's in Build? We probably want the ability to "drop" capabilities too and it would be nice if they lived in the same struct and mirrored Build for clarity. I'd also make this just "add" so it'd look something like:

capabilities:
  add: ["SETUID"]

And in the future:

capabilities:
  add: ["SETUID"]
  drop: ["NET_ADMIN"]

Or whatever.

[maxgio92]

I like it @jonjohnsonjr . I just addressed it, alongside the capability drop option.

Do we want to add a specialized test for this? In the meantime I used the following fixture:

package:
  name: caps
  description: caps add-drop feature test
  version: 0.1.0

capabilities:
  add:
    - CAP_NET_ADMIN
  drop:
    - CAP_SYS_ADMIN
    - CAP_SYS_CHROOT

environment:
  contents:
    packages:
      - busybox
      - cmd:capsh

pipeline:
  - name: Test default effective capability
    runs: |
      capsh --decode=$(grep CapEff /proc/self/status | cut -d ':' -f2 | xargs) | grep -i cap_dac_override
  - name: Test added non-default effective capability
    runs: |
      capsh --decode=$(grep CapEff /proc/self/status | cut -d ':' -f2 | xargs) | grep -i cap_net_admin
  - name: Test dropped default effective capability
    runs: |
      capsh --decode=$(grep CapEff /proc/self/status | cut -d ':' -f2 | xargs) | grep -vi cap_sys_chroot

[jonjohnsonjr]

This is great, yes, can you add this as a test and in the examples/ ?

[maxgio92]

Thanks @jonjohnsonjr Just added e2e tests for both build and test.
Plus a pipeline example with iproute.