capability demonstration

cap.py

import os
import sys

pid = os.getpid()
with open(f"/proc/{pid}/status") as fp:
    for line in fp.readlines():
        if line.startswith("Cap"):
            print(line.strip())

main.go

package main

import (
        "bufio"
        "fmt"
        "os"
        "syscall"
        "log"

        "kernel.org/pub/linux/libs/security/libcap/cap"
)

func main() {
        pid := os.Getpid()
        status := fmt.Sprintf("/proc/%d/status", pid)
        fp, err := os.Open(status)
        if err != nil {
                log.Fatal(err)
        }
        defer fp.Close()
        scanner := bufio.NewScanner(fp)
        for scanner.Scan() {
                line := scanner.Text()
                if line[:3] == "Cap" {
                        fmt.Println(line)
                }
        }

        log.Printf("this process has these caps: %q", cap.GetProc())
        flag, err := cap.GetProc().GetFlag(cap.Permitted, cap.SYS_ADMIN)
        if err != nil {
                log.Fatal(err)
        }
        log.Printf("Has %s: %v", cap.SYS_ADMIN.String(), flag)

        // https://gist.github.com/BorePlusPlus/4f9b2b4cc687c05dbdfb
        log.Println("Starting setuid. getuid:", syscall.Getuid())
        if err := syscall.Setuid(0); err != nil {
                log.Fatal("setuid: ", err)
        }
        log.Println("setuid ok. getuid:", syscall.Getuid())
}