Merge pull request #5599 from kolyshkin/1.4-5598

[1.4] build(deps): bump github.com/moby/sys/capability from 0.4.0 to 0.5.0

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.7.0
 	github.com/docker/go-units v0.5.0
 	github.com/godbus/dbus/v5 v5.1.0
-	github.com/moby/sys/capability v0.4.0
+	github.com/moby/sys/capability v0.5.0
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/user v0.4.0
 	github.com/moby/sys/userns v0.1.0

go.sum

@@ -28,8 +28,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
-github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
+github.com/moby/sys/capability v0.5.0 h1:Bm4oD9xGCtZguPnaoQy1/jvKTSwZHMvM0FrnxNYtGYU=
+github.com/moby/sys/capability v0.5.0/go.mod h1:i+0cXvNSriGrL3C6sxnmlmGL5HVU0OdxocizXdC8A+g=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=

vendor/github.com/moby/sys/capability/CHANGELOG.md

@@ -5,6 +5,21 @@ from https://github.com/syndtr/gocapability/commit/42c35b4376354fd5.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-10-23
+
+### Breaking changes
+* Go 1.24 or later is now required. (#264)
+
+### Fixed
+* [LastCap] no longer reads `/proc/sys/kernel/cap_last_cap`, querying the
+  kernel via `prctl(PR_CAPBSET_READ)` instead. This makes the package work
+  when `/proc` is not mounted, and fixes a possible panic or infinite loop
+  when `/proc/sys/kernel/cap_last_cap` contains a bogus value (for example,
+  if something is mounted over `/proc`). (#265, #269)
+
+### Changed
+* Minor code cleanups. (#187)
+
 ## [0.4.0] - 2024-11-11
 
 ### Added
@@ -104,6 +119,7 @@ This is an initial release since the fork.
 [SetAmbient]: https://pkg.go.dev/github.com/moby/sys/capability#SetAmbient
 
 <!-- Minor releases. -->
+[0.5.0]: https://github.com/moby/sys/releases/tag/capability%2Fv0.5.0
 [0.4.0]: https://github.com/moby/sys/releases/tag/capability%2Fv0.4.0
 [0.3.0]: https://github.com/moby/sys/releases/tag/capability%2Fv0.3.0
 [0.2.0]: https://github.com/moby/sys/releases/tag/capability%2Fv0.2.0

vendor/github.com/moby/sys/capability/capability_linux.go

@@ -13,7 +13,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"strconv"
 	"strings"
 	"sync"
 	"syscall"
@@ -25,27 +24,76 @@ const (
 	linuxCapVer3 = 0x20080522
 )
 
+// capValid reports whether the running kernel supports capability c.
+func capValid(c Cap) (bool, error) {
+	err := prctl(syscall.PR_CAPBSET_READ, uintptr(c), 0)
+	if errors.Is(err, syscall.EINVAL) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+// lastCap returns the highest capability supported by the running kernel.
 var lastCap = sync.OnceValues(func() (Cap, error) {
-	f, err := os.Open("/proc/sys/kernel/cap_last_cap")
+	last, err := findLastCap()
 	if err != nil {
-		return 0, err
+		return 0, fmt.Errorf("unable to get last capability: %w", err)
 	}
-
-	buf := make([]byte, 11)
-	l, err := f.Read(buf)
-	f.Close()
-	if err != nil {
-		return 0, err
-	}
-	buf = buf[:l]
-
-	last, err := strconv.Atoi(strings.TrimSpace(string(buf)))
-	if err != nil {
-		return 0, err
-	}
-	return Cap(last), nil
+	return last, nil
 })
 
+func findLastCap() (Cap, error) {
+	// Based on the fact Go 1.24+ supports Linux >= 3.2, and
+	//   - CAP_WAKE_ALARM (35) was added in 3.0;
+	//   - CAP_CHECKPOINT_RESTORE (40) was added in 5.9, and it is
+	//     the last added capability as of October 2026 (Linux 7.3);
+	//
+	// the last capability is at least minLastCap, and most probably
+	// lastKnownCap (but newer kernels may have more).
+	//
+	// maxLastCap is the highest capability which can be represented
+	// by the kernel capability ABI v3 (two 32-bit words per set).
+	const (
+		minLastCap   = CAP_WAKE_ALARM
+		lastKnownCap = CAP_CHECKPOINT_RESTORE
+		maxLastCap   = Cap(63)
+	)
+
+	// Start from lastKnownCap, and go up if it's valid, or down if it's
+	// not. For most kernels, this takes two syscalls.
+	c := lastKnownCap
+	ok, err := capValid(c)
+	if err != nil {
+		return 0, err
+	}
+	if ok {
+		// Go up while the next one is valid.
+		for c < maxLastCap {
+			ok, err := capValid(c + 1)
+			if err != nil {
+				return 0, err
+			}
+			if !ok {
+				break
+			}
+			c++
+		}
+		return c, nil
+	}
+	// Go down until a valid one is found.
+	for c > minLastCap {
+		c--
+		ok, err := capValid(c)
+		if err != nil {
+			return 0, err
+		}
+		if ok {
+			return c, nil
+		}
+	}
+	return 0, fmt.Errorf("PR_CAPBSET_READ returned EINVAL for %s", minLastCap)
+}
+
 func capUpperMask() uint32 {
 	last, err := lastCap()
 	if err != nil || last < 32 {

vendor/github.com/moby/sys/capability/syscall_linux.go

@@ -141,16 +141,17 @@ func setVfsCap(path string, data *vfscapData) (err error) {
 		return
 	}
 	var size uintptr
-	if data.version == 1 {
+	switch data.version {
+	case 1:
 		data.magic = vfsCapVer1
 		size = vfscapDataSizeV1
-	} else if data.version == 2 {
+	case 2:
 		data.magic = vfsCapVer2
 		if data.effective[0] != 0 || data.effective[1] != 0 {
 			data.magic |= vfsCapFlageffective
 		}
 		size = vfscapDataSizeV2
-	} else {
+	default:
 		return syscall.EINVAL
 	}
 	_, _, e1 := syscall.RawSyscall6(syscall.SYS_SETXATTR, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_vfsXattrName)), uintptr(unsafe.Pointer(data)), size, 0, 0)

vendor/modules.txt

@@ -45,8 +45,8 @@ github.com/docker/go-units
 # github.com/godbus/dbus/v5 v5.1.0
 ## explicit; go 1.12
 github.com/godbus/dbus/v5
-# github.com/moby/sys/capability v0.4.0
-## explicit; go 1.21
+# github.com/moby/sys/capability v0.5.0
+## explicit; go 1.24
 github.com/moby/sys/capability
 # github.com/moby/sys/mountinfo v0.7.2
 ## explicit; go 1.17