Fix capability detection for privileged containers

[klutchell]

Description

Privileged containers do not list each cap by name,
instead they lead with =eip and selectively remove
caps with cap_foo_bar-eip.

Instead we can use the --has-p flag of capsh to check
for the permitted cap.

See: https://k3a.me/linux-capabilities-in-a-nutshell/
See: https://man7.org/linux/man-pages/man1/capsh.1.html

Motivation and Context

This will allow privileged containers to not fail the fix_capabilities check as they do today.

 pihole  WARNING: Unable to set capabilities for pihole-FTL.
 pihole           Please ensure that the container has the required capabilities.
 pihole  [cont-init.d] 20-start.sh: exited 1.

How Has This Been Tested?

Confirmed on a Ubuntu desktop environment with Docker 20.10 that privileged containers do not show all the caps expected by the fix_capabilities function. Instead it adopts all caps (=eip) and specifically removes some.

$ docker run --rm -it alpine sh -c 'apk add --no-cache libcap && capsh == --print | grep Current: | grep -q cap_net_admin ; echo $?'
1

$ docker run --rm -it --cap-add NET_ADMIN alpine sh -c 'apk add --no-cache libcap && capsh == --print | grep Current: | grep -q cap_net_admin ; echo $?'
0

$ docker run --rm -it --privileged alpine sh -c 'apk add --no-cache libcap && capsh == --print | grep Current: | grep -q cap_net_admin ; echo $?'
1 # we are privileged so this should be 0

However, the --has-p flag will correctly identify the permitted capabilities.

$ docker run --rm -it alpine sh -c 'apk add --no-cache libcap && capsh --has-p=cap_net_admin ; echo $?'
cap[cap_net_admin] not permitted
1

$ docker run --rm -it --cap-add NET_ADMIN alpine sh -c 'apk add --no-cache libcap && capsh --has-p=cap_net_admin ; echo $?'
0

$ docker run --rm -it --privileged alpine sh -c 'apk add --no-cache libcap && capsh --has-p=cap_net_admin ; echo $?'
0 # much better!

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[PromoFaux]

Tested - and appears to be working even with privileged: true set in my docker-compose. Thanks for the PR!