beats libbeat/processors/add_process_metada: add capabilities to process me…

trafficstars

Proposed commit message

Extends process metadata with effective and permitted capabilities.

Errors from capabilities.FromPid() are ignored since it returns a nil slice, which results in len() == 0 which supresses any output. A possible common error is getting ESRCH as the process might have already exited.

Checklist

[ ] ~~My code follows the style guidelines of this project~~
[x] I have commented my code, particularly in hard-to-understand areas
[ ] ~~I have made corresponding changes to the documentation~~
[ ] ~~I have made corresponding change to the default configuration files~~
[x] I have added tests that prove my fix is effective or that my feature works
[x] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

processors:
  - add_process_metadata:
      overwrite_keys: true
      match_pids: ["process.pid"]

auditbeat.modules:
- module: system
  datasets:
    - socket
  period: 10s # The frequency at which the datasets check for changes
  state.period: 20s

output.console:
  pretty: true

Related issues

Part of https://github.com/elastic/security-team/issues/4375 Related to https://github.com/elastic/beats/pull/37453

Screenshots

Screenshot from 2024-03-11 12-07-56

output.txt

Mar 11 '24 12:03 haesbaert

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

Mar 11 '24 12:03 elasticmachine

This pull request does not have a backport label. If this is a bug or security fix, could you label this PR @haesbaert? 🙏. For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed branches, such as:

backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

Mar 11 '24 12:03 mergify[bot]

:green_heart: Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Duration: 133 min 9 sec

:grey_exclamation: Flaky test report

No test was executed to be analysed.

:robot: GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

Mar 11 '24 12:03 elasticmachine

The Windows errors seem to be unrelated, apparently the CI can't find the go binary and whatnot

Mar 11 '24 15:03 haesbaert

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

Mar 11 '24 16:03 elasticmachine

BuildKite should not prevent the PR from be merged yet. Once you get the approvals and Jenkins is green you should be able to merge it.

Mar 12 '24 14:03 belimawr

BuildKite should not prevent the PR from be merged yet. Once you get the approvals and Jenkins is green you should be able to merge it.

Awesome, thanks :)

Mar 19 '24 06:03 haesbaert

Merging is blocked as waiting a review from @fearful-symmetry , is this because we need a reviewer from each team?

Mar 21 '24 16:03 haesbaert

:green_heart: Build Succeeded

Buildkite Build
Commit: 13eb6f7407eeff7763020bbebf6b0f80bbdbb63b