Add CAP_CHOWN to permitted capability set

[bryancall]

Summary

Add CAP_CHOWN to the permitted capability set retained by RestrictCapabilities() after the privilege drop from root to the unprivileged user.

This enables plugins that manage TLS certificate files to set root:root ownership on backup copies they write to disk, supporting deployments where cert files are restricted to root:root 600 inside root:root 700 directories.

Changes

• src/tscore/ink_cap.cc -- Added CAP_CHOWN to perm_list in RestrictCapabilities(). Like CAP_DAC_OVERRIDE and CAP_FOWNER, it is retained in the permitted set only (not effective). A plugin must explicitly promote it to the effective set before use.

Security Considerations

CAP_CHOWN allows changing file ownership. It follows the same security model as CAP_DAC_OVERRIDE (already retained): held in the permitted set but not in the effective set during normal operation. A plugin must use RAII-style elevation to briefly promote it, then drop it immediately after the fchown() call.

Testing

Verified on Fedora 43 with libcap 2.76:

• CAP_CHOWN appears in CapPrm but not CapEff after startup
• fchown() succeeds when the capability is elevated
• No change to steady-state behavior

[Copilot]

Pull request overview

This PR adds CAP_CHOWN to the permitted capability set to enable plugins to change file ownership, specifically to support TLS certificate management plugins that need to set root:root ownership on backup certificate files.

Changes:

• Added CAP_CHOWN to the perm_list array in RestrictCapabilities(), making it available in the permitted set (but not the effective set) after privilege drop

[Copilot]

Adding CAP_CHOWN to the permitted set without a corresponding privilege level in the ElevateAccess class makes it effectively unusable. Currently, ElevateAccess supports FILE_PRIVILEGE (maps to CAP_DAC_OVERRIDE), OWNER_PRIVILEGE (maps to CAP_FOWNER), TRACE_PRIVILEGE (maps to CAP_SYS_PTRACE), and LOW_PORT_PRIVILEGE. To actually use CAP_CHOWN, you need to either:

1. Add a new privilege level (e.g., CHOWN_PRIVILEGE = 0x10u) to the ElevateAccess class in include/tscore/ink_cap.h
2. Update the acquirePrivilege() function in src/tscore/ink_cap.cc to handle this new privilege level by elevating CAP_CHOWN to the effective set

Without these changes, CAP_CHOWN will remain in the permitted set but cannot be elevated to the effective set, making it impossible for plugins to use fchown() as described in the PR description.

Suggested change

	cap_value_t perm_list[] = {CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_IPC_LOCK, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_CHOWN};
	cap_value_t perm_list[] = {CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_IPC_LOCK, CAP_DAC_OVERRIDE, CAP_FOWNER};

[Copilot]

This line exceeds the maximum line length of 132 characters (currently 143 characters). According to the C++ style guidelines for this repository, lines should not exceed 132 characters. Consider breaking this into multiple lines or using a more compact formatting.