Add linux capabilities to process events (#431)

* Add linux capabilities to process events
* Update year
* Ignore vim temp files
* Update ECS_GIT_REF to v8.10.0
* Ensure caps are included in our custom ECS subset
* Add results of make
* adding the results of make -B

Author: nicholasberlin

.gitignore

@@ -8,3 +8,4 @@ venv/
 vendor/
 generated/
 .DS_Store
+*.swp

Makefile

@@ -1,8 +1,9 @@
 ROOT_DIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
 # we are intentionally pinning the ECS version here, when ecs releases a new version
 # we'll discuss whether we need to release a new package and bump the version here
-# cd3227cb3eb0de7e422aef90a64321ac68f7896e is 8.7-dev
-ECS_GIT_REF ?= cd3227cb3eb0de7e422aef90a64321ac68f7896e
+# 43a1a61a4a4db88e2de60da9019733610717ff7e is v8.10.0
+ECS_GIT_REF ?= 43a1a61a4a4db88e2de60da9019733610717ff7e
+
 
 # This variable specifies to location of the package-storage repo. It is used for automatically creating a PR
 # to release a new endpoint package. This can be overridden with the location on your file system using the config.mk

NOTICE.txt

@@ -1,5 +1,5 @@
 Elastic Endpoint Package
-Copyright 2017-2019 Elasticsearch B.V.
+Copyright 2017-2023 Elasticsearch B.V.
 
 This product includes software developed at
 Elasticsearch, B.V. (https://www.elastic.co/).

custom_documentation/doc/endpoint/process/linux/linux_process_already_running.md

@@ -181,6 +181,8 @@ This event is generated for a process that was already running before Endpoint's
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_exec.md

@@ -186,6 +186,8 @@ This event is generated when a process calls `exec()`.
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_exit.md

@@ -94,6 +94,8 @@ This event is generated when a process exits.
 | process.entry_leader.start |
 | process.entry_leader.supplemental_groups.id |
 | process.entry_leader.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.entry_leader.tty.char_device.major |
 | process.entry_leader.tty.char_device.minor |
 | process.entry_leader.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_fork.md

@@ -183,6 +183,8 @@ This event is generated when a new process is created using `fork()`.
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_gid_change.md

@@ -184,6 +184,8 @@ This event is generated when the group id changes for a process.
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_session_id_change.md

@@ -181,6 +181,8 @@ This event is generated when a process's session id changes.
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.user.id |

custom_documentation/doc/endpoint/process/linux/linux_process_text_output.md

@@ -182,6 +182,8 @@ This event is generated when a process generates text output.
 | process.start |
 | process.supplemental_groups.id |
 | process.supplemental_groups.name |
+| process.thread.capabilities.permitted |
+| process.thread.capabilities.effective |
 | process.tty.char_device.major |
 | process.tty.char_device.minor |
 | process.tty.columns |