Output a log when an application uses a Linux capability

[ptodev]

It would be nice if Beyla could produce log lines similar to this Python utility. There are not many tools I could find for this on the internet, and this Python utility is a bit hard to run since it needs the Linux headers to be installed. That's not easy to do for some Linux distributions. There is also an application called Tetragon which seems to be able to do it, but it looks very tightly coupled with K8s.

My use case - I would like to know which Linux capabilities Alloy is using. That way we could document them in the Alloy docs. If this feature is part of Alloy's beyla.ebpf component, then it would be very easy to incorporate it into the Alloy CI.

[rafaelroquetto]

Hey @ptodev - just to clarify, if all you want is to find out which capabilities an Alloy process is using, would the following be feasible to you?

capsh --decode=`cat /proc/<ALLOY_PID>/status | grep CapEff | awk '{print $2}'`