Improvements when encountering new capabilities

- When there are capabilities we don't know about yet, warn the user
- Such unnamed capabilities can now be manipulated, and are dropped by
  limit()

Author: seveas

_prctlmodule.c

@@ -760,14 +760,13 @@ PyInit__prctl(void)
     namedconstant(CAP_SYS_RESOURCE);
     namedconstant(CAP_SYS_TIME);
     namedconstant(CAP_SYS_TTY_CONFIG);
-    namedconstant(CAP_SYSLOG);
-    namedconstant(CAP_WAKE_ALARM);
 #ifdef CAP_SYSLOG
     namedconstant(CAP_SYSLOG);
 #endif
 #ifdef CAP_WAKE_ALARM
     namedconstant(CAP_WAKE_ALARM);
 #endif
+    namedconstant(CAP_LAST_CAP);
     /* And the securebits constants */
     namedconstant(SECURE_KEEP_CAPS);
     namedconstant(SECURE_NO_SETUID_FIXUP);

prctl.py

@@ -44,12 +44,22 @@ def setter(self, value):
     return property(getter, setter)
 
 # Wrap the capabilities, capability bounding set and securebits in an object
-_ALL_FLAG_NAMES  = ('CAP_EFFECTIVE', 'CAP_INHERITABLE', 'CAP_PERMITTED')
+_ALL_FLAG_NAMES = ('CAP_EFFECTIVE', 'CAP_INHERITABLE', 'CAP_PERMITTED')
 _ALL_CAP_NAMES = tuple(x for x in dir(_prctl) if x.startswith('CAP_') and x not in _ALL_FLAG_NAMES)
-ALL_FLAG_NAMES  = list(x[4:].lower() for x in _ALL_FLAG_NAMES)
-ALL_CAP_NAMES  = list(x[4:].lower() for x in _ALL_CAP_NAMES)
-ALL_CAPS = tuple(getattr(_prctl,x) for x in _ALL_CAP_NAMES)
+ALL_FLAG_NAMES = tuple(x[4:].lower() for x in _ALL_FLAG_NAMES)
+ALL_CAP_NAMES = tuple(x[4:].lower() for x in _ALL_CAP_NAMES)
 ALL_FLAGS = tuple(getattr(_prctl,x) for x in _ALL_FLAG_NAMES)
+ALL_CAPS = tuple(getattr(_prctl,x) for x in _ALL_CAP_NAMES)
+
+for i in range(_prctl.CAP_LAST_CAP+1):
+    if i not in ALL_CAPS:
+        _ALL_CAP_NAMES += ("CAP_UNKNOWN_%d" % i,)
+del i
+
+if len(_ALL_CAP_NAMES) != len(ALL_CAPS):
+    warnings.warn("not all known capabilities are named, this is a bug in python-prctl", RuntimeWarning)
+    ALL_CAP_NAMES  = tuple(x[4:].lower() for x in _ALL_CAP_NAMES)
+    ALL_CAPS = tuple(getattr(_prctl,x) for x in _ALL_CAP_NAMES)
 
 class Capbset(object):
     __slots__ = ALL_CAP_NAMES
@@ -69,7 +79,7 @@ def limit(self, *caps):
 capbset = Capbset()
 
 class Capset(object):
-    __slots__ = ALL_CAP_NAMES + ['flag']
+    __slots__ = ALL_CAP_NAMES + ('flag',)
     def __init__(self, flag):
         self.flag = flag
         for name in _ALL_CAP_NAMES: