<commit_before>package cradle

import (
	"github.com/spacemonkeygo/errors"

	"polydawn.net/repeatr/def"
)

/*
	Map of policies to the capabilities we give that policy by default.

	May not be implemented/enforced by all executors (e.g. chroot is
	simply not capable of these).
*/
func CapsForPolicy(m def.Policy) []string {
	switch m {
	case def.PolicyRoutine:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
		}
	case def.PolicyUidZero:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
		}
	case def.PolicyGovernor:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_CHOWN",
			"CAP_DAC_OVERRIDE",
			"CAP_FSETID",
			"CAP_FOWNER",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
			"CAP_NET_RAW",
			"CAP_SETGID",
			"CAP_SETUID", // fairly terrifying
			"CAP_SETFCAP",
			"CAP_SETPCAP",
			"CAP_SYS_CHROOT",
		}
	case def.PolicySysad:
		return []string{
			"CAP_AUDIT_CONTROL",
			"CAP_AUDIT_READ",
			"CAP_AUDIT_WRITE",
			"CAP_BLOCK_SUSPEND",
			"CAP_CHOWN",
			"CAP_DAC_OVERRIDE",
			"CAP_DAC_READ_SEARCH",
			"CAP_FOWNER",
			"CAP_FSETID",
			"CAP_IPC_LOCK",
			"CAP_IPC_OWNER",
			"CAP_KILL",
			"CAP_LEASE",
			"CAP_LINUX_IMMUTABLE",
			"CAP_MAC_ADMIN",
			"CAP_MAC_OVERRIDE",
			"CAP_MKNOD",
			"CAP_NET_ADMIN",
			"CAP_NET_BIND_SERVICE",
			"CAP_NET_BROADCAST",
			"CAP_NET_RAW",
			"CAP_SETGID",
			"CAP_SETFCAP",
			"CAP_SETPCAP",
			"CAP_SETUID",
			"CAP_SYS_ADMIN",
			"CAP_SYS_BOOT",<commit_msg>Drop a cap from Sysad Policy because unsupported.<commit_after>package cradle

import (
	"github.com/spacemonkeygo/errors"

	"polydawn.net/repeatr/def"
)

/*
	Map of policies to the capabilities we give that policy by default.

	May not be implemented/enforced by all executors (e.g. chroot is
	simply not capable of these).
*/
func CapsForPolicy(m def.Policy) []string {
	switch m {
	case def.PolicyRoutine:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
		}
	case def.PolicyUidZero:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
		}
	case def.PolicyGovernor:
		return []string{
			"CAP_AUDIT_WRITE",
			"CAP_CHOWN",
			"CAP_DAC_OVERRIDE",
			"CAP_FSETID",
			"CAP_FOWNER",
			"CAP_KILL",
			"CAP_NET_BIND_SERVICE",
			"CAP_NET_RAW",
			"CAP_SETGID",
			"CAP_SETUID", // fairly terrifying
			"CAP_SETFCAP",
			"CAP_SETPCAP",
			"CAP_SYS_CHROOT",
		}
	case def.PolicySysad:
		return []string{
			"CAP_AUDIT_CONTROL",
			//"CAP_AUDIT_READ", // currently regarded as 'unknown' by runc...?
			"CAP_AUDIT_WRITE",
			"CAP_BLOCK_SUSPEND",
			"CAP_CHOWN",
			"CAP_DAC_OVERRIDE",
			"CAP_DAC_READ_SEARCH",
			"CAP_FOWNER",
			"CAP_FSETID",
			"CAP_IPC_LOCK",
			"CAP_IPC_OWNER",
			"CAP_KILL",
			"CAP_LEASE",
			"CAP_LINUX_IMMUTABLE",
			"CAP_MAC_ADMIN",
			"CAP_MAC_OVERRIDE",
			"CAP_MKNOD",
			"CAP_NET_ADMIN",
			"CAP_NET_BIND_SERVICE",
			"CAP_NET_BROADCAST",
			"CAP_NET_RAW",
			"CAP_SETGID",
			"CAP_SETFCAP",
			"CAP_SETPCAP",
			"CAP_SETUID",
			"CAP_SYS_ADMIN",
			"CAP_SYS_BOOT",
{'fraction_non_alphanumeric': 0.13304721030042918, 'fraction_numerical': 0.0, 'mean_word_length': 3.9108589951377635, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '735481', 'n_tokens_mistral': 1544, 'n_tokens_neox': 1303, 'n_words': 216}