analyze: capability: add support for decoding capability masks

This adds support in `systemd-analyze capability` for decoding
capability masks (sets), e.g.:

```console
$ systemd-analyze capability --mask 0000000000003c00
NAME                 NUMBER
cap_net_bind_service     10
cap_net_broadcast        11
cap_net_admin            12
cap_net_raw              13
```

This is intended as a convenience tool for pretty-printing capability
values as found in e.g. `/proc/$PID/status`.

3 files changed, 59 insertions, 11 deletions

diff --git a/src/analyze/analyze-capability.c b/src/analyze/analyze-capability.c
index 07ac725a69..3e9b918ed4 100644
--- a/src/analyze/analyze-capability.c
+++ b/src/analyze/analyze-capability.c
@@ -5,6 +5,18 @@
 #include "cap-list.h"
 #include "capability-util.h"
 #include "format-table.h"
+#include "parse-util.h"
+
+static int table_add_capability(Table *table, int c) {
+        int r;
+
+        r = table_add_many(table,
+                           TABLE_STRING, capability_to_name(c) ?: "cap_???",
+                           TABLE_UINT, c);
+        if (r < 0)
+                return table_log_add_error(r);
+        return 0;
+}
 
 int verb_capabilities(int argc, char *argv[], void *userdata) {
         _cleanup_(table_unrefp) Table *table = NULL;
@@ -20,15 +32,38 @@ int verb_capabilities(int argc, char *argv[], void *userdata) {
         /* Determine the maximum of the last cap known by the kernel and by us */
         last_cap = MAX((unsigned) CAP_LAST_CAP, cap_last_cap());
 
-        if (strv_isempty(strv_skip(argv, 1)))
+        if (arg_capability == CAPABILITY_MASK) {
+                uint64_t cap_mask;
+
+                if (argc != 2)
+                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Exactly 1 positional argument expected.");
+
+                r = safe_atoux64(argv[1], &cap_mask);
+                if (r < 0)
+                        return log_error_errno(r, "Capability mask \"%s\" is not valid.", argv[1]);
+
+                for (unsigned c = 0; cap_mask != 0; ) {
+                        if (cap_mask & 0b1) {
+                                if (c > last_cap)
+                                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Capability %u is not known.", c);
+
+                                r = table_add_capability(table, c);
+                                if (r < 0)
+                                        return r;
+                        }
+                        ++c;
+                        cap_mask >>= 1;
+                }
+
+                (void) table_set_sort(table, (size_t) 1);
+
+        } else if (argc == 1) {
                 for (unsigned c = 0; c <= last_cap; c++) {
-                        r = table_add_many(table,
-                                           TABLE_STRING, capability_to_name(c) ?: "cap_???",
-                                           TABLE_UINT, c);
+                        r = table_add_capability(table, c);
                         if (r < 0)
-                                return table_log_add_error(r);
+                                return r;
                 }
-        else {
+        } else {
                 for (int i = 1; i < argc; i++) {
                         int c;
 
@@ -36,11 +71,9 @@ int verb_capabilities(int argc, char *argv[], void *userdata) {
                         if (c < 0 || (unsigned) c > last_cap)
                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Capability \"%s\" is not known.", argv[i]);
 
-                        r = table_add_many(table,
-                                           TABLE_STRING, capability_to_name(c) ?: "cap_???",
-                                           TABLE_UINT, (unsigned) c);
+                        r = table_add_capability(table, c);
                         if (r < 0)
-                                return table_log_add_error(r);
+                                return r;
                 }
 
                 (void) table_set_sort(table, (size_t) 1);
diff --git a/src/analyze/analyze.c b/src/analyze/analyze.c
index 2b4babc5c9..c9675d4258 100644
--- a/src/analyze/analyze.c
+++ b/src/analyze/analyze.c
@@ -91,6 +91,7 @@
 #include "verbs.h"
 
 DotMode arg_dot = DEP_ALL;
+CapabilityMode arg_capability = CAPABILITY_LITERAL;
 char **arg_dot_from_patterns = NULL, **arg_dot_to_patterns = NULL;
 usec_t arg_fuzz = 0;
 PagerFlags arg_pager_flags = 0;
@@ -358,6 +359,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "table",            optional_argument, NULL, ARG_TABLE            },
                 { "no-legend",        optional_argument, NULL, ARG_NO_LEGEND        },
                 { "tldr",             no_argument,       NULL, ARG_TLDR             },
+                { "mask",             no_argument,       NULL, 'm'                  },
                 {}
         };
 
@@ -366,7 +368,7 @@ static int parse_argv(int argc, char *argv[]) {
         assert(argc >= 0);
         assert(argv);
 
-        while ((c = getopt_long(argc, argv, "hH:M:U:q", options, NULL)) >= 0)
+        while ((c = getopt_long(argc, argv, "hqH:M:U:m", options, NULL)) >= 0)
                 switch (c) {
 
                 case 'h':
@@ -551,6 +553,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_cat_flags = CAT_TLDR;
                         break;
 
+                case 'm':
+                        arg_capability = CAPABILITY_MASK;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -614,6 +620,9 @@ static int parse_argv(int argc, char *argv[]) {
         if (arg_table && !FLAGS_SET(arg_json_format_flags, SD_JSON_FORMAT_OFF))
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--table and --json= are mutually exclusive.");
 
+        if (arg_capability != CAPABILITY_LITERAL && !streq_ptr(argv[optind], "capability"))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Option --mask is only supported for capability.");
+
         return 1; /* work to do */
 }
 
diff --git a/src/analyze/analyze.h b/src/analyze/analyze.h
index a6920b7653..a93603243c 100644
--- a/src/analyze/analyze.h
+++ b/src/analyze/analyze.h
@@ -18,7 +18,13 @@ typedef enum DotMode {
         DEP_REQUIRE,
 } DotMode;
 
+typedef enum CapabilityMode {
+        CAPABILITY_LITERAL,
+        CAPABILITY_MASK,
+} CapabilityMode;
+
 extern DotMode arg_dot;
+extern CapabilityMode arg_capability;
 extern char **arg_dot_from_patterns, **arg_dot_to_patterns;
 extern usec_t arg_fuzz;
 extern PagerFlags arg_pager_flags;