fix: check CAP_BPF by capget syscall

[Asphaltt]

Fixes #706

It's more simple to check CAP_BPF by capget syscall than creating a bpf prog, as creating bpf prog requires removing rlimit memlock.

[chilli13]

test ok for memory lock low env, but the warning tip for non-root operation is inaccurate. I understand that the permissions should be determined before RemoveMemlocks.

non root user exec ecapture tip info is confuse

[usera@zhm-cd ecapture]$ ./bin/ecapture  tls
Error: failed to remove rlimit memlock: failed to set memlock rlimit: operation not permitted
NAME:
	tls - Used to capture TLS/SSL text content without the need for a CA certificate. (Supports OpenSSL 1.0.x/1.1.x/3.x or newer).

USAGE:
	eCapture tls [flags]

[root@zhm-cd ecapture]# ulimit -l
1
[root@zhm-cd ecapture]# ./bin/ecapture tls
2024-12-27T14:21:49+08:00 INF AppName="eCapture(旁观者)"
2024-12-27T14:21:49+08:00 INF HomePage=https://ecapture.cc
2024-12-27T14:21:49+08:00 INF Repository=https://github.com/gojue/ecapture
2024-12-27T14:21:49+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-12-27T14:21:49+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-27T14:21:49+08:00 INF Version=linux_amd64:-20241227-31f1364:x86_64
2024-12-27T14:21:49+08:00 INF Listen=localhost:28256

[Asphaltt]

non root user exec ecapture tip info is confuse

The error message updates as "the current user does not have CAP_SYS_RESOURCE to remove rlimit memlock. Please run as root or use sudo or add the --privileged=true flag for Docker".

[cfc4n]

LGTM, Thanks.

[cfc4n]

Test passed

127|emu64a:/data/local/tmp $ uname -a
Linux localhost 5.15.41-android13-8-00055-g4f5025129fe8-ab8949913 #1 SMP PREEMPT Mon Aug 15 18:33:14 UTC 2022 aarch64 Toybox
emu64a:/data/local/tmp $ whoami
shell
emu64a:/data/local/tmp $ ./ecapture tls                                                                                                         
Error: the current user does not have CAP_BPF to load bpf programs. Please run as root or use sudo or add the --privileged=true flag for Docker.
1|emu64a:/data/local/tmp $ su
emu64a:/data/local/tmp # ./ecapture tls                                                                                                         
2024-12-28T14:23:08Z INF AppName="eCapture(旁观者)"
2024-12-28T14:23:08Z INF HomePage=https://ecapture.cc
2024-12-28T14:23:08Z INF Repository=https://github.com/gojue/ecapture
2024-12-28T14:23:08Z INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-12-28T14:23:08Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-28T14:23:08Z INF Version=androidgki_arm64:v0.9.1-20241228-32f201c:5.15.0-127-generic
2024-12-28T14:23:08Z INF Listen=localhost:28256
2024-12-28T14:23:08Z INF eCapture running logs logger=
2024-12-28T14:23:08Z INF the file handler that receives the captured event eventCollector=
2024-12-28T14:23:08Z INF Kernel Info=5.15.41 Pid=5680
2024-12-28T14:23:08Z INF listen=localhost:28256
2024-12-28T14:23:08Z INF https server starting...You can upgrade the configuration file via the HTTP interface.
2024-12-28T14:23:08Z WRN Your environment is like a container. We won't be able to detect the BTF configuration.
If eCapture fails to run, try specifying the BTF mode. use `-b 2` to specify non-CORE mode.
2024-12-28T14:23:08Z INF BTF bytecode mode: CORE. btfMode=0
2024-12-28T14:23:08Z INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-12-28T14:23:08Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-12-28T14:23:08Z INF Module.Run()
2024-12-28T14:23:08Z ERR OpenSSL/BoringSSL version not found, used default version.If you want to use the specific version, please set the sslVersion parameter with "--ssl_version='boringssl_a_13'" , "--ssl_version='boringssl_a_14'", or use "ecapture tls --help" for more help.
2024-12-28T14:23:08Z ERR bpfFile=boringssl_a_13_kern.o sslVersion=android_default
2024-12-28T14:23:08Z INF Hook masterKey function ElfType=2 Functions=["SSL_in_init"] binrayPath=/apex/com.android.conscrypt/lib64/libssl.so
2024-12-28T14:23:08Z INF target all process.
2024-12-28T14:23:08Z INF target all users.
2024-12-28T14:23:08Z INF setupManagers eBPFProgramType=Text
2024-12-28T14:23:08Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/boringssl_a_13_kern_core.o
2024-12-28T14:23:09Z INF perfEventReader created mapSize(MB)=4
2024-12-28T14:23:09Z INF perfEventReader created mapSize(MB)=4
2024-12-28T14:23:09Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
^C2024-12-28T14:23:10Z INF Module closed,message recived from Context
2024-12-28T14:23:10Z INF module close.
2024-12-28T14:23:11Z INF iModule module close
2024-12-28T14:23:11Z INF bye bye.