TODO

Objective:
We want to generate allowlists for dependencies we import, and enforce these allowlists of capabilities at runtime. 

e.g.
depA -> [CAP_NETWORK, CAP_FILE]
depB -> [CAP_ENV_VARIABLE]

Monitor the capabilities at runtime, and block the execution if a dependency
trigger a capability out of its allowlist.

---------------------------

First prototype: Monkey Patching

Monkey patching allow to hook the execution of specific function calls 
(e.g., the Go standard library). During the hook of these function calls:
1. We use the call stack trace to infer which dependency have invoked the function
   
   ^ file_open(...)
   ^ file_library_function(...)
   ^ DEP_A/some_file/wrapper_file_open()
      
2. We add validation checks against the allowlist

Advantages: potential low overhead since only a subset of functions 
(standard libary function implementing capabilities are tracked and hooked) 
and not all the syscalls

Limitations: we can only hook and enforce capabilities invoked through Go code
(e.g., standard library functions) since we need to know the address of the 
function to track, at compile time. 
We cannot track capabilities invoked "dynamically" through
- CGO
- inline assembly code
- pre-built Go plugins
- external binaries invoked through syscalls like exec(), or spawning childs  

--------------------------

Second prototype: eBPF syscall tracing

We hook and enforce all the syscalls invoked by the Go application we 
want to trace. 

1. We first run the application with an eBPF tracer enabled. This allow us
to dynamically collect a subset of trusted capabilities (in terms of syscalls)
2. We can further enhance this allowlist with the callgraph analysis provided
by Capslock
3. We use the generated allowlist to enforce the capabilities invoked 
at runtime by tracing each syscall.

Advantages: we can cover capabilities invoked "dynamically

Limitations: potentially we have high overhead due to the hooking of all the 
syscalls invoked by the traced application. 



-----------

TODO

1. Create a MAP of capabilities/syscalls and track capabilities instead of syscalls
2. Integrate Capslock in the allowlist generation phase
3. Design a inheritance model for handling imported capabilities