feat: add SYS_GETCAPS syscall to retrieve process capabilities

programs/include/Api/Syscall.hpp

@@ -259,6 +259,9 @@ namespace montauk::abi {
     /* Battery.hpp -- ACPI battery status */
     static constexpr uint64_t SYS_BATTERYINFO          = 188;  // (BatteryInfo*) -> 0, -1 no battery device
 
+    // The caller's own capability masks.
+    static constexpr uint64_t SYS_GETCAPS              = 189;  // (SpawnCapabilities*) -> 0, -1 bad pointer
+
     /* Kernel-owned process capabilities. User identities may namespace
        per-user resources, but never participate in authorization decisions. */
     static constexpr uint64_t CAP_PROCESS_ADMIN = 1ULL << 0;

programs/include/libc/montauk.h

@@ -212,6 +212,7 @@ extern "C" {
 #define MTK_SYS_SPAWN_REDIR_CAPS   186
 #define MTK_SYS_ALLOC_EAGER        187
 #define MTK_SYS_BATTERYINFO        188
+#define MTK_SYS_GETCAPS            189
 /* @SYSCALLS-END */
 
 #define MTK_SOCK_TCP 1

programs/include/montauk/capabilities.h

@@ -15,7 +15,6 @@ namespace caps {
 
     inline constexpr const char* GRANT_CONFIG = "capabilities";
     inline constexpr const char* GRANT_PREFIX = "grant.";
-    inline constexpr int MAX_SCAN_PROCS = 256;
 
     struct CapName {
         const char* name;
@@ -134,26 +133,7 @@ namespace caps {
     // The calling process's own capability masks.
     inline bool self(montauk::abi::SpawnCapabilities& out) {
         out = {0, 0, 0};
-
-        auto* table = (montauk::abi::ProcInfo*)montauk::malloc(
-            sizeof(montauk::abi::ProcInfo) * MAX_SCAN_PROCS);
-        if (table == nullptr) return false;
-
-        int count = montauk::proclist(table, MAX_SCAN_PROCS);
-        int self_pid = montauk::getpid();
-
-        bool found = false;
-        for (int i = 0; i < count; i++) {
-            if (table[i].pid != self_pid) continue;
-            out.permitted = table[i].permittedCaps;
-            out.effective = table[i].effectiveCaps;
-            out.delegable = table[i].delegableCaps;
-            found = true;
-            break;
-        }
-
-        montauk::mfree(table);
-        return found;
+        return montauk::getcaps(&out) == 0;
     }
 
     inline uint64_t self_delegable() {

programs/include/montauk/syscall.h

@@ -127,6 +127,10 @@ namespace montauk {
                              (uint64_t)args, (uint64_t)user,
                              (uint64_t)&capabilities);
     }
+    // The calling process's own capability masks. Returns 0 on success.
+    inline int getcaps(montauk::abi::SpawnCapabilities* out) {
+        return (int)syscall1(montauk::abi::SYS_GETCAPS, (uint64_t)out);
+    }
     inline int chdir(const char* path) {
         return (int)syscall1(montauk::abi::SYS_CHDIR, (uint64_t)path);
     }