unshare: add CAP_NET_ADMIN helper

pkg/unshare/unshare_linux.go

@@ -411,6 +411,9 @@ var (
 	hasCapSysAdminOnce sync.Once
 	hasCapSysAdminRet  bool
 	hasCapSysAdminErr  error
+	hasCapNetAdminOnce sync.Once
+	hasCapNetAdminRet  bool
+	hasCapNetAdminErr  error
 )
 
 // IsRootless tells us if we are running in rootless mode
@@ -753,3 +756,20 @@ func HasCapSysAdmin() (bool, error) {
 	})
 	return hasCapSysAdminRet, hasCapSysAdminErr
 }
+
+// HasCapNetAdmin returns whether the current process has CAP_NET_ADMIN.
+func HasCapNetAdmin() (bool, error) {
+	hasCapNetAdminOnce.Do(func() {
+		currentCaps, err := capability.NewPid2(0)
+		if err != nil {
+			hasCapNetAdminErr = err
+			return
+		}
+		if err = currentCaps.Load(); err != nil {
+			hasCapNetAdminErr = err
+			return
+		}
+		hasCapNetAdminRet = currentCaps.Get(capability.EFFECTIVE, capability.CAP_NET_ADMIN)
+	})
+	return hasCapNetAdminRet, hasCapNetAdminErr
+}

pkg/unshare/unshare_unsupported.go

@@ -53,3 +53,8 @@ func ParseIDMappings(uidmap, gidmap []string) ([]idtools.IDMap, []idtools.IDMap,
 func HasCapSysAdmin() (bool, error) {
 	return os.Geteuid() == 0, nil
 }
+
+// HasCapNetAdmin returns whether the current process has CAP_NET_ADMIN.
+func HasCapNetAdmin() (bool, error) {
+	return os.Geteuid() == 0, nil
+}