Ensure CAP_CHOWN capability is included if root user is required

[mrodm]

Ensure that CAP_CHOWN capability is present in the docker-compose scenario for the Elastic Agent container when the package requires or sets root privileges.

Fixes #2330

Additional:

• Take into account if a data stream manifest defines that it requires root privileges.
  • system package defines root privileges in the manifest of some of its data streams: example data stream manifest link

Author's checklist

• Test packages from integrations with 8.18.0-SNAPSHOT
  • https://buildkite.com/elastic/integrations/builds/20277
  • https://buildkite.com/elastic/integrations/builds/20287 (including root privileges defined in data stream manifests)
• Test packages from integrations with their minimum Kibana version supported
  • https://buildkite.com/elastic/integrations/builds/20292

[mrodm]

test integrations

[elastic-vault-github-plugin-prod]

Created or updated PR in integrations repository to test this version. Check elastic/integrations#12295

[mrodm]

Package nginx that does not require root:

    healthcheck:
      test: "elastic-agent status"
      retries: 180
      interval: 1s

    cap_drop:
      - ALL

Package auditd_manager that require root:

    healthcheck:
      test: "elastic-agent status"
      retries: 180
      interval: 1s
    
    pid: host

    user: root

    cap_add: [AUDIT_CONTROL,AUDIT_READ,CAP_CHOWN]
    
    cap_drop:
      - ALL

Package fim that requires root:

    healthcheck:
      test: "elastic-agent status"
      retries: 180
      interval: 1s
  
    user: root
   
    cap_add: [CAP_CHOWN]
    
    cap_drop:
      - ALL

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7b6901d

History

• 💚 Build #4614 succeeded d7a9e19

cc @mrodm

[mrodm]

test integrations

[elastic-vault-github-plugin-prod]

Created or updated PR in integrations repository to test this version. Check elastic/integrations#12295

[mrodm]

Previously, it was just considered the privileges settings from package manifest. It was no taken into account the one from the data stream manifest.