Fix capabilities plugin on kernels before 6.3

kernel_cap_t only handles the 6.3+ layout and raised for everything else.
Before 6.3 the same name exists as a typedef of kernel_cap_struct, whose
implementation already decodes the two-element cap array, so fall back to
it instead of raising.
This commit is contained in:
mmadersbacher
2026-08-18 20:11:30 +02:00
parent 958be9bcd9
commit f148a93445
@@ -2375,9 +2375,8 @@ class kernel_cap_t(kernel_cap_struct):
# In kernels >= 6.3 kernel_cap_t::val is a u64
cap_value = self.val
else:
raise exceptions.VolatilityException(
"Unsupported kernel capabilities implementation"
)
# Before 6.3 kernel_cap_t is a typedef of kernel_cap_struct
return super().get_capabilities()
return cap_value & self.get_kernel_cap_full()