feat: implement kernel capability model

programs/src/procmgr/main.cpp

@@ -7,6 +7,7 @@
 #include <montauk/syscall.h>
 #include <montauk/string.h>
 #include <montauk/heap.h>
+#include <montauk/capabilities.h>
 #include <gui/mtk.hpp>
 
 extern "C" {
@@ -392,8 +393,26 @@ static bool refresh_state(bool force) {
     return true;
 }
 
+// Ending another process needs CAP_PROCESS_ADMIN; without it the kernel only
+// permits killing our own descendants. Capabilities cannot change over a
+// process lifetime and this is consulted from the render path, so resolve it
+// once rather than per frame.
+static bool g_process_admin = false;
+static bool g_process_admin_known = false;
+
+static bool process_admin_granted() {
+    if (!g_process_admin_known) {
+        montauk::abi::SpawnCapabilities mine;
+        montauk::caps::self(mine);
+        g_process_admin = (mine.effective & montauk::abi::CAP_PROCESS_ADMIN) != 0;
+        g_process_admin_known = true;
+    }
+    return g_process_admin;
+}
+
 static bool can_kill_selected() {
-    return g_pm.active_tab == PM_TAB_PROCESSES
+    return process_admin_granted()
+        && g_pm.active_tab == PM_TAB_PROCESSES
         && g_pm.selected >= 0
         && g_pm.selected < g_pm.proc_count
         && g_pm.procs[g_pm.selected].pid != 0