[Export Audit] LINUX_CAPABILITY_MAP unused outside defining file #7884

Dead Export Analysis

File: src/capability-filter.ts
Symbol: LINUX_CAPABILITY_MAP
Type: Exported constant (Record(string, number))
Lines: 10-52

Evidence

Verification Command

grep -rw "LINUX_CAPABILITY_MAP" src/ --include="*.ts" | grep -vE "test|capability-filter\.ts"

Result: No matches found (exit code 1)

Usage Analysis

• Exported: Yes (line 10: export const LINUX_CAPABILITY_MAP)
• Used in defining file: Yes (line 124, within filterCapDrop() function)
• Used outside defining file: No
• Verification status: used_outside_defining_file=0_files (confirmed by automated audit)

Impact

Dead Code Risk: Medium-High (Score: 3/5)

This is a 52-line capability map containing Linux kernel capability names and bit positions that is exported but never imported by any other module. The export serves no external API purpose.

Security Context

The file handles Linux capability filtering for container security, a critical security boundary. Dead exports in security-critical modules increase attack surface unnecessarily.

Root Cause

The constant was likely exported initially for testing or potential future use, but:

1. Tests import the public functions (filterCapDrop, filterComposeCapDrop) instead
2. No other modules need direct access to the capability map
3. The constant serves as an internal implementation detail of filterCapDrop()

Recommendation

Remove the export keyword from line 10:

-export const LINUX_CAPABILITY_MAP: Record<string, number> = {
+const LINUX_CAPABILITY_MAP: Record<string, number> = {

This:

• Reduces public API surface
• Makes the constant's role as an internal implementation detail explicit
• Maintains all existing functionality (internal usage unaffected)
• Improves security posture by reducing unnecessary exports in security-critical code

Verification Steps

After removing export:

1. Run TypeScript compiler: npm run build (should succeed)
2. Run tests: npm test -- capability-filter (should pass)
3. Verify no external imports: grep -rw "LINUX_CAPABILITY_MAP" src/ --include="*.ts" | grep -v capability-filter (should be empty)

Generated by API Surface & Export Audit · copilot · sonnet45 · 21.8 AIC · ⊞ 6.2K · ◷

• expires on Sep 30, 2026, 9:12 AM UTC