Support $LS_COLORS 'ca' (linux only)

news/fix-ls-color-codes.rst

@@ -1,6 +1,8 @@
 **Added:**
 
 * $LS_COLORS code 'mh' now recognized for (multi) hard-linked files.
+* $LS_COLORS code 'ca' now recognized for files with security capabilities (linux only).
+
 
 **Changed:**
 

tests/test_pyghooks.py

@@ -156,6 +156,10 @@ def test_XonshStyle_init_file_color_tokens(xonsh_builtins_LS_COLORS):
         xonsh_builtins_LS_COLORS.__xonsh__.env["LS_COLORS"].keys()
     )
 
+# parameterized tests for file colorization
+# note 'ca' is checked by standalone test.
+# requires privilege to create a file with capabilities
+
 
 _cf = {
     "fi": "regular",
@@ -259,6 +263,22 @@ def test_colorize_file(key, file_path, colorizable_files, xonsh_builtins_LS_COLO
     assert color_key == key, "File classified as expected kind"
     assert color_token == file_color_tokens[key], "Color token is as expected"
 
+
+def test_colorize_file_ca(xonsh_builtins_LS_COLORS, monkeypatch):
+    def mock_os_listxattr(p):
+        return ['security.capability']
+
+    monkeypatch.setattr(os, "listxattr", mock_os_listxattr)
+
+    with TemporaryDirectory() as tmpdir:
+        file_path = tmpdir + "/cap_file"
+        open(file_path, "a").close()
+        os.chmod(file_path, stat.S_IXUSR)   # ca overrides ex
+        color_token, color_key = color_file(file_path, os.lstat(file_path))
+
+        assert color_key == 'ca'
+
+
 # TODO: test precedence of some types over others:
 # mh + link to ex --> ex
 # ln + link to ex --> ex

xonsh/pyghooks.py

@@ -1373,7 +1373,6 @@ def color_file(file_path: str, path_stat: os.stat_result) -> (Color, str):
     Notes
     -----
 
-    * doesn't handle CA (capability)
     * doesn't handle LS TARGET mapping
 
     """
@@ -1389,7 +1388,10 @@ def color_file(file_path: str, path_stat: os.stat_result) -> (Color, str):
         except FileNotFoundError:
             color_key = "or"
     elif stat.S_ISREG(mode):
-        if stat.S_IMODE(mode) & (stat.S_IXUSR + stat.S_IXGRP + stat.S_IXOTH):
+        cap = os.listxattr(file_path)
+        if cap and "security.capability" in cap:    # protect None return on some OS?
+            color_key = "ca"
+        elif stat.S_IMODE(mode) & (stat.S_IXUSR + stat.S_IXGRP + stat.S_IXOTH):
             color_key = "ex"
         elif (
             mode & stat.S_ISUID