Suggestion for Capability Check Refinement in too_many_unix_fds()

[孟敬姿]

Hi!

We identified a potential refinement in the too_many_unix_fds() function. Currently CAP_SYS_ADMIN and CAP_SYS_RESOURCE are checked when the number of open files in a socket exceeds the upper limit, having either one could pass the check. We recommend revisiting the capability checks and considering to utilize CAP_SYS_RESOURCE exclusively. Here's our rationale for this suggestion:

(1) Defined Capability for Resource Limits: According to the capability manual page[1], the capability explicitly designed for bypassing system resource limits is CAP_SYS_RESOURCE(CAP_SYS_RESOURCE: allow the RLIMIT_NOFILE resource limit on the number of "in-flight" file descriptors to be bypassed).

(2) Preserving Least Privilege Principle: CAP_SYS_ADMIN check in this context may lead to over-privileging. It is already overloaded and known as the new "root"[2]. According to the manual page[1] “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). 

Your feedback and insights on this proposed modification would be greatly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/