Suggestion for Capability Check Refinement in check_syslog_permissions()

[孟敬姿]

Hi, we suggest revisiting the capability checks in check_syslog_permissions(). Currently CAP_SYSLOG is checked first, and if it’s not there but there is a CAP_SYS_ADMIN, it can also pass the check. We recommend refining this check to exclusively use CAP_SYSLOG. Here's our reasoning for this suggestion:

(1) Independence of CAP_SYSLOG and CAP_SYS_ADMIN: Since the introduction of CAP_SYSLOG in Linux 2.6.37, it has been a distinct capability from CAP_SYS_ADMIN. For compatibility reasons, it might make sense to keep CAP_SYS_ADMIN at the beginning. However, now that 13 years have passed，we think maybe it's appropriate to update the code to reflect their separate roles. 

(2) Maintaining Least Privilege Principle: CAP_SYS_ADMIN is overloaded and known as the new "root"[1]. And according to the manual page[2] “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). 

Your feedback and insights on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://lwn.net/Articles/486306/
[2] https://www.man7.org/linux/man-pages/man7/capabilities.7.html