proposal to refine capability checks when _rlimit_overlimit() is true

[孟敬姿 <mengjingzi@iie.ac.cn>]

Hi!

We observed a potential refinement in the kernel/fork.c line 2368. Currently, both CAP_SYS_ADMIN and CAP_SYS_RESOURCE are checked when the limit is over system limit. We suggest considering an adjustment to utilize CAP_SYS_RESOURCE exclusively. Here's our rationale for this suggestion:

(1) Defined Capability for Resource Access: According to the capability manual page[1], the capability explicitly defined for bypassing resource limits is CAP_SYS_RESOURCE. This capability is designed to provide the necessary privileges for accessing system resources without over-privileging with the broader CAP_SYS_ADMIN.

(2) Maintaining Least Privilege: CAP_SYS_ASMIN is already overloaded and known as the new "root"[2]. The use of CAP_SYS_ADMIN in this context might inadvertently over-privilege the system by providing more capabilities than necessary. And according to capability manual page[1], “Don't choose CAP_SYS_ADMIN if you can possibly avoid it!”, it's beneficial to use the most specific capability required for a given task.

This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9).

Your insights and feedback on this proposed modification would be highly appreciated. Thank you for your time and consideration.

Best regards,
Jingzi

reference:
[1] https://www.man7.org/linux/man-pages/man7/capabilities.7.html
[2] https://lwn.net/Articles/486306/