Hi,
On 10/11/23 19:14, Michael Biebl wrote:
- CAP_NET_ADMIN: use of setsockopt()
- CAP_SYS_ADMIN: exceed /proc/sys/fs/file-max, the system-wide limit on
the number of open files, in system calls that open files (e.g. accept
execve), use of setns(),...
I see, thanks!
I looked over the code quickly, it seems the only privileged
setsockopt() calls are to set larger buffer sizes.
It may be good to lobby for these and the open file limit to be added to
CAP_SYS_RESOURCE, that would allow locking it down further in the future.
Simon