Hi! We've identified redundant capability checks within the sk_setsockopt() and __sock_cmsg_send() functions, specifically related to the options SO_MARK and SO_PRIORITY. Currently, both CAP_NET_ADMIN and CAP_NET_RAW are used for these checks, and we propose simplifying this by exclusively using CAP_NET_ADMIN. Our rationale is based on the definitions provided in the capability manual page(https://www.man7.org/linux/man-pages/man7/capabilities.7.html), which specifies that only CAP_NET_ADMIN is required for using setsockopt(2) to set SO_PRIORITY, SO_DEBUG, and SO_MARK. Additionally, we've observed that SO_DEBUG is already protected solely by CAP_NET_ADMIN. Simplifying the capability checks in these functions to only use CAP_NET_ADMIN would not only align with the capability manual page but also contribute to a more straightforward and consistent codebase. This issue exists in several kernel versions and we have checked it on the latest stable release(Linux 6.6.9). Your insights and feedback on this proposed adjustment would be greatly appreciated. Thank you for your time and consideration. Best regards, Jingzi
