RFE: Add finer-grained LSM/SELinux controls for CAP_SYS_ADMIN functionality

[stephensmalley]

As discussed on the mailing list, split up CAP_SYS_ADMIN by introducing new finer-grained LSM hooks and SELinux permission checks for logical groupings of the operations currently controlled by CAP_SYS_ADMIN.

[cgzones]

While on it, are there plans to split up NET_ADMIN likewise, especially to counter the NET_ADMIN requests the setsockopt call is making?

[pcmoore]

@cgzones I'm not aware of any plans regarding NET_ADMIN, but that can always change.