prctl: use CAP_SYS_RESOURCE for PR_SET_MM option

CAP_SYS_ADMIN is already overloaded left and right, so to have more
fine-grained access control use CAP_SYS_RESOURCE here.

The CAP_SYS_RESOUCE is chosen because this prctl option allows a current
process to adjust some fields of memory map descriptor which rather
represents what the process owns: pointers to code, data, stack
segments, command line, auxiliary vector data and etc.

Suggested-by: Michael Kerrisk <[e-mail]>
Acked-by: Kees Cook <[e-mail]>
Acked-by: Michael Kerrisk <[e-mail]>
Cc: Pavel Emelyanov <[e-mail]>
Cc: Tejun Heo <[e-mail]>
Cc: Oleg Nesterov <[e-mail]>
Cc: Paul Bolle <[e-mail]>
Cc: KOSAKI Motohiro <[e-mail]>
Signed-off-by: Cyrill Gorcunov <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>
Signed-off-by: Linus Torvalds <[e-mail]>

kernel/sys.c

···
 	if (arg4 | arg5)
 		return -EINVAL;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_RESOURCE))
 		return -EPERM;
 
 	if (addr >= TASK_SIZE)