[docker-teamd] limit privileged flag for teamd container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag, retain NET_ADMIN capability

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[judyjoseph]

Looks ok here for teamd, one question on below capability.

NET_RAW | Use RAW and PACKET sockets

    Is this needed for doing tcpdump inside the docker container ? 
    In the multi-asic platforms we usually go into one of these dockers in the "asic" namespace and do a tcpdump
    as the interfaces are present in the namespace. 

Another interesting capability is below

NET_BIND_SERVICE | Bind a socket to internet domain privileged ports (port numbers less than 1024).

  Not significant to L2 protocols like LLDP, LACP, but would need to set this in case of frr docker, as we have BGP bould to port 179.

[maipbui]

Looks ok here for teamd, one question on below capability.

NET_RAW | Use RAW and PACKET sockets

    Is this needed for doing tcpdump inside the docker container ? 
    In the multi-asic platforms we usually go into one of these dockers in the "asic" namespace and do a tcpdump
    as the interfaces are present in the namespace. 

Another interesting capability is below

NET_BIND_SERVICE | Bind a socket to internet domain privileged ports (port numbers less than 1024).

  Not significant to L2 protocols like LLDP, LACP, but would need to set this in case of frr docker, as we have BGP bould to port 179.

@judyjoseph both NET_RAW and NET_BIND_SERVICE caps are granted by default if not use --privileged flag, check this ref: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities