I am trying to understand the relationship between capabilities and syscalls on Linux.
As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When some syscalls are called with certain arguments, the syscall will only succeed when that process has certain capabilities.
Is it the case that for a particular syscall with particular arguments to succeed only one capability will ever be required? Or do some syscalls require multiple capabilities when called with a particular set of (or any) arguments?