Check netutils_wrapper don't use file capabilities
The netutils_wrapper is called by a variety of vendor processes. If the
netutils_wrapper is granted CAP_NET_ADMIN by filesystem capabilities, it
may also grant such capability to all vendor domains that run this
executable. To prevent that, adding a test to make sure the
netutils_wrapper binary doesn't have filesystem capabilities setup.
Bug: 72644927
Test: atest netd_integration_test
Change-Id: I856b0782bcb3f84be2925c995a6f8b64d16ffe33
2 files changed