tree f3136d08b078aae70b9236a08b31414a357f80fb
parent 5316da5fec0d2c8662ace4f35e121e9194def0a2
author John Stultz <john.stultz@linaro.org> 1503704486 -0700
committer Dmitry Shmidt <dimitrysh@google.com> 1505239155 +0000

ANDROID: commoncap: Begin to warn users of implicit PARANOID_NETWORK capability grants

CAP_NET_ADMIN and CAP_NET_RAW are implicity granted to the "special"
Android groups net_admin and net_raw.

This is a byproduct of the init system not being able to specify
capabilities back in the day, but has now been resolved and .rc files
can explictly specify the capabilities to be granted to a service.

Thus, we should start to remove this implict capability grant, and the
first step is to warn when a process doesn't have explicit capablity
but is a member of the implicitly granted group, when that capability
is checked.

This will allow for the PARANOID_NETWORK checks in commoncap.c to
be totally removed in a future kernel.

Change-Id: I6dac90e23608b6dba14a8f2049ba29ae56cb7ae4
Signed-off-by: John Stultz <john.stultz@linaro.org>