[Security Discussion] E:V:A:
Just something I've noticed...and a heads up.

We got a Huawei Nova (CAN-L11) for testing purposes, but it is fairly locked down, apart from a vendor provided boot-loader unlock. Sources are not yet available and the only full update is a total re-flash upgrade from AOS 6 to 7. What is interesting is that while searching around in the linux mounted extracted partitions of that firmware update, I noticed two things.

(1) Most usual tools (like ls) in /system/bin are provided by "toybox" while many others and all custom ones are masked by links to "toolbox" on a different /vendor partition, provided by vendor.img.

(2) On this device, on the extracted vendor partition there appear to be a setguid file called netcfg, that is not visible from shell...

# From linux mount:
$ ls -alZ
-rwxr-s---. 1 root 3003 u:object_r:system_file:s0 11K Dec 5 11:47 bin/netcfg

# From phone/adb shell
$ toybox ls -alZ /system/bin/netcfg
-rwxr-xr-x 1 root shell u:object_r:system_file:s0 10240 2016-09-14 00:39 /system/bin/netcfg

$ toolbox ls -alZ /system/bin/netcfg
-rwxr-xr-x root shell u:object_r:system_file:s0 netcfg

But perhaps it's normal for Android to have a different understanding of file permissions than Linux or simply an artifact of mounting a foreign filesystem?

$ ll bin |grep toolbox

lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 dd -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 getevent -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 iftop -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 ioctl -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 log -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 nandread -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 newfs_msdos -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 prlimit -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 ps -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 sendevent -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 start -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 stop -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 toolbox -> /vendor/bin/toolbox
lrwxr-xr-x. 1 root 2000 19 Dec 5 10:01 top -> /vendor/bin/toolbox

$ ll bin |grep toybox

lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 acpi -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 base64 -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 basename -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 blockdev -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 bzcat -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cal -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cat -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 chcon -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 chgrp -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 chmod -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 chown -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 chroot -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cksum -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 clear -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cmp -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 comm -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cp -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cpio -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 cut -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 date -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 df -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 dirname -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 dmesg -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 dos2unix -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 du -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 echo -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 env -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 expand -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 expr -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 fallocate -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 false -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 find -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 flock -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 free -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 getenforce -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 getprop -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 groups -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 head -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 hostname -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 hwclock -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 id -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 ifconfig -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 inotifyd -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 insmod -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 ionice -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 iorenice -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 kill -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 killall -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 ln -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 load_policy -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 logname -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 losetup -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 ls -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 lsmod -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 lsof -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 lsusb -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 md5sum -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mkdir -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mknod -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mkswap -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mktemp -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 modinfo -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 more -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mount -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mountpoint -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 mv -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 netstat -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 nice -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 nl -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 nohup -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 od -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 paste -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 patch -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 pgrep -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 pidof -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 pkill -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 pmap -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 printenv -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 printf -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 pwd -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 readlink -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 realpath -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 renice -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 restorecon -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 rm -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 rmdir -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 rmmod -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 route -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 runcon -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sed -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 seq -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 setenforce -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 setprop -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 setsid -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sha1sum -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sleep -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sort -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 split -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 stat -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 strings -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 swapoff -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 swapon -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sync -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 sysctl -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tac -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tail -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tar -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 taskset -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tee -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 time -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 timeout -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 touch -> toybox
-rwxr-xr-x. 1 root 2000 348K Dec 5 09:48 toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tr -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 true -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 truncate -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 tty -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 ulimit -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 umount -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 uname -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 uniq -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 unix2dos -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 uptime -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 usleep -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 vmstat -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 wc -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 which -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 whoami -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 xargs -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 xxd -> toybox
lrwxr-xr-x. 1 root 2000 6 Dec 5 09:48 yes -> toybox

Now this may be completely normal, but people may forget that these cross-partition links are not seen from shell. In either way, the binaries as supplied by these tool boxes, should not be trusted, as they can be easily manipulated to ignore certain files, links or filetypes. So whatever tools you use, make sure you use non-stock ones, like those provided by busybox...