fix: use subprocess instead of os.system in set_sysctls.py

[orbisai0security]

Summary

Fix critical severity security issue in gtests/net/tcp/common/set_sysctls.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	gtests/net/tcp/common/set_sysctls.py:29
CWE	CWE-78

Description: The script reads sysctl path/value pairs directly from sys.argv[1:] at line 29 and constructs shell command strings using % string formatting. These strings are passed directly to os.system() at line 39 (for writing sysctl values) and line 41 (for chmod). No sanitization, validation, or allowlisting of input is performed. An attacker who controls the command-line arguments — including any CI/CD pipeline, test orchestration system, or local user invoking the script — can inject shell metacharacters to execute arbitrary OS commands. Because sysctl manipulation requires root privileges, this script is routinely executed as root, making successful exploitation equivalent to full system compromise.

Changes

• gtests/net/tcp/common/set_sysctls.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security