Add more fuzz targets for SELinux am: 7cb28c7f7a

Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/1465082

Change-Id: Iaab4d92b059e36a4b0cbfc77db78d6d71bc82843

libselinux/fuzzers/Android.bp

@@ -34,3 +34,17 @@ cc_fuzz {
     srcs: ["ContextFuzzer.cpp"],
     host_supported: true,
 }
+
+cc_fuzz {
+    name: "libselinux_selabel_lookup_fuzzer",
+    defaults: ["libselinux_fuzzer_defaults"],
+    srcs: ["selabel_lookup_fuzzer.cpp"],
+    dictionary: "selabel_lookup_fuzzer.dict",
+}
+
+cc_fuzz {
+    name: "libselinux_selinux_check_access_fuzzer",
+    defaults: ["libselinux_fuzzer_defaults"],
+    srcs: ["selinux_check_access_fuzzer.cpp"],
+    dictionary: "selinux_check_access_fuzzer.dict",
+}

libselinux/fuzzers/selabel_lookup_fuzzer.cpp

@@ -0,0 +1,47 @@
+/******************************************************************************
+ *
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ *****************************************************************************
+ */
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <stdint.h>
+#include <selinux/android.h>
+#include <string>
+
+selabel_handle *GetHandle(FuzzedDataProvider &fdp) {
+  switch (fdp.ConsumeIntegralInRange(0, 4)) {
+  case 0: return selinux_android_file_context_handle();
+  case 1: return selinux_android_service_context_handle();
+  case 2: return selinux_android_hw_service_context_handle();
+  case 3: return selinux_android_vendor_service_context_handle();
+  case 4: return selinux_android_keystore2_key_context_handle();
+  default: return selinux_android_file_context_handle();
+  }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  FuzzedDataProvider fdp(data, size);
+
+  std::string str = fdp.ConsumeRandomLengthString();
+  static auto handle = GetHandle(fdp);
+  char *conn = NULL;
+  int type = fdp.ConsumeIntegral<int>();
+
+  selabel_lookup(handle, &conn, str.data(), type);
+
+  return 0;
+}

libselinux/fuzzers/selabel_lookup_fuzzer.dict

@@ -0,0 +1,8 @@
+# A few paths from frameworks/native.
+
+"/data/app/com.example/dir/dir/file"
+"/data/user/0/com.example/secondary.dex"
+"/dev/socket/pdx"
+"/proc/net/xt_qtaguid/iface_stat_all"
+"/sys/devices/system/cpu/cpufreq"
+"/vendor/bin/hw/android.hardware.media.omx@1.0-service"

libselinux/fuzzers/selinux_check_access_fuzzer.cpp

@@ -0,0 +1,64 @@
+/******************************************************************************
+ *
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ *****************************************************************************
+ */
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <selinux/selinux.h>
+#include <string>
+
+std::string GetClass(FuzzedDataProvider &fdp) {
+  switch (fdp.ConsumeIntegralInRange(0, 9)) {
+  case 0: return "filesystem";
+  case 1: return "dir";
+  case 2: return "file";
+  case 3: return "lnk_file";
+  case 4: return "chr_file";
+  case 5: return "blk_file";
+  case 6: return "sock_file";
+  case 7: return "fifo_file";
+  case 8: return "fd";
+  default: return fdp.ConsumeRandomLengthString();
+  }
+}
+
+// This is not an exhaustive list.
+std::string GetPermission(FuzzedDataProvider &fdp) {
+  switch (fdp.ConsumeIntegralInRange(0, 7)) {
+  case 0: return "create";
+  case 1: return "execute";
+  case 2: return "getattr";
+  case 3: return "ioctl";
+  case 4: return "read";
+  case 5: return "setattr";
+  case 6: return "write";
+  default: return fdp.ConsumeRandomLengthString();
+  }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  FuzzedDataProvider fdp(data, size);
+
+  std::string tclass = GetClass(fdp);
+  std::string perm = GetPermission(fdp);
+  std::string scon = fdp.ConsumeRandomLengthString();
+  std::string tcon = fdp.ConsumeRandomLengthString();
+
+  selinux_check_access(scon.data(), tcon.data(), tclass.data(), perm.data(), NULL);
+
+  return 0;
+}

libselinux/fuzzers/selinux_check_access_fuzzer.dict

@@ -0,0 +1,2 @@
+scon="u:r:shell:s0"
+tcon="u:object_r:metadata_file:s0"