tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_core/init/fuzzer
History
Eric Biggers 5d7c35ce20 init: remove session keyring workaround for old kernels 
The android-4.14-stable and later kernels support the
FS_IOC_ADD_ENCRYPTION_KEY and FS_IOC_REMOVE_ENCRYPTION_KEY ioctls.  This
has superseded the old way of adding fscrypt keys to the kernel, which
was to use the add_key() syscall to add keys to the "session" keyring.
On kernels that support the ioctls, Android doesn't use the obsolete
way.  Since upgrading even just to Android 14 requires at minimum a
android-4.14-stable kernel (according to
https://source.android.com/docs/core/architecture/kernel/android-common#compatibility-matrix),
there is no need to support the obsolete way anymore.

Therefore, this commit removes the code from init that created a keyring
named "fscrypt" in the session keyring.  It also removes the code that
created the session keyring itself, since the only reason that Android
even created a session keyring was just to hold the "fscrypt" keyring.

Flag: N/A for the following reasons:
      - Removing obsolete code, which is fairly safe
      - Very early code, so runtime flag cannot be used
      - Even a build-time flag cannot be used, since init needs
        recovery_available, which aconfig libraries do not support

Bug: 311736104
Test: Build and boot Cuttlefish
Change-Id: Id9a184c68cf16d5c4b1d889444cf637c95a91413
2023-11-27 23:43:49 +00:00
..
Android.bp init: remove session keyring workaround for old kernels 2023-11-27 23:43:49 +00:00
init_parser_fuzzer.cpp Make the host_init_verifier init.rc parser follow symlinks. 2023-03-17 02:47:21 +00:00
init_property_fuzzer.cpp Added init_property_fuzzer 2022-08-19 11:48:19 +05:30
init_ueventHandler_fuzzer.cpp Added init_ueventHandler_fuzzer 2022-08-19 11:48:30 +05:30
README.md Added init_ueventHandler_fuzzer 2022-08-19 11:48:30 +05:30

README.md

Fuzzers for libinit

Table of contents

Fuzzer for InitParser

InitParser supports the following parameters:

  1. ValidPathNames (parameter name: "kValidPaths")
  2. ValidParseInputs (parameter name: "kValidInputs")
Parameter Valid Values Configured Value
kValidPaths 0./system/etc/init/hw/init.rc,
1./system/etc/init		 Value obtained from FuzzedDataProvider
kValidInputs 0.{"","cpu", "10", "10"},
1.{"","RLIM_CPU", "10", "10"},
2.{"","12", "unlimited", "10"},
3.{"","13", "-1", "10"},
4.{"","14", "10", "unlimited"},
5.{"","15", "10", "-1"}		 Value obtained from FuzzedDataProvider

Steps to run

  1. Build the fuzzer
  $ mm -j$(nproc) init_parser_fuzzer
  1. Run on device
  $ adb sync data
  $ adb shell /data/fuzz/arm64/init_parser_fuzzer/init_parser_fuzzer

Fuzzer for InitProperty

InitProperty supports the following parameters: PropertyType (parameter name: "PropertyType")

Parameter Valid Values Configured Value
PropertyType 0.STRING,
1.BOOL,
2.INT,
3.UINT,
4.DOUBLE,
5.SIZE,
6.ENUM,
7.RANDOM		 Value obtained from FuzzedDataProvider

Steps to run

  1. Build the fuzzer
  $ mm -j$(nproc) init_property_fuzzer
  1. Run on device
  $ adb sync data
  $ adb shell /data/fuzz/arm64/init_property_fuzzer/init_property_fuzzer

Fuzzer for InitUeventHandler

Maximize code coverage

The configuration parameters are not hardcoded, but instead selected based on incoming data. This ensures more code paths are reached by the fuzzer.

InitUeventHandler supports the following parameters:

  1. Major (parameter name: major)
  2. Minor (parameter name: minor)
  3. PartitionNum (parameter name: partition_num)
  4. Uid (parameter name: uid)
  5. Gid (parameter name: gid)
  6. Action (parameter name: action)
  7. Path (parameter name: path)
  8. Subsystem (parameter name: subsystem)
  9. PartitionName (parameter name: partition_name)
  10. DeviceName (parameter name: device_name)
  11. Modalias (parameter name: modalias)
  12. DevPath (parameter name: devPath)
  13. HandlerPath (parameter name: handlerPath)
Parameter Valid Values Configured Value
major UINT32_MIN to UINT32_MAX Value obtained from FuzzedDataProvider
minor UINT32_MIN to UINT32_MAX Value obtained from FuzzedDataProvider
partition_num UINT32_MIN to UINT32_MAX Value obtained from FuzzedDataProvider
uid UINT32_MIN to UINT32_MAX Value obtained from FuzzedDataProvider
gid UINT32_MIN to UINT32_MAX Value obtained from FuzzedDataProvider
action String Value obtained from FuzzedDataProvider
path String Value obtained from FuzzedDataProvider
subsystem String Value obtained from FuzzedDataProvider
partition_name String Value obtained from FuzzedDataProvider
device_name String Value obtained from FuzzedDataProvider
modalias String Value obtained from FuzzedDataProvider
devPath String Value obtained from FuzzedDataProvider
handlerPath String Value obtained from FuzzedDataProvider

This also ensures that the plugin is always deterministic for any given input.

Steps to run

  1. Build the fuzzer
$ mm -j$(nproc) init_ueventHandler_fuzzer
  1. Run on device
$ adb sync data
$ adb shell /data/fuzz/arm64/init_ueventHandler_fuzzer/init_ueventHandler_fuzzer