[WIP] fuzzer: attach security labels to programs #6374
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
winrares
force-pushed
the
seclabel_usage
branch
from
5c276a8 to
f3e06fd
Compare
Collaborator
|
Hi @winrares! |
winrares
force-pushed
the
seclabel_usage
branch
from
f3e06fd to
4d34627
Compare
Author
|
Hi @a-nogikh, I updated the description of the PR and the commit descriptions. I am also working on a third commit that will add the audit log collection. I did not test this with Android yet, but will do it ASAP. Tested it with the image created by |
Added one experimental field that allow the user to add a list of security contexts that can be used during fuzzing. The security context is attached to the program as the first "syscall" and it will be set using `setcon`. The objective is to allow syzkaller to fuzz syscalls under specific security contexts that match the SELinux policy that is loaded on target. Signed-off-by: Rares Constantin <[email protected]>
Added the security context generator in the fuzzer package which will contain the implementation for loading a binary security policy, parse it and then generate an appropiate security context based on the syscalls that are fuzzed in a program. For now, it will use the first security context provided in the `seccontexts` list if any is available. Signed-off-by: Rares Constantin <[email protected]>
Implemented the audit log extraction per program. This is available for VMs that run only one proc and add `audit` in the experimental config. The messages are appended to the output of the program and are printed during result processing.
winrares
force-pushed
the
seclabel_usage
branch
from
17aac19 to
e05ca4c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Objective: fuzzing syscalls under specific security contexts that are more focused. For example, if the program contains socket syscalls, we can try to attach a context that is focused on socket manipulation or we can attach a security context that we know will not allow the syscalls to be executed.
Adjacent to this feature, we can implement a security context generator that can scan the syscalls in a program and then decide which security context is appropriate for that program.
This would also allow us to add another functionality for SELinux policy enforcement testing: audit log collection for the programs. This would be used with
syz-verifieronce it's refactored and merged.