RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-22 05:59:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol: add libfuzz based fuzzer for reading binary policies

Browse Source 
Introduce a libfuzz[1] based fuzzer testing the parsing of a binary
policy.

Build the fuzzer in the oss-fuzz script.

[1]: https://llvm.org/docs/LibFuzzer.html

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2021-12-09 17:48:56 +01:00 committed by James Carter
parent e0ba116803
commit 82438341f7
3 changed files with 78 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
libsepol/fuzz/binpolicy-fuzzer.c Normal file
View File

@ -0,0 +1,63 @@
#include <sepol/debug.h>
#include <sepol/kernel_to_cil.h>
#include <sepol/kernel_to_conf.h>
#include <sepol/policydb/policydb.h>
extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
static int write_binary_policy(policydb_t *p, FILE *outfp)
{
struct policy_file pf;
policy_file_init(&pf);
pf.type = PF_USE_STDIO;
pf.fp = outfp;
return policydb_write(p, &pf);
}
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
policydb_t policydb = {};
sidtab_t sidtab = {};
struct policy_file pf;
FILE *devnull = NULL;
sepol_debug(0);
policy_file_init(&pf);
pf.type = PF_USE_MEMORY;
pf.data = (char *) data;
pf.len = size;
if (policydb_init(&policydb))
goto exit;
if (policydb_read(&policydb, &pf, /*verbose=*/0))
goto exit;
if (policydb_load_isids(&policydb, &sidtab))
goto exit;
if (policydb.policy_type == POLICY_KERN)
(void) policydb_optimize(&policydb);
devnull = fopen("/dev/null", "w");
if (!devnull)
goto exit;
(void) write_binary_policy(&policydb, devnull);
(void) sepol_kernel_policydb_to_conf(devnull, &policydb);
(void) sepol_kernel_policydb_to_cil(devnull, &policydb);
exit:
if (devnull != NULL)
fclose(devnull);
policydb_destroy(&policydb);
sepol_sidtab_destroy(&sidtab);
/* Non-zero return values are reserved for future use. */
return 0;
}

BIN
libsepol/fuzz/policy.bin Normal file
View File

Binary file not shown.

17
scripts/oss-fuzz.sh
View File

@ -32,7 +32,7 @@ SANITIZER=${SANITIZER:-address}
flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER -fsanitize=fuzzer-no-link"
export CC=${CC:-clang}
export CFLAGS=${CFLAGS:-$flags}
export CFLAGS="${CFLAGS:-$flags} -I$DESTDIR/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64"
export CXX=${CXX:-clang++}
export CXXFLAGS=${CXXFLAGS:-$flags}
@ -49,11 +49,24 @@ make -C libsepol clean
# shellcheck disable=SC2016
make -C libsepol V=1 LD_SONAME_FLAGS='-soname,$(LIBSO),--version-script=$(LIBMAP)' -j"$(nproc)" install
## secilc fuzzer ##
# CFLAGS, CXXFLAGS and LIB_FUZZING_ENGINE have to be split to be accepted by
# the compiler/linker so they shouldn't be quoted
# shellcheck disable=SC2086
$CC $CFLAGS -I"$DESTDIR/usr/include" -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -c -o secilc-fuzzer.o libsepol/fuzz/secilc-fuzzer.c
$CC $CFLAGS -c -o secilc-fuzzer.o libsepol/fuzz/secilc-fuzzer.c
# shellcheck disable=SC2086
$CXX $CXXFLAGS $LIB_FUZZING_ENGINE secilc-fuzzer.o "$DESTDIR/usr/lib/libsepol.a" -o "$OUT/secilc-fuzzer"
zip -r "$OUT/secilc-fuzzer_seed_corpus.zip" secilc/test
## binary policy fuzzer ##
# CFLAGS, CXXFLAGS and LIB_FUZZING_ENGINE have to be split to be accepted by
# the compiler/linker so they shouldn't be quoted
# shellcheck disable=SC2086
$CC $CFLAGS -c -o binpolicy-fuzzer.o libsepol/fuzz/binpolicy-fuzzer.c
# shellcheck disable=SC2086
$CXX $CXXFLAGS $LIB_FUZZING_ENGINE binpolicy-fuzzer.o "$DESTDIR/usr/lib/libsepol.a" -o "$OUT/binpolicy-fuzzer"
zip -j "$OUT/binpolicy-fuzzer_seed_corpus.zip" libsepol/fuzz/policy.bin