Replace use of deprecated logging functions am: 788c867d40
Original change: https://android-review.googlesource.com/c/platform/tools/security/+/2966525
Change-Id: I9c500fa26fca463d94c63d376171115c96e883fb
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/fuzzing/example_afl_fuzzer/Android.bp b/fuzzing/example_afl_fuzzer/Android.bp
new file mode 100644
index 0000000..8d3a6d0
--- /dev/null
+++ b/fuzzing/example_afl_fuzzer/Android.bp
@@ -0,0 +1,18 @@
+
+
+cc_fuzz {
+ name: "example_afl_fuzzer",
+ srcs: [
+ "example_afl_fuzzer.cpp",
+ ],
+ fuzz_config: {
+ triage_assignee: "cobark@google.com",
+ },
+ fuzzing_frameworks: {
+ afl: true,
+ libfuzzer: false,
+ },
+ cflags: [
+ "-Wno-array-bounds",
+ ],
+}
\ No newline at end of file
diff --git a/fuzzing/example_afl_fuzzer/example_afl_fuzzer.cpp b/fuzzing/example_afl_fuzzer/example_afl_fuzzer.cpp
new file mode 100644
index 0000000..96b536f
--- /dev/null
+++ b/fuzzing/example_afl_fuzzer/example_afl_fuzzer.cpp
@@ -0,0 +1,25 @@
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <iostream>
+
+#include <string>
+
+void CrashFunc(const char *data) {
+
+ if (strcmp(data, "c") == 0) {
+ volatile int* arr = new int[10];
+ for (int i = 0; i < 15; i++){
+ arr[i] = 54;
+ }
+ }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+ std::string null_terminated_string(reinterpret_cast<const char *>(data),
+ size);
+
+ CrashFunc(null_terminated_string.c_str());
+ return 0;
+}
diff --git a/fuzzing/example_fuzzer/Android.bp b/fuzzing/example_fuzzer/Android.bp
index 177a085..0b3dda5 100644
--- a/fuzzing/example_fuzzer/Android.bp
+++ b/fuzzing/example_fuzzer/Android.bp
@@ -22,8 +22,8 @@
description: "Test Fuzzer",
production_date: "6/8/2019",
critical: false,
- fuzz_on_haiku_device: true,
- fuzz_on_haiku_host: true,
+ fuzz_on_haiku_device: false,
+ fuzz_on_haiku_host: false,
triage_assignee: "davfu@google.com"
},
}
diff --git a/fuzzing/measure_sandbox/Android.bp b/fuzzing/measure_sandbox/Android.bp
new file mode 100644
index 0000000..22bac0b
--- /dev/null
+++ b/fuzzing/measure_sandbox/Android.bp
@@ -0,0 +1,20 @@
+package {
+ default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+ name: "measure_sandbox",
+ srcs: [
+ "measure_sandbox.cpp",
+ ],
+ include_dirs: [
+ "system/core/libcutils/include/private/",
+ ],
+ static_libs: [
+ "libselinux",
+ ],
+ shared_libs: [
+ "libseccomp_policy",
+ ],
+ host_supported: false,
+}
diff --git a/fuzzing/measure_sandbox/measure_sandbox.cpp b/fuzzing/measure_sandbox/measure_sandbox.cpp
new file mode 100644
index 0000000..79684fc
--- /dev/null
+++ b/fuzzing/measure_sandbox/measure_sandbox.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fcntl.h>
+#include <grp.h>
+#include <selinux/selinux.h>
+#include <signal.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+#include "android_filesystem_config.h"
+#include "seccomp_policy.h"
+
+static bool set_groups(const gid_t gid) {
+ const gid_t groups[] = {gid, AID_EVERYBODY, AID_MISC};
+ const size_t num_groups = sizeof(groups) / sizeof(gid_t);
+
+ if (setgroups(num_groups, groups) != 0) {
+ fprintf(stderr, "setgroups failed\n");
+ return false;
+ }
+
+ if (setresgid(gid, gid, gid) != 0) {
+ fprintf(stderr, "setresgid failed\n");
+ return false;
+ }
+
+ return true;
+}
+
+static bool set_user(const uid_t uid) {
+ if (setresuid(uid, uid, uid) != 0) {
+ fprintf(stderr, "setresuid failed\n");
+ return false;
+ }
+
+ if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0)) {
+ fprintf(stderr, "prctl failed\n");
+ return false;
+ }
+
+ return true;
+}
+
+static bool enter_app_sandbox() {
+ if (!set_groups(AID_APP_START)) {
+ return false;
+ }
+
+ if (!set_app_seccomp_filter()) {
+ return false;
+ }
+
+ if (!set_user(AID_APP_START)) {
+ return false;
+ };
+
+ // TODO: figure out the correct value or make this configurable.
+ setcon("u:r:untrusted_app:s0:c512,c768");
+
+ return true;
+}
+
+static bool enter_system_sandbox() {
+ if (!set_groups(AID_SYSTEM)) {
+ return false;
+ }
+
+ if (!set_system_seccomp_filter()) {
+ return false;
+ }
+
+ if (!set_user(AID_SYSTEM)) {
+ return false;
+ };
+
+ return true;
+}
+
+void print_usage(char** argv) {
+ fprintf(stderr, "usage: %s <app|system> <file>\n", argv[0]);
+}
+
+int main(int argc, char** argv) {
+ if (argc != 3) {
+ print_usage(argv);
+ return 1;
+ }
+
+ if (!strcmp(argv[1], "app")) {
+ if (!enter_app_sandbox()) {
+ return 1;
+ }
+ } else if (!strcmp(argv[1], "system")) {
+ if (!enter_system_sandbox()) {
+ return 1;
+ }
+ } else {
+ print_usage(argv);
+ return 1;
+ }
+
+ if (open(argv[2], O_RDONLY) == -1) {
+ fprintf(stderr, "failed to open %s\n", argv[2]);
+ return 1;
+ }
+
+ return 0;
+}
diff --git a/fuzzing/presubmit_test_fuzzers/Android.bp b/fuzzing/presubmit_test_fuzzers/Android.bp
new file mode 100644
index 0000000..b7f923a
--- /dev/null
+++ b/fuzzing/presubmit_test_fuzzers/Android.bp
@@ -0,0 +1,36 @@
+package {
+ default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_fuzz {
+ name: "test_fuzzer_1",
+ srcs: [
+ "test_fuzzer_1.cpp",
+ "test_code.cpp"
+ ],
+ host_supported: true,
+ fuzz_config: {
+ description: "Test Fuzzer 1",
+ critical: false,
+ fuzz_on_haiku_device: true,
+ fuzz_on_haiku_host: true,
+ triage_assignee: "davfu@google.com",
+ use_for_presubmit: true,
+ },
+}
+cc_fuzz {
+ name: "test_fuzzer_2",
+ srcs: [
+ "test_fuzzer_2.cpp",
+ "test_code.cpp"
+ ],
+ host_supported: true,
+ fuzz_config: {
+ description: "Test Fuzzer 2",
+ critical: false,
+ fuzz_on_haiku_device: true,
+ fuzz_on_haiku_host: true,
+ triage_assignee: "davfu@google.com",
+ use_for_presubmit: true,
+ },
+}
\ No newline at end of file
diff --git a/fuzzing/presubmit_test_fuzzers/test_code.cpp b/fuzzing/presubmit_test_fuzzers/test_code.cpp
new file mode 100644
index 0000000..0548d6f
--- /dev/null
+++ b/fuzzing/presubmit_test_fuzzers/test_code.cpp
@@ -0,0 +1,14 @@
+#include <string.h>
+#include <stdlib.h>
+
+void BuggyCode1(const char *data) {
+ if (strcmp(data, "Hi!") == 0) {
+ abort(); // Boom!
+ }
+}
+
+void BuggyCode2(const char *data) {
+ if (strcmp(data, "Hey") == 0) {
+ abort(); // Boom!
+ }
+}
\ No newline at end of file
diff --git a/fuzzing/presubmit_test_fuzzers/test_fuzzer_1.cpp b/fuzzing/presubmit_test_fuzzers/test_fuzzer_1.cpp
new file mode 100644
index 0000000..19692f6
--- /dev/null
+++ b/fuzzing/presubmit_test_fuzzers/test_fuzzer_1.cpp
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <string>
+
+void BuggyCode1(const char *data);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+ std::string null_terminated_string(reinterpret_cast<const char *>(data),
+ size);
+
+ BuggyCode1(null_terminated_string.c_str());
+ return 0;
+}
diff --git a/fuzzing/presubmit_test_fuzzers/test_fuzzer_2.cpp b/fuzzing/presubmit_test_fuzzers/test_fuzzer_2.cpp
new file mode 100644
index 0000000..2eb41e5
--- /dev/null
+++ b/fuzzing/presubmit_test_fuzzers/test_fuzzer_2.cpp
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <string>
+
+void BuggyCode2(const char *data);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+ std::string null_terminated_string(reinterpret_cast<const char *>(data),
+ size);
+
+ BuggyCode2(null_terminated_string.c_str());
+ return 0;
+}