picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge pull request #10817 from evverx/audit-fuzzer

Browse source 
Add a fuzzer for process_audit_string
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2018-11-17 18:26:54 +01:00 committed by GitHub
parent af18705f8e ed62712dc6
commit f921797d61
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 55 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/fuzz/fuzz-journald-audit.c Normal file
View file

@ -0,0 +1,15 @@
/* SPDX-License-Identifier: LGPL-2.1+ */
#include "fuzz.h"
#include "fuzz-journald.h"
#include "journald-audit.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
Server s;
dummy_server_init(&s, data, size);
process_audit_string(&s, 0, s.buffer, size);
server_done(&s);
return 0;
}

20
src/fuzz/fuzz-journald-kmsg.c
View file

@ -1,29 +1,17 @@
/* SPDX-License-Identifier: LGPL-2.1+ */
#include "fuzz.h"
#include "fuzz-journald.h"
#include "journald-kmsg.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
Server s = {};
_cleanup_free_ char *buffer = NULL;
Server s;
if (size == 0)
return 0;
s = (Server) {
.syslog_fd = -1,
.native_fd = -1,
.stdout_fd = -1,
.dev_kmsg_fd = -1,
.audit_fd = -1,
.hostname_fd = -1,
.notify_fd = -1,
.storage = STORAGE_NONE,
};
assert_se(sd_event_default(&s.event) >= 0);
buffer = memdup(data, size);
assert_se(buffer);
dev_kmsg_record(&s, buffer, size);
dummy_server_init(&s, data, size);
dev_kmsg_record(&s, s.buffer, size);
server_done(&s);
return 0;

26
src/fuzz/fuzz-journald.c
View file

@ -5,12 +5,29 @@
#include "journald-server.h"
#include "sd-event.h"
void dummy_server_init(Server *s, const uint8_t *buffer, size_t size) {
*s = (Server) {
.syslog_fd = -1,
.native_fd = -1,
.stdout_fd = -1,
.dev_kmsg_fd = -1,
.audit_fd = -1,
.hostname_fd = -1,
.notify_fd = -1,
.storage = STORAGE_NONE,
};
assert_se(sd_event_default(&s->event) >= 0);
s->buffer = memdup_suffix0(buffer, size);
assert_se(s->buffer);
s->buffer_size = size + 1;
}
void fuzz_journald_processing_function(
const uint8_t *data,
size_t size,
void (*f)(Server *s, const char *buf, size_t raw_len, const struct ucred *ucred, const struct timeval *tv, const char *label, size_t label_len)
) {
Server s = {};
Server s;
char *label = NULL;
size_t label_len = 0;
struct ucred *ucred = NULL;
@ -19,12 +36,7 @@ void fuzz_journald_processing_function(
if (size == 0)
return;
assert_se(sd_event_default(&s.event) >= 0);
s.syslog_fd = s.native_fd = s.stdout_fd = s.dev_kmsg_fd = s.audit_fd = s.hostname_fd = s.notify_fd = -1;
s.buffer = memdup_suffix0(data, size);
assert_se(s.buffer);
s.buffer_size = size + 1;
s.storage = STORAGE_NONE;
dummy_server_init(&s, data, size);
(*f)(&s, s.buffer, size, ucred, tv, label, label_len);
server_done(&s);
}

2
src/fuzz/fuzz-journald.h
View file

@ -3,6 +3,8 @@
#include "journald-server.h"
void dummy_server_init(Server *s, const uint8_t *buffer, size_t size);
void fuzz_journald_processing_function(
const uint8_t *data,
size_t size,

9
src/fuzz/meson.build
View file

@ -51,7 +51,14 @@ fuzzers += [
libshared],
[libmount]],
[['src/fuzz/fuzz-journald-kmsg.c'],
[['src/fuzz/fuzz-journald-audit.c',
'src/fuzz/fuzz-journald.c'],
[libjournal_core,
libshared],
[libselinux]],
[['src/fuzz/fuzz-journald-kmsg.c',
'src/fuzz/fuzz-journald.c'],
[libjournal_core,
libshared],
[libselinux]],

5
src/journal/journald-audit.c
View file

@ -313,7 +313,7 @@ static int map_all_fields(
}
}
static void process_audit_string(Server *s, int type, const char *data, size_t size) {
void process_audit_string(Server *s, int type, const char *data, size_t size) {
size_t n_iov_allocated = 0, n_iov = 0, z;
_cleanup_free_ struct iovec *iov = NULL;
uint64_t seconds, msec, id;
@ -341,11 +341,12 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s
if (!p)
return;
k = 0;
if (sscanf(p, "(%" PRIu64 ".%" PRIu64 ":%" PRIu64 "):%n",
&seconds,
&msec,
&id,
&k) != 3)
&k) != 3 || k == 0)
return;
p += k;

2
src/journal/journald-audit.h
View file

@ -6,4 +6,6 @@
void server_process_audit_message(Server *s, const void *buffer, size_t buffer_size, const struct ucred *ucred, const union sockaddr_union *sa, socklen_t salen);
void process_audit_string(Server *s, int type, const char *data, size_t size);
int server_open_audit(Server*s);

1
test/fuzz/fuzz-journald-audit/basic Normal file
View file

@ -0,0 +1 @@
audit(1542398162.211:744): pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="vagrant" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'

1
test/fuzz/fuzz-journald-audit/crash Normal file
View file

@ -0,0 +1 @@
audit(1542398162.211:744) pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="vagrant" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'