Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d00565cb authored by Pawan Wagh's avatar Pawan Wagh Committed by Automerger Merge Worker
Browse files

Merge "Adding service manager fuzzer. Android platform specific macros are... 

Merge "Adding service manager fuzzer. Android platform specific macros are added in access.cpp because of dependency on libselinux." am: 8f60fa31

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2165944



Change-Id: Ibe1deb09e58a14a815a13d06903263e582f9ef76
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 2d017733 8f60fa31

cmds/servicemanager/Access.cpp

+26 −1
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ constexpr bool kIsVendor = true; 
constexpr bool kIsVendor = false;

#endif



#ifdef __ANDROID__

static std::string getPidcon(pid_t pid) {

    android_errorWriteLog(0x534e4554, "121035042");
@@ -45,7 +46,6 @@ static std::string getPidcon(pid_t pid) { 


static struct selabel_handle* getSehandle() {

    static struct selabel_handle* gSehandle = nullptr;



    if (gSehandle != nullptr && selinux_status_updated()) {

        selabel_close(gSehandle);

        gSehandle = nullptr;
@@ -78,8 +78,10 @@ static int auditCallback(void *data, security_class_t /*cls*/, char *buf, size_t 
        ad->tname->c_str());

    return 0;

}

#endif



Access::Access() {

#ifdef __ANDROID__

    union selinux_callback cb;



    cb.func_audit = auditCallback;
@@ -91,6 +93,7 @@ Access::Access() { 
    CHECK(selinux_status_open(true /*fallback*/) >= 0);



    CHECK(getcon(&mThisProcessContext) == 0);

#endif

}



Access::~Access() {
@@ -98,6 +101,7 @@ Access::~Access() { 
}



Access::CallingContext Access::getCallingContext() {

#ifdef __ANDROID__

    IPCThreadState* ipc = IPCThreadState::self();



    const char* callingSid = ipc->getCallingSid();
@@ -108,6 +112,9 @@ Access::CallingContext Access::getCallingContext() { 
        .uid = ipc->getCallingUid(),

        .sid = callingSid ? std::string(callingSid) : getPidcon(callingPid),

    };

#else

    return CallingContext();

#endif

}



bool Access::canFind(const CallingContext& ctx,const std::string& name) {
@@ -124,6 +131,7 @@ bool Access::canList(const CallingContext& ctx) { 


bool Access::actionAllowed(const CallingContext& sctx, const char* tctx, const char* perm,

        const std::string& tname) {

#ifdef __ANDROID__

    const char* tclass = "service_manager";



    AuditCallbackData data = {
@@ -133,9 +141,18 @@ bool Access::actionAllowed(const CallingContext& sctx, const char* tctx, const c 


    return 0 == selinux_check_access(sctx.sid.c_str(), tctx, tclass, perm,

        reinterpret_cast<void*>(&data));

#else

    (void)sctx;

    (void)tctx;

    (void)perm;

    (void)tname;



    return true;

#endif

}



bool Access::actionAllowedFromLookup(const CallingContext& sctx, const std::string& name, const char *perm) {

#ifdef __ANDROID__

    char *tctx = nullptr;

    if (selabel_lookup(getSehandle(), &tctx, name.c_str(), SELABEL_CTX_ANDROID_SERVICE) != 0) {

        LOG(ERROR) << "SELinux: No match for " << name << " in service_contexts.\n";
@@ -145,6 +162,14 @@ bool Access::actionAllowedFromLookup(const CallingContext& sctx, const std::stri 
    bool allowed = actionAllowed(sctx, tctx, perm, name);

    freecon(tctx);

    return allowed;

#else

    (void)sctx;

    (void)name;

    (void)perm;

    (void)kIsVendor;



    return true;

#endif

}



}  // android

cmds/servicemanager/Android.bp

+32 −0
Original line number Diff line number Diff line
@@ -87,3 +87,35 @@ cc_test { 
    ],

    static_libs: ["libgmock"],

}



cc_fuzz {

    name: "servicemanager_fuzzer",

    defaults: ["servicemanager_defaults"],

    host_supported: true,

    static_libs: [

        "libbase",

        "libbinder_random_parcel",

        "libcutils",

    ],

    target: {

        android: {

            shared_libs: [

                "libbinder_ndk",

                "libbinder",

            ],

        },

        host: {

            static_libs: [

                "libbinder_ndk",

                "libbinder",

            ],

        },

    },

    srcs: ["ServiceManagerFuzzer.cpp"],

    fuzz_config: {

        cc: [

            "smoreland@google.com",

            "waghpawan@google.com",

        ],

    },

}

cmds/servicemanager/ServiceManagerFuzzer.cpp

0 → 100644
+38 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <fuzzbinder/libbinder_driver.h>

#include <utils/StrongPointer.h>



#include "Access.h"

#include "ServiceManager.h"



using ::android::Access;

using ::android::fuzzService;

using ::android::ServiceManager;

using ::android::sp;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    if (size > 50000) {

        return 0;

    }



    auto accessPtr = std::make_unique<Access>();

    auto serviceManager = sp<ServiceManager>::make(std::move(accessPtr));

    fuzzService(serviceManager, FuzzedDataProvider(data, size));



    return 0;

}
 
 No newline at end of file