Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5196239 authored by Pawan Wagh's avatar Pawan Wagh Committed by Automerger Merge Worker
Browse files

Merge "Adding service manager fuzzer. Android platform specific macros are... 

Merge "Adding service manager fuzzer. Android platform specific macros are added in access.cpp because of dependency on libselinux." am: 8f60fa31 am: d00565cb

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2165944



Change-Id: Id485539eec5524bc09d9fb17b982b4410ea67695
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 0a82a928 d00565cb

cmds/servicemanager/Access.cpp

+26 −1
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ constexpr bool kIsVendor = true; 
constexpr bool kIsVendor = false;

#endif



#ifdef __ANDROID__

static std::string getPidcon(pid_t pid) {

    android_errorWriteLog(0x534e4554, "121035042");
@@ -45,7 +46,6 @@ static std::string getPidcon(pid_t pid) { 


static struct selabel_handle* getSehandle() {

    static struct selabel_handle* gSehandle = nullptr;



    if (gSehandle != nullptr && selinux_status_updated()) {

        selabel_close(gSehandle);

        gSehandle = nullptr;
@@ -78,8 +78,10 @@ static int auditCallback(void *data, security_class_t /*cls*/, char *buf, size_t 
        ad->tname->c_str());

    return 0;

}

#endif



Access::Access() {

#ifdef __ANDROID__

    union selinux_callback cb;



    cb.func_audit = auditCallback;
@@ -91,6 +93,7 @@ Access::Access() { 
    CHECK(selinux_status_open(true /*fallback*/) >= 0);



    CHECK(getcon(&mThisProcessContext) == 0);

#endif

}



Access::~Access() {
@@ -98,6 +101,7 @@ Access::~Access() { 
}



Access::CallingContext Access::getCallingContext() {

#ifdef __ANDROID__

    IPCThreadState* ipc = IPCThreadState::self();



    const char* callingSid = ipc->getCallingSid();
@@ -108,6 +112,9 @@ Access::CallingContext Access::getCallingContext() { 
        .uid = ipc->getCallingUid(),

        .sid = callingSid ? std::string(callingSid) : getPidcon(callingPid),

    };

#else

    return CallingContext();

#endif

}



bool Access::canFind(const CallingContext& ctx,const std::string& name) {
@@ -124,6 +131,7 @@ bool Access::canList(const CallingContext& ctx) { 


bool Access::actionAllowed(const CallingContext& sctx, const char* tctx, const char* perm,

        const std::string& tname) {

#ifdef __ANDROID__

    const char* tclass = "service_manager";



    AuditCallbackData data = {
@@ -133,9 +141,18 @@ bool Access::actionAllowed(const CallingContext& sctx, const char* tctx, const c 


    return 0 == selinux_check_access(sctx.sid.c_str(), tctx, tclass, perm,

        reinterpret_cast<void*>(&data));

#else

    (void)sctx;

    (void)tctx;

    (void)perm;

    (void)tname;



    return true;

#endif

}



bool Access::actionAllowedFromLookup(const CallingContext& sctx, const std::string& name, const char *perm) {

#ifdef __ANDROID__

    char *tctx = nullptr;

    if (selabel_lookup(getSehandle(), &tctx, name.c_str(), SELABEL_CTX_ANDROID_SERVICE) != 0) {

        LOG(ERROR) << "SELinux: No match for " << name << " in service_contexts.\n";
@@ -145,6 +162,14 @@ bool Access::actionAllowedFromLookup(const CallingContext& sctx, const std::stri 
    bool allowed = actionAllowed(sctx, tctx, perm, name);

    freecon(tctx);

    return allowed;

#else

    (void)sctx;

    (void)name;

    (void)perm;

    (void)kIsVendor;



    return true;

#endif

}



}  // android

cmds/servicemanager/Android.bp

+32 −0
Original line number Diff line number Diff line
@@ -87,3 +87,35 @@ cc_test { 
    ],

    static_libs: ["libgmock"],

}



cc_fuzz {

    name: "servicemanager_fuzzer",

    defaults: ["servicemanager_defaults"],

    host_supported: true,

    static_libs: [

        "libbase",

        "libbinder_random_parcel",

        "libcutils",

    ],

    target: {

        android: {

            shared_libs: [

                "libbinder_ndk",

                "libbinder",

            ],

        },

        host: {

            static_libs: [

                "libbinder_ndk",

                "libbinder",

            ],

        },

    },

    srcs: ["ServiceManagerFuzzer.cpp"],

    fuzz_config: {

        cc: [

            "smoreland@google.com",

            "waghpawan@google.com",

        ],

    },

}

cmds/servicemanager/ServiceManagerFuzzer.cpp

0 → 100644
+38 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <fuzzbinder/libbinder_driver.h>

#include <utils/StrongPointer.h>



#include "Access.h"

#include "ServiceManager.h"



using ::android::Access;

using ::android::fuzzService;

using ::android::ServiceManager;

using ::android::sp;



extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

    if (size > 50000) {

        return 0;

    }



    auto accessPtr = std::make_unique<Access>();

    auto serviceManager = sp<ServiceManager>::make(std::move(accessPtr));

    fuzzService(serviceManager, FuzzedDataProvider(data, size));



    return 0;

}
 
 No newline at end of file