executor: minor cleanup of android sandbox

Fix code formatting, clang-tidy warnings, minor style nits.

4 files changed, 40 insertions, 49 deletions

diff --git a/Makefile b/Makefile
index 6b618adf1..b28867868 100644
--- a/Makefile
+++ b/Makefile
@@ -221,6 +221,7 @@ format_go:
 
 format_cpp:
 	clang-format --style=file -i executor/*.cc executor/*.h \
+		executor/android/android_seccomp.h \
 		tools/kcovtrace/*.c tools/kcovfuzzer/*.c tools/fops_probe/*.cc
 
 format_sys: bin/syz-fmt
diff --git a/executor/android/android_seccomp.h b/executor/android/android_seccomp.h
index 21fd723e3..d8df52792 100644
--- a/executor/android/android_seccomp.h
+++ b/executor/android/android_seccomp.h
@@ -1,4 +1,4 @@
-// Copyright 2016 syzkaller project authors. All rights reserved.
+// Copyright 2020 syzkaller project authors. All rights reserved.
 // Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
 
 // These headers are generated by the Android build system and need to be updated periodically.
@@ -36,23 +36,21 @@ static const size_t primary_app_filter_size = x86_app_filter_size;
 #endif
 
 #define syscall_nr (offsetof(struct seccomp_data, nr))
-#define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 #define arch_nr (offsetof(struct seccomp_data, arch))
 
-
 typedef struct Filter_t {
 	struct sock_filter data[kFilterMaxSize];
 	size_t count;
 } Filter;
 
-inline void push_back(Filter* filter_array, struct sock_filter filter)
+static void push_back(Filter* filter_array, struct sock_filter filter)
 {
 	if (filter_array->count == kFilterMaxSize)
-		fail("Can't add another syscall to seccomp filter: count %zu.", filter_array->count);
+		fail("can't add another syscall to seccomp filter: count %zu", filter_array->count);
 	filter_array->data[filter_array->count++] = filter;
 }
 
-inline void Disallow(Filter* f)
+static void Disallow(Filter* f)
 {
 	struct sock_filter filter = BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP);
 	push_back(f, filter);
@@ -60,14 +58,14 @@ inline void Disallow(Filter* f)
 
 static void ExamineSyscall(Filter* f)
 {
-    struct sock_filter filter = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_nr);
+	struct sock_filter filter = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_nr);
 	push_back(f, filter);
 }
 
 static void ValidateArchitecture(Filter* f)
 {
-    struct sock_filter filter1 = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, arch_nr);
-    struct sock_filter filter2 = BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PRIMARY_ARCH, 1, 0);
+	struct sock_filter filter1 = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, arch_nr);
+	struct sock_filter filter2 = BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PRIMARY_ARCH, 1, 0);
 	push_back(f, filter1);
 	push_back(f, filter2);
 	Disallow(f);
@@ -77,8 +75,8 @@ static void ValidateArchitecture(Filter* f)
 static void install_filter(const Filter* f)
 {
 	struct sock_fprog prog = {
-		(unsigned short)f->count,
-		(struct sock_filter*)&f->data[0],
+	    (unsigned short)f->count,
+	    (struct sock_filter*)&f->data[0],
 	};
 	// This assumes either the current process has CAP_SYS_ADMIN, or PR_SET_NO_NEW_PRIVS bit is set.
 	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
@@ -87,23 +85,18 @@ static void install_filter(const Filter* f)
 }
 
 // Modified from the orignal Android code as we don't need dual arch support
-void set_app_seccomp_filter()
+static void set_app_seccomp_filter()
 {
-	const struct sock_filter *p;
-	size_t p_size;
+	const struct sock_filter* p = primary_app_filter;
+	size_t p_size = primary_app_filter_size;
+
 	Filter f;
 	f.count = 0;
-
-	p = primary_app_filter;
-	p_size = primary_app_filter_size;
-
 	ValidateArchitecture(&f);
-
 	ExamineSyscall(&f);
 
-	for (size_t i = 0; i < p_size; ++i) {
+	for (size_t i = 0; i < p_size; ++i)
 		push_back(&f, p[i]);
-	}
 	Disallow(&f);
 
 	// Will fail() if anything fails.
diff --git a/executor/common_linux.h b/executor/common_linux.h
index 3f8a5bc6d..ef071e9be 100644
--- a/executor/common_linux.h
+++ b/executor/common_linux.h
@@ -2886,10 +2886,10 @@ static int do_sandbox_namespace(void)
 #define UNTRUSTED_APP_UID AID_APP + 999
 #define UNTRUSTED_APP_GID AID_APP + 999
 
-const char* SELINUX_CONTEXT_UNTRUSTED_APP = "u:r:untrusted_app:s0:c512,c768";
-const char* SELINUX_LABEL_APP_DATA_FILE = "u:object_r:app_data_file:s0:c512,c768";
-const char* SELINUX_CONTEXT_FILE = "/proc/thread-self/attr/current";
-const char* SELINUX_XATTR_NAME = "security.selinux";
+const char* const SELINUX_CONTEXT_UNTRUSTED_APP = "u:r:untrusted_app:s0:c512,c768";
+const char* const SELINUX_LABEL_APP_DATA_FILE = "u:object_r:app_data_file:s0:c512,c768";
+const char* const SELINUX_CONTEXT_FILE = "/proc/thread-self/attr/current";
+const char* const SELINUX_XATTR_NAME = "security.selinux";
 
 const gid_t UNTRUSTED_APP_GROUPS[] = {UNTRUSTED_APP_GID, AID_NET_BT_ADMIN, AID_NET_BT, AID_INET, AID_EVERYBODY};
 const size_t UNTRUSTED_APP_NUM_GROUPS = sizeof(UNTRUSTED_APP_GROUPS) / sizeof(UNTRUSTED_APP_GROUPS[0]);
@@ -2997,6 +2997,10 @@ static int do_sandbox_android(void)
 	initialize_tun();
 #endif
 #if SYZ_EXECUTOR || SYZ_NET_DEVICES
+	// TODO(dvyukov): unshare net namespace.
+	// Currently all netdev setup happens in init namespace.
+	// It will lead to some mess, all test process will use the same devices
+	// and try to reinitialize them as other test processes use them.
 	initialize_netdevices();
 #endif
 
diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go
index 8661266e8..87fbbc435 100644
--- a/pkg/csource/generated.go
+++ b/pkg/csource/generated.go
@@ -6354,23 +6354,21 @@ static const size_t primary_app_filter_size = x86_app_filter_size;
 #endif
 
 #define syscall_nr (offsetof(struct seccomp_data, nr))
-#define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 #define arch_nr (offsetof(struct seccomp_data, arch))
 
-
 typedef struct Filter_t {
 	struct sock_filter data[kFilterMaxSize];
 	size_t count;
 } Filter;
 
-inline void push_back(Filter* filter_array, struct sock_filter filter)
+static void push_back(Filter* filter_array, struct sock_filter filter)
 {
 	if (filter_array->count == kFilterMaxSize)
-		fail("Can't add another syscall to seccomp filter: count %zu.", filter_array->count);
+		fail("can't add another syscall to seccomp filter: count %zu", filter_array->count);
 	filter_array->data[filter_array->count++] = filter;
 }
 
-inline void Disallow(Filter* f)
+static void Disallow(Filter* f)
 {
 	struct sock_filter filter = BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP);
 	push_back(f, filter);
@@ -6378,14 +6376,14 @@ inline void Disallow(Filter* f)
 
 static void ExamineSyscall(Filter* f)
 {
-    struct sock_filter filter = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_nr);
+	struct sock_filter filter = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, syscall_nr);
 	push_back(f, filter);
 }
 
 static void ValidateArchitecture(Filter* f)
 {
-    struct sock_filter filter1 = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, arch_nr);
-    struct sock_filter filter2 = BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PRIMARY_ARCH, 1, 0);
+	struct sock_filter filter1 = BPF_STMT(BPF_LD | BPF_W | BPF_ABS, arch_nr);
+	struct sock_filter filter2 = BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, PRIMARY_ARCH, 1, 0);
 	push_back(f, filter1);
 	push_back(f, filter2);
 	Disallow(f);
@@ -6393,30 +6391,25 @@ static void ValidateArchitecture(Filter* f)
 static void install_filter(const Filter* f)
 {
 	struct sock_fprog prog = {
-		(unsigned short)f->count,
-		(struct sock_filter*)&f->data[0],
+	    (unsigned short)f->count,
+	    (struct sock_filter*)&f->data[0],
 	};
 	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
 		fail("Could not set seccomp filter of size %zu", f->count);
 	}
 }
-void set_app_seccomp_filter()
+static void set_app_seccomp_filter()
 {
-	const struct sock_filter *p;
-	size_t p_size;
+	const struct sock_filter* p = primary_app_filter;
+	size_t p_size = primary_app_filter_size;
+
 	Filter f;
 	f.count = 0;
-
-	p = primary_app_filter;
-	p_size = primary_app_filter_size;
-
 	ValidateArchitecture(&f);
-
 	ExamineSyscall(&f);
 
-	for (size_t i = 0; i < p_size; ++i) {
+	for (size_t i = 0; i < p_size; ++i)
 		push_back(&f, p[i]);
-	}
 	Disallow(&f);
 	install_filter(&f);
 }
@@ -6435,10 +6428,10 @@ void set_app_seccomp_filter()
 #define UNTRUSTED_APP_UID AID_APP + 999
 #define UNTRUSTED_APP_GID AID_APP + 999
 
-const char* SELINUX_CONTEXT_UNTRUSTED_APP = "u:r:untrusted_app:s0:c512,c768";
-const char* SELINUX_LABEL_APP_DATA_FILE = "u:object_r:app_data_file:s0:c512,c768";
-const char* SELINUX_CONTEXT_FILE = "/proc/thread-self/attr/current";
-const char* SELINUX_XATTR_NAME = "security.selinux";
+const char* const SELINUX_CONTEXT_UNTRUSTED_APP = "u:r:untrusted_app:s0:c512,c768";
+const char* const SELINUX_LABEL_APP_DATA_FILE = "u:object_r:app_data_file:s0:c512,c768";
+const char* const SELINUX_CONTEXT_FILE = "/proc/thread-self/attr/current";
+const char* const SELINUX_XATTR_NAME = "security.selinux";
 
 const gid_t UNTRUSTED_APP_GROUPS[] = {UNTRUSTED_APP_GID, AID_NET_BT_ADMIN, AID_NET_BT, AID_INET, AID_EVERYBODY};
 const size_t UNTRUSTED_APP_NUM_GROUPS = sizeof(UNTRUSTED_APP_GROUPS) / sizeof(UNTRUSTED_APP_GROUPS[0]);