diff options
| author | Zach Riggle <zachriggle@users.noreply.github.com> | 2018-09-17 04:33:11 -0500 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2018-09-17 11:33:11 +0200 |
| commit | 0eca949a6c271b879d582e01c3d1d79dc704172c (patch) | |
| tree | ff6c780fbf4993aaa11036de414a74c28ac0fb5d /executor/executor.cc | |
| parent | fd85ed48854729938fad986fc81e1c57a667fb36 (diff) | |
RFC: android: Add support for untrusted_app sandboxing (#697)
executor: add support for android_untrusted_app sandbox
This adds a new sandbox type, 'android_untrusted_app', which restricts
syz-executor to the privileges which are available to third-party applications,
e.g. those installed from the Google Play store.
In particular, this uses the UID space reserved for applications (instead of
the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534)
as well as a set of groups which the Android-specific kernels are aware of,
and finally ensures that the SELinux context is set appropriately.
Dependencies on libselinux are avoided by manually implementing the few
functions that are needed to change the context of the current process,
and arbitrary files. The underlying mechanisms are relatively simple.
Fixes google/syzkaller#643
Test: make presubmit
Bug: http://b/112900774
Diffstat (limited to 'executor/executor.cc')
| -rw-r--r-- | executor/executor.cc | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/executor/executor.cc b/executor/executor.cc index 22fe8d50e..2244cc797 100644 --- a/executor/executor.cc +++ b/executor/executor.cc @@ -101,6 +101,7 @@ enum sandbox_type { sandbox_none, sandbox_setuid, sandbox_namespace, + sandbox_android_untrusted_app }; bool flag_debug; @@ -369,6 +370,9 @@ int main(int argc, char** argv) case sandbox_namespace: status = do_sandbox_namespace(); break; + case sandbox_android_untrusted_app: + status = do_sandbox_android_untrusted_app(); + break; default: fail("unknown sandbox type"); } @@ -415,6 +419,7 @@ void setup_control_pipes() void parse_env_flags(uint64 flags) { + // Note: Values correspond to ordering in pkg/ipc/ipc.go, e.g. FlagSandboxNamespace flag_debug = flags & (1 << 0); flag_cover = flags & (1 << 1); flag_sandbox = sandbox_none; @@ -422,9 +427,11 @@ void parse_env_flags(uint64 flags) flag_sandbox = sandbox_setuid; else if (flags & (1 << 3)) flag_sandbox = sandbox_namespace; - flag_enable_tun = flags & (1 << 4); - flag_enable_net_dev = flags & (1 << 5); - flag_enable_fault_injection = flags & (1 << 6); + else if (flags & (1 << 4)) + flag_sandbox = sandbox_android_untrusted_app; + flag_enable_tun = flags & (1 << 5); + flag_enable_net_dev = flags & (1 << 6); + flag_enable_fault_injection = flags & (1 << 7); } #if SYZ_EXECUTOR_USES_FORK_SERVER |