diff options
| author | kalder <61064868+kalder@users.noreply.github.com> | 2023-02-06 09:03:38 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-06 17:03:38 +0000 |
| commit | 5bc3be51cc65ecf6d4532ac7c93b6d5d284d5a38 (patch) | |
| tree | 31db1b267d471ac5a7308abd07fb72c256f521ec /executor | |
| parent | 0a9c11b64c9f99ba6bf90f22430b6794577c7aeb (diff) | |
executor: fix initialize_tun() for Android (#3656)
Android devices often fail during the initial check with the error:
SYZFAIL: tun: ioctl(TUNSETIFF) failed
We need the same namespacing here that is used for other sandboxing
configurations.
Diffstat (limited to 'executor')
| -rw-r--r-- | executor/common_linux.h | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/executor/common_linux.h b/executor/common_linux.h index 06d94fe67..e53a908ab 100644 --- a/executor/common_linux.h +++ b/executor/common_linux.h @@ -4354,6 +4354,14 @@ static int do_sandbox_android(uint64 sandbox_arg) #if SYZ_EXECUTOR || SYZ_NET_DEVICES initialize_netdevices_init(); #endif + // CLONE_NEWNET must always happen before tun setup, because we want the tun + // device in the test namespace. If we don't do this, executor will crash with + // SYZFATAL: executor NUM failed NUM times: executor NUM: EOF + if (unshare(CLONE_NEWNET)) { + debug("unshare(CLONE_NEWNET): %d\n", errno); + } + // Enable access to IPPROTO_ICMP sockets, must be done after CLONE_NEWNET. + write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); #if SYZ_EXECUTOR || SYZ_DEVLINK_PCI initialize_devlink_pci(); #endif @@ -4361,10 +4369,6 @@ static int do_sandbox_android(uint64 sandbox_arg) initialize_tun(); #endif #if SYZ_EXECUTOR || SYZ_NET_DEVICES - // TODO(dvyukov): unshare net namespace. - // Currently all netdev setup happens in init namespace. - // It will lead to some mess, all test process will use the same devices - // and try to reinitialize them as other test processes use them. initialize_netdevices(); #endif uid_t uid = UNTRUSTED_APP_UID; |