RFC: android: Add support for untrusted_app sandboxing (#697)

executor: add support for android_untrusted_app sandbox

This adds a new sandbox type, 'android_untrusted_app', which restricts
syz-executor to the privileges which are available to third-party applications,
e.g. those installed from the Google Play store.

In particular, this uses the UID space reserved for applications (instead of
the 'setuid' sandbox, which uses the traditional 'nobody' user / 65534)
as well as a set of groups which the Android-specific kernels are aware of,
and finally ensures that the SELinux context is set appropriately.

Dependencies on libselinux are avoided by manually implementing the few
functions that are needed to change the context of the current process,
and arbitrary files.  The underlying mechanisms are relatively simple.

Fixes google/syzkaller#643

Test: make presubmit
Bug: http://b/112900774

1 files changed, 21 insertions, 1 deletions

diff --git a/pkg/csource/options_test.go b/pkg/csource/options_test.go
index 61ebe5827..d8e8a217e 100644
--- a/pkg/csource/options_test.go
+++ b/pkg/csource/options_test.go
@@ -47,6 +47,26 @@ func TestParseOptionsCanned(t *testing.T) {
 			HandleSegv:    true,
 			Repro:         true,
 		},
+		`{"threaded":true,"collide":true,"repeat":true,"procs":10,"sandbox":"android_untrusted_app",
+		"fault":true,"fault_call":1,"fault_nth":2,"tun":true,"tmpdir":true,"cgroups":true,
+		"netdev":true,"resetnet":true,
+		"segv":true,"waitrepeat":true,"debug":true,"repro":true}`: {
+			Threaded:      true,
+			Collide:       true,
+			Repeat:        true,
+			Procs:         10,
+			Sandbox:       "android_untrusted_app",
+			Fault:         true,
+			FaultCall:     1,
+			FaultNth:      2,
+			EnableTun:     true,
+			UseTmpDir:     true,
+			EnableCgroups: true,
+			EnableNetdev:  true,
+			ResetNet:      true,
+			HandleSegv:    true,
+			Repro:         true,
+		},
 		"{Threaded:true Collide:true Repeat:true Procs:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:true UseTmpDir:true HandleSegv:true WaitRepeat:true Debug:false Repro:false}": {
 			Threaded:      true,
 			Collide:       true,
@@ -140,7 +160,7 @@ func enumerateField(OS string, opt Options, field int) []Options {
 	fldName := s.Type().Field(field).Name
 	fld := s.Field(field)
 	if fldName == "Sandbox" {
-		for _, sandbox := range []string{"", "none", "setuid", "namespace"} {
+		for _, sandbox := range []string{"", "none", "setuid", "namespace", "android_untrusted_app"} {
 			fld.SetString(sandbox)
 			opts = append(opts, opt)
 		}