syz/targets: add SyzExecutorCmd flag

This commit adds a new attribute to syzkaller targets that tells
syzkaller how to invoke the syz-executor command.

Some systems, like Fuchsia, are now building syz-executor as part of the
build, and there is no need to copy it over, or to run it from `/tmp`.
In fact, that might stop working at some time in the future in Fuchsia.

All places that used to copy syz-executor into the target machine will
now check for the SyzExecutorCmd flag, and won't copy it if the flag is
set.

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/targets/targets.go b/sys/targets/targets.go
index 9c3a01f2e..34c06d5c6 100644
--- a/sys/targets/targets.go
+++ b/sys/targets/targets.go
@@ -49,6 +49,11 @@ type osCommon struct {
 	// Special mode for OSes that do not have support for building Go binaries.
 	// In this mode we run Go binaries on the host machine, only executor runs on target.
 	HostFuzzer bool
+	// How to run syz-executor directly.
+	// Some systems build syz-executor into their images.
+	// If this flag is not empty, syz-executor will not be copied to the machine, and will be run using
+	// this command instead.
+	SyzExecutorCmd string
 	// Extension of executable files (notably, .exe for windows).
 	ExeExtension string
 	// Name of the kernel object file.
@@ -361,6 +366,7 @@ var oses = map[string]osCommon{
 		ExecutorUsesShmem:      false,
 		ExecutorUsesForkServer: false,
 		HostFuzzer:             true,
+		SyzExecutorCmd:         "syz-executor",
 		KernelObject:           "zircon.elf",
 	},
 	"windows": {