diff options
Diffstat (limited to 'executor/common_linux.h')
| -rw-r--r-- | executor/common_linux.h | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/executor/common_linux.h b/executor/common_linux.h index 5528257ac..56d5e15ab 100644 --- a/executor/common_linux.h +++ b/executor/common_linux.h @@ -902,7 +902,8 @@ static long syz_kvm_setup_cpu(long a0, long a1, long a2, long a3, long a4, long #endif #endif -#if SYZ_EXECUTOR || SYZ_FAULT_INJECTION || SYZ_SANDBOX_NAMESPACE || SYZ_ENABLE_CGROUPS +#if SYZ_EXECUTOR || SYZ_FAULT_INJECTION || SYZ_ENABLE_CGROUPS || SYZ_SANDBOX_NONE || \ + SYZ_SANDBOX_SETUID || SYZ_SANDBOX_NAMESPACE || SYZ_SANDBOX_ANDROID_UNTRUSTED_APP #include <errno.h> #include <fcntl.h> #include <stdarg.h> @@ -1557,6 +1558,29 @@ static void sandbox_common() if (unshare(CLONE_SYSVSEM)) { debug("unshare(CLONE_SYSVSEM): %d\n", errno); } + // These sysctl's restrict ipc resource usage (by default it's possible + // to eat all system memory by creating e.g. lots of large sem sets). + // These sysctl's are per-namespace, so we need to set them inside + // of the test ipc namespace (after CLONE_NEWIPC). + typedef struct { + const char* name; + const char* value; + } sysctl_t; + static const sysctl_t sysctls[] = { + {"/proc/sys/kernel/shmmax", "16777216"}, + {"/proc/sys/kernel/shmall", "536870912"}, + {"/proc/sys/kernel/shmmni", "1024"}, + {"/proc/sys/kernel/msgmax", "8192"}, + {"/proc/sys/kernel/msgmni", "1024"}, + {"/proc/sys/kernel/msgmnb", "1024"}, + {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, + }; + unsigned i; + for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) { + if (!write_file(sysctls[i].name, sysctls[i].value)) { + debug("failed to set sysctl %s=%s\n", sysctls[i].name, sysctls[i].value); + } + } } int wait_for_loop(int pid) |