|
 |
b9a53a |
From f991a9c7644f3fb5155ff823600ba5a6ea403dc4 Mon Sep 17 00:00:00 2001
|
|
|
b9a53a |
From: Evgeny Vereshchagin <evvers@ya.ru>
|
|
|
b9a53a |
Date: Fri, 16 Nov 2018 21:23:56 +0100
|
|
|
b9a53a |
Subject: [PATCH] tests: add a fuzzer for process_audit_string
|
|
|
b9a53a |
|
|
|
b9a53a |
(cherry picked from commit 090a20cfaf3d5439fa39c5d8df473b0cfef181dd)
|
|
|
b9a53a |
|
|
|
b9a53a |
Resolves: #1764560
|
|
|
b9a53a |
---
|
|
|
b9a53a |
src/fuzz/fuzz-journald-audit.c | 27 +++++++++++++++++++++++++++
|
|
|
b9a53a |
src/fuzz/meson.build | 5 +++++
|
|
|
b9a53a |
src/journal/journald-audit.c | 2 +-
|
|
|
b9a53a |
src/journal/journald-audit.h | 2 ++
|
|
|
b9a53a |
test/fuzz/fuzz-journald-audit/basic | 1 +
|
|
|
b9a53a |
5 files changed, 36 insertions(+), 1 deletion(-)
|
|
|
b9a53a |
create mode 100644 src/fuzz/fuzz-journald-audit.c
|
|
|
b9a53a |
create mode 100644 test/fuzz/fuzz-journald-audit/basic
|
|
|
b9a53a |
|
|
|
b9a53a |
diff --git a/src/fuzz/fuzz-journald-audit.c b/src/fuzz/fuzz-journald-audit.c
|
|
|
b9a53a |
new file mode 100644
|
|
|
b9a53a |
index 0000000000..fe401c0d98
|
|
|
b9a53a |
--- /dev/null
|
|
|
b9a53a |
+++ b/src/fuzz/fuzz-journald-audit.c
|
|
|
b9a53a |
@@ -0,0 +1,27 @@
|
|
|
b9a53a |
+/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
|
b9a53a |
+
|
|
|
b9a53a |
+#include "fuzz.h"
|
|
|
b9a53a |
+#include "journald-audit.h"
|
|
|
b9a53a |
+
|
|
|
b9a53a |
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
|
b9a53a |
+ Server s;
|
|
|
b9a53a |
+ _cleanup_free_ char *buffer = NULL;
|
|
|
b9a53a |
+
|
|
|
b9a53a |
+ s = (Server) {
|
|
|
b9a53a |
+ .syslog_fd = -1,
|
|
|
b9a53a |
+ .native_fd = -1,
|
|
|
b9a53a |
+ .stdout_fd = -1,
|
|
|
b9a53a |
+ .dev_kmsg_fd = -1,
|
|
|
b9a53a |
+ .audit_fd = -1,
|
|
|
b9a53a |
+ .hostname_fd = -1,
|
|
|
b9a53a |
+ .notify_fd = -1,
|
|
|
b9a53a |
+ .storage = STORAGE_NONE,
|
|
|
b9a53a |
+ };
|
|
|
b9a53a |
+ assert_se(sd_event_default(&s.event) >= 0);
|
|
|
b9a53a |
+ buffer = memdup_suffix0(data, size);
|
|
|
b9a53a |
+ assert_se(buffer);
|
|
|
b9a53a |
+ process_audit_string(&s, 0, buffer, size);
|
|
|
b9a53a |
+ server_done(&s);
|
|
|
b9a53a |
+
|
|
|
b9a53a |
+ return 0;
|
|
|
b9a53a |
+}
|
|
|
b9a53a |
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
|
|
|
b9a53a |
index 0520e448a9..5548da3822 100644
|
|
|
b9a53a |
--- a/src/fuzz/meson.build
|
|
|
b9a53a |
+++ b/src/fuzz/meson.build
|
|
|
b9a53a |
@@ -33,6 +33,11 @@ fuzzers += [
|
|
|
b9a53a |
libshared],
|
|
|
b9a53a |
[libmount]],
|
|
|
b9a53a |
|
|
|
b9a53a |
+ [['src/fuzz/fuzz-journald-audit.c'],
|
|
|
b9a53a |
+ [libjournal_core,
|
|
|
b9a53a |
+ libshared],
|
|
|
b9a53a |
+ [libselinux]],
|
|
|
b9a53a |
+
|
|
|
b9a53a |
[['src/fuzz/fuzz-journald-kmsg.c'],
|
|
|
b9a53a |
[libjournal_core,
|
|
|
b9a53a |
libshared],
|
|
|
b9a53a |
diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
|
|
|
b9a53a |
index 87726684af..7810a0139a 100644
|
|
|
b9a53a |
--- a/src/journal/journald-audit.c
|
|
|
b9a53a |
+++ b/src/journal/journald-audit.c
|
|
|
b9a53a |
@@ -313,7 +313,7 @@ static int map_all_fields(
|
|
|
b9a53a |
}
|
|
|
b9a53a |
}
|
|
|
b9a53a |
|
|
|
b9a53a |
-static void process_audit_string(Server *s, int type, const char *data, size_t size) {
|
|
|
b9a53a |
+void process_audit_string(Server *s, int type, const char *data, size_t size) {
|
|
|
b9a53a |
size_t n_iov_allocated = 0, n_iov = 0, z;
|
|
|
b9a53a |
_cleanup_free_ struct iovec *iov = NULL;
|
|
|
b9a53a |
uint64_t seconds, msec, id;
|
|
|
b9a53a |
diff --git a/src/journal/journald-audit.h b/src/journal/journald-audit.h
|
|
|
b9a53a |
index 57bb1711c9..7766618c98 100644
|
|
|
b9a53a |
--- a/src/journal/journald-audit.h
|
|
|
b9a53a |
+++ b/src/journal/journald-audit.h
|
|
|
b9a53a |
@@ -6,4 +6,6 @@
|
|
|
b9a53a |
|
|
|
b9a53a |
void server_process_audit_message(Server *s, const void *buffer, size_t buffer_size, const struct ucred *ucred, const union sockaddr_union *sa, socklen_t salen);
|
|
|
b9a53a |
|
|
|
b9a53a |
+void process_audit_string(Server *s, int type, const char *data, size_t size);
|
|
|
b9a53a |
+
|
|
|
b9a53a |
int server_open_audit(Server*s);
|
|
|
b9a53a |
diff --git a/test/fuzz/fuzz-journald-audit/basic b/test/fuzz/fuzz-journald-audit/basic
|
|
|
b9a53a |
new file mode 100644
|
|
|
b9a53a |
index 0000000000..d1ce8cc5f0
|
|
|
b9a53a |
--- /dev/null
|
|
|
b9a53a |
+++ b/test/fuzz/fuzz-journald-audit/basic
|
|
|
b9a53a |
@@ -0,0 +1 @@
|
|
|
b9a53a |
+audit(1542398162.211:744): pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="vagrant" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
|
|
|
b9a53a |
\ No newline at end of file
|