-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
executor: better support for globs #5685
Conversation
4147a27
to
b3326d4
Compare
What motivated you to go with this approach rather than the second one I suggested?
|
I didn't want to use syzkaller's mutator here. I want to do some testing of ELF processing in both kernel and userspace applications, so instead I wanted to generate fuzzing artifacts with an external tool (Melkor) and then use those as-is with Syzkaller, as well as some other tools. |
b3326d4
to
8bba7cd
Compare
CI complains on some non-formatted source files:
This needs to be fixed before we can merge this. |
Head branch was pushed to by a user without write access
8bba7cd
to
3cd41b6
Compare
Looks like I missed some whitespace differences. Should be fixed now, sorry. |
Syzkaller allows user to specify filepath arguments in syscalls via globs. However, on linux, you are effectivly limited to some /sys and /dev paths due to sandboxing. With this change, user can supply their custom fuzzing artifacts to /syz-inputs to use those in globs. They are mounted read-only to increase reproducibility.
Proper glob resolution is required for fuzzing. If it times out, it does so silently, and fuzzing dictionary will be smaller then expected, without any obvious errors. Given that, it makes sense to increase glob timeouts.
3cd41b6
to
75deab3
Compare
Linux executor now mounts /syz-inputs folder to sandbox, so user can pass their own files for fuzzing with globs. Folder is mounted as RO, so this shouldn't make sandoxing less effective. (See https://groups.google.com/g/syzkaller/c/U-DISFjKLzg for specific usecase)
Timeouts for globs are disabled. They can be quite slow (with default settings, in my tests, globs started timing out on thousands of files), and right now, if glob resolution timeouts, nothing happens. If you are running debug, you can see the timeout error, but in any case, it is ignored and fuzzer runs with less inputs then user expected without any notification. I think that it is reasonable to wait for those longer then default program timeout.