Skip isolation steps that prevent AFL++ from operating:
- close_range(): AFL++ needs its shared memory fds open
- User namespace and setuid/setgid: the fuzzer runs in a
separate rootless namespace, not passt's own
- Capability dropping: not needed without real isolation
- Seccomp BPF filters: the fuzz loop uses syscalls
(epoll_create1, fork, execl).
Signed-off-by: Anshu Kumari
---
isolation.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/isolation.c b/isolation.c
index a30b329f..0d1e6423 100644
--- a/isolation.c
+++ b/isolation.c
@@ -275,6 +275,7 @@ int isolate_fds(int argc, char **argv)
fd = close_from++;
}
+#ifndef FUZZING
if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) {
if (errno == ENOSYS || errno == EINVAL) {
/* This probably means close_range() or the
@@ -288,6 +289,9 @@ int isolate_fds(int argc, char **argv)
die_perror("Failed to close files leaked by parent");
}
}
+#else
+ (void)close_from;
+#endif /* !FUZZING */
return fd;
}
@@ -311,6 +315,7 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
{
uint64_t ns_caps = 0;
+#ifndef FUZZING
/* First set our UID & GID in the original namespace */
if (setgroups(0, NULL)) {
/* If we don't have CAP_SETGID, this will EPERM */
@@ -340,6 +345,10 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
if (unshare(CLONE_NEWUSER) != 0)
die_perror("Couldn't create user namespace");
}
+#else
+ (void)uid;
+ (void)gid;
+#endif /* !FUZZING */
/* Joining a new userns gives us full capabilities; drop the
* ones we don't need. With --netns-only we haven't changed
@@ -371,7 +380,11 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
ns_caps |= BIT(CAP_SYS_PTRACE);
}
+#ifndef FUZZING
drop_caps_ep_except(ns_caps);
+#else
+ (void)ns_caps;
+#endif /* !FUZZING */
}
/**
@@ -389,6 +402,7 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
*/
int isolate_prefork(const struct ctx *c)
{
+#ifndef FUZZING
int flags = CLONE_NEWIPC | CLONE_NEWNS | CLONE_NEWUTS;
uint64_t ns_caps = 0;
@@ -452,6 +466,9 @@ int isolate_prefork(const struct ctx *c)
clamp_caps();
drop_caps_ep_except(ns_caps);
+#else
+ (void)c;
+#endif /* !FUZZING */
return 0;
}
@@ -466,10 +483,13 @@ int isolate_prefork(const struct ctx *c)
*/
void isolate_postfork(const struct ctx *c)
{
+#ifndef FUZZING
struct sock_fprog prog;
+#endif /* !FUZZING */
prctl(PR_SET_DUMPABLE, 0);
+#ifndef FUZZING
switch (c->mode) {
case MODE_PASST:
prog.len = (unsigned short)ARRAY_SIZE(filter_passt);
@@ -490,4 +510,7 @@ void isolate_postfork(const struct ctx *c)
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
die_perror("Failed to apply seccomp filter");
+#else
+ (void)c;
+#endif /* !FUZZING */
}
--
2.55.0