commit ab56a475fb4d2eb7b9ab23bbeefb0a703e31fa41
author Pawan <waghpawan@google.com> Tue Jul 26 17:06:25 2022 +0000
committer Pawan <waghpawan@google.com> Tue Jul 26 17:41:45 2022 +0000
tree 6e1bb03429e0c66c3fe03f1ecf3005fded1f3c19
parent 05f897cae9b8590c43717b3492e470fa0197c330

Adding service manager fuzzer. Android platform specific macros are added in access.cpp because of dependency on libselinux.

Steps to run:
On host :
m servicemanager_fuzzer && $ANDROID_HOST_OUT/fuzz/x86_64/servicemanager_fuzzer/servicemanager_fuzzer
On Device:
cd ${ANDROID_PRODUCT_OUT}
adb root
adb sync data
adb shell /data/fuzz/$(get_build_var TARGET_ARCH)/servicemanager_fuzzer/servicemanager_fuzzer

Test: atest servicemanager_test
Bug: 232439428
Change-Id: Ic20b7e842bcaa40762e612557a3d85bf009ae105

cmds/servicemanager/Access.cpp

diff --git a/cmds/servicemanager/Access.cpp b/cmds/servicemanager/Access.cpp
index b7e520f..711038c 100644
--- a/cmds/servicemanager/Access.cpp
+++ b/cmds/servicemanager/Access.cpp
@@ -30,6 +30,7 @@
 constexpr bool kIsVendor = false;
 #endif
 
+#ifdef __ANDROID__
 static std::string getPidcon(pid_t pid) {
     android_errorWriteLog(0x534e4554, "121035042");
 
@@ -45,7 +46,6 @@
 
 static struct selabel_handle* getSehandle() {
     static struct selabel_handle* gSehandle = nullptr;
-
     if (gSehandle != nullptr && selinux_status_updated()) {
         selabel_close(gSehandle);
         gSehandle = nullptr;
@@ -78,8 +78,10 @@
         ad->tname->c_str());
     return 0;
 }
+#endif
 
 Access::Access() {
+#ifdef __ANDROID__
     union selinux_callback cb;
 
     cb.func_audit = auditCallback;
@@ -91,6 +93,7 @@
     CHECK(selinux_status_open(true /*fallback*/) >= 0);
 
     CHECK(getcon(&mThisProcessContext) == 0);
+#endif
 }
 
 Access::~Access() {
@@ -98,6 +101,7 @@
 }
 
 Access::CallingContext Access::getCallingContext() {
+#ifdef __ANDROID__
     IPCThreadState* ipc = IPCThreadState::self();
 
     const char* callingSid = ipc->getCallingSid();
@@ -108,6 +112,9 @@
         .uid = ipc->getCallingUid(),
         .sid = callingSid ? std::string(callingSid) : getPidcon(callingPid),
     };
+#else
+    return CallingContext();
+#endif
 }
 
 bool Access::canFind(const CallingContext& ctx,const std::string& name) {
@@ -124,6 +131,7 @@
 
 bool Access::actionAllowed(const CallingContext& sctx, const char* tctx, const char* perm,
         const std::string& tname) {
+#ifdef __ANDROID__
     const char* tclass = "service_manager";
 
     AuditCallbackData data = {
@@ -133,9 +141,18 @@
 
     return 0 == selinux_check_access(sctx.sid.c_str(), tctx, tclass, perm,
         reinterpret_cast<void*>(&data));
+#else
+    (void)sctx;
+    (void)tctx;
+    (void)perm;
+    (void)tname;
+
+    return true;
+#endif
 }
 
 bool Access::actionAllowedFromLookup(const CallingContext& sctx, const std::string& name, const char *perm) {
+#ifdef __ANDROID__
     char *tctx = nullptr;
     if (selabel_lookup(getSehandle(), &tctx, name.c_str(), SELABEL_CTX_ANDROID_SERVICE) != 0) {
         LOG(ERROR) << "SELinux: No match for " << name << " in service_contexts.\n";
@@ -145,6 +162,14 @@
     bool allowed = actionAllowed(sctx, tctx, perm, name);
     freecon(tctx);
     return allowed;
+#else
+    (void)sctx;
+    (void)name;
+    (void)perm;
+    (void)kIsVendor;
+
+    return true;
+#endif
 }
 
 }  // android