mirror of
https://github.com/reactos/syzkaller.git
synced 2024-11-28 05:40:26 +00:00
3a35170a24
I had missed that once hardening is enabled, it automatically disables
any exposure of JITed addresses, therefore when crashes or warnings are
thrown we don't unwind beyond a helper function. For now disable hardening.
After merge window I'll see if it's possible to detangle the case where
kernel queries kallsyms internally to find function names whenever a WARN
or BUG is thrown. If that's not possible easily, we can potentially add a
harden mode 3 which does hardening but does not disable kallsyms exposure
and then set this here for tools like syzkaller.
Fixes: ac9b19d2e4 ("bpf: enable hardening mode 1 for jited images")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
[dvyukov: also updated dashboard/config/upstream.sysctl]
46 lines
2.2 KiB
Bash
Executable File
46 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Copyright 2016 syzkaller project authors. All rights reserved.
|
|
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
|
|
|
|
# create-image.sh creates a minimal Debian-wheezy Linux image suitable for syzkaller.
|
|
|
|
set -eux
|
|
|
|
# Create a minimal Debian-wheezy distributive as a directory.
|
|
RELEASE=wheezy
|
|
DIR=wheezy
|
|
sudo rm -rf $DIR
|
|
mkdir -p $DIR
|
|
sudo debootstrap --include=openssh-server,curl,tar,gcc,libc6-dev,time,strace,sudo,less,psmisc,selinux-utils,policycoreutils,checkpolicy,selinux-policy-default $RELEASE $DIR
|
|
|
|
# Set some defaults and enable promtless ssh to the machine for root.
|
|
sudo sed -i '/^root/ { s/:x:/::/ }' $DIR/etc/passwd
|
|
echo 'T0:23:respawn:/sbin/getty -L ttyS0 115200 vt100' | sudo tee -a $DIR/etc/inittab
|
|
printf '\nauto eth0\niface eth0 inet dhcp\n' | sudo tee -a $DIR/etc/network/interfaces
|
|
echo 'debugfs /sys/kernel/debug debugfs defaults 0 0' | sudo tee -a $DIR/etc/fstab
|
|
echo 'binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc defaults 0 0' | sudo tee -a $DIR/etc/fstab
|
|
echo 'SELINUX=disabled' | sudo tee $DIR/etc/selinux/config
|
|
echo "kernel.printk = 7 4 1 3" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo 'debug.exception-trace = 0' | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "net.core.bpf_jit_enable = 1" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "net.core.bpf_jit_kallsyms = 1" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "net.core.bpf_jit_harden = 0" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "kernel.softlockup_all_cpu_backtrace = 1" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "kernel.kptr_restrict = 0" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "kernel.watchdog_thresh = 60" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo "net.ipv4.ping_group_range = 0 65535" | sudo tee -a $DIR/etc/sysctl.conf
|
|
echo -en "127.0.0.1\tlocalhost\n" | sudo tee $DIR/etc/hosts
|
|
echo "nameserver 8.8.8.8" | sudo tee -a $DIR/etc/resolve.conf
|
|
echo "syzkaller" | sudo tee $DIR/etc/hostname
|
|
ssh-keygen -f $RELEASE.id_rsa -t rsa -N ''
|
|
sudo mkdir -p $DIR/root/.ssh/
|
|
cat $RELEASE.id_rsa.pub | sudo tee $DIR/root/.ssh/authorized_keys
|
|
|
|
# Build a disk image
|
|
dd if=/dev/zero of=$RELEASE.img bs=1M seek=2047 count=1
|
|
sudo mkfs.ext4 -F $RELEASE.img
|
|
sudo mkdir -p /mnt/$DIR
|
|
sudo mount -o loop $RELEASE.img /mnt/$DIR
|
|
sudo cp -a $DIR/. /mnt/$DIR/.
|
|
sudo umount /mnt/$DIR
|