summaryrefslogtreecommitdiffstats
path: root/test/fuzz/fuzz-nspawn-oci
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:49:52 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:49:52 +0000
commit55944e5e40b1be2afc4855d8d2baf4b73d1876b5 (patch)
tree33f869f55a1b149e9b7c2b7e201867ca5dd52992 /test/fuzz/fuzz-nspawn-oci
parentInitial commit. (diff)
downloadsystemd-55944e5e40b1be2afc4855d8d2baf4b73d1876b5.tar.xz
systemd-55944e5e40b1be2afc4855d8d2baf4b73d1876b5.zip
Adding upstream version 255.4.upstream/255.4
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'test/fuzz/fuzz-nspawn-oci')
-rw-r--r--test/fuzz/fuzz-nspawn-oci/basic.json348
-rw-r--r--test/fuzz/fuzz-nspawn-oci/double-free5
-rw-r--r--test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string1
-rw-r--r--test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string21
-rw-r--r--test/fuzz/fuzz-nspawn-oci/no-mount-source92
5 files changed, 447 insertions, 0 deletions
diff --git a/test/fuzz/fuzz-nspawn-oci/basic.json b/test/fuzz/fuzz-nspawn-oci/basic.json
new file mode 100644
index 0000000..24bacf3
--- /dev/null
+++ b/test/fuzz/fuzz-nspawn-oci/basic.json
@@ -0,0 +1,348 @@
+{
+ "ociVersion": "1.0.0",
+
+ "hostname" : "foo",
+
+ "root": {
+ "path": "rootfs",
+ "readonly": true
+ },
+
+ "process": {
+ "terminal": false,
+ "consoleSize": {
+ "height":6667,
+ "width":6668
+ },
+
+ "user": {
+ "uid": 14,
+ "gid": 14,
+ "additionalGids": [59, 81]
+ },
+
+ "args": [
+ "/tmp/verify.sh"
+ ],
+
+ "env": [
+ "FOO=BAR",
+ "WITHSPACES=FOO BAR",
+ "WITHSHELLCHARS=$ASDF \\\"asdf asdf\\\" !",
+ "WITHCONTROLCHARS=\\123\\125\\010\\020",
+ "TERM=xterm"
+ ],
+
+ "cwd": "/tmp/src",
+
+ "noNewPrivileges" : true,
+ "oomScoreAdj" : 20,
+ "capabilities" : {
+ "bounding" : [
+ "CAP_AUDIT_WRITE",
+ "CAP_KILL",
+ "CAP_NET_BIND_SERVICE"
+ ],
+ "permitted" : [
+ "CAP_AUDIT_WRITE",
+ "CAP_KILL",
+ "CAP_NET_BIND_SERVICE"
+ ],
+ "inheritable" : [
+ "CAP_AUDIT_WRITE",
+ "CAP_KILL",
+ "CAP_NET_BIND_SERVICE"
+ ],
+ "effective" : [
+ "CAP_AUDIT_WRITE",
+ "CAP_KILL"
+ ],
+ "ambient" : [
+ "CAP_NET_BIND_SERVICE"
+ ]
+ },
+ "rlimits" : [
+ {
+ "type" : "RLIMIT_NOFILE",
+ "soft" : 1024,
+ "hard" : 1024
+ },
+ {
+ "type" : "RLIMIT_RTPRIO",
+ "soft" : 5,
+ "hard" : 10
+ }
+ ]
+ },
+
+ "mounts": [
+ {
+ "destination": "/tmp/src",
+ "source": "src",
+ "options": ["ro"]
+ },
+
+ {
+ "destination": "/tmp/verify.sh",
+ "source": "verify.sh",
+ "options": ["ro"]
+ },
+
+ {
+ "destination": "/proc",
+ "type": "proc",
+ "source": "proc"
+ },
+ {
+ "destination": "/dev",
+ "type": "tmpfs",
+ "source": "tmpfs",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/dev/pts",
+ "type": "devpts",
+ "source": "devpts",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/dev/shm",
+ "type": "tmpfs",
+ "source": "shm",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/dev/mqueue",
+ "type": "mqueue",
+ "source": "mqueue",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/sys",
+ "type": "sysfs",
+ "source": "sysfs",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/sys/fs/cgroup",
+ "type": "cgroup",
+ "source": "cgroup",
+ "options": [
+ "mode=777"
+ ]
+ }
+ ],
+
+ "linux" : {
+ "namespaces" : [
+ {
+ "type" : "mount"
+ },
+ {
+ "type" : "network",
+ "path" : "$NETNS"
+ },
+ {
+ "type" : "pid"
+ },
+ {
+ "type" : "uts"
+ }
+ ],
+ "uidMappings" : [
+ {
+ "containerID" : 0,
+ "hostID" : 1000,
+ "size" : 100
+ }
+ ],
+ "gidMappings" : [
+ {
+ "containerID" : 0,
+ "hostID" : 1000,
+ "size" : 100
+ }
+ ],
+ "devices" : [
+ {
+ "type" : "c",
+ "path" : "/dev/zero",
+ "major" : 1,
+ "minor" : 5,
+ "fileMode" : 444
+ },
+ {
+ "type" : "b",
+ "path" : "$DEV",
+ "major" : 4,
+ "minor" : 2,
+ "fileMode" : 666,
+ "uid" : 0,
+ "gid" : 0
+ }
+ ],
+ "resources" : {
+ "devices" : [
+ {
+ "allow" : false,
+ "access" : "m"
+ },
+ {
+ "allow" : true,
+ "type" : "b",
+ "major" : 4,
+ "minor" : 2,
+ "access" : "rwm"
+ }
+ ],
+ "memory" : {
+ "limit" : 134217728,
+ "reservation" : 33554432,
+ "swap" : 268435456
+ },
+ "cpu" : {
+ "shares" : 1024,
+ "quota" : 1000000,
+ "period" : 500000,
+ "cpus" : "0-7"
+ },
+ "blockIO" : {
+ "weight" : 10,
+ "weightDevice" : [
+ {
+ "major" : 4,
+ "minor" : 2,
+ "weight" : 500
+ }
+ ],
+ "throttleReadBpsDevice" : [
+ {
+ "major" : 4,
+ "minor" : 2,
+ "rate" : 500
+ }
+ ],
+ "throttleWriteBpsDevice" : [
+ {
+ "major" : 4,
+ "minor" : 2,
+ "rate" : 500
+ }
+ ],
+ "throttleReadIOPSDevice" : [
+ {
+ "major" : 4,
+ "minor" : 2,
+ "rate" : 500
+ }
+ ],
+ "throttleWriteIOPSDevice" : [
+ {
+ "major" : 4,
+ "minor" : 2,
+ "rate" : 500
+ }
+ ]
+ },
+ "pids" : {
+ "limit" : 1024
+ }
+ },
+ "sysctl" : {
+ "kernel.domainname" : "foo.bar",
+ "vm.swappiness" : "60"
+ },
+ "seccomp" : {
+ "defaultAction" : "SCMP_ACT_ALLOW",
+ "architectures" : [
+ "SCMP_ARCH_ARM",
+ "SCMP_ARCH_X86_64"
+ ],
+ "syscalls" : [
+ {
+ "names" : [
+ "lchown",
+ "chmod"
+ ],
+ "action" : "SCMP_ACT_ERRNO",
+ "args" : [
+ {
+ "index" : 0,
+ "value" : 1,
+ "op" : "SCMP_CMP_NE"
+ },
+ {
+ "index" : 1,
+ "value" : 2,
+ "valueTwo" : 3,
+ "op" : "SCMP_CMP_MASKED_EQ"
+ }
+ ]
+ }
+ ]
+ },
+ "rootfsPropagation" : "shared",
+ "maskedPaths" : [
+ "/proc/kcore",
+ "/root/nonexistent"
+ ],
+ "readonlyPaths" : [
+ "/proc/sys",
+ "/opt/readonly"
+ ]
+ },
+ "hooks" : {
+ "prestart" : [
+ {
+ "path" : "/bin/sh",
+ "args" : [
+ "-xec",
+ "echo $PRESTART_FOO >/prestart"
+ ],
+ "env" : [
+ "PRESTART_FOO=prestart_bar",
+ "ALSO_FOO=also_bar"
+ ],
+ "timeout" : 666
+ },
+ {
+ "path" : "/bin/touch",
+ "args" : [
+ "/tmp/also-prestart"
+ ]
+ }
+ ],
+ "poststart" : [
+ {
+ "path" : "/bin/sh",
+ "args" : [
+ "touch",
+ "/poststart"
+ ]
+ }
+ ],
+ "poststop" : [
+ {
+ "path" : "/bin/sh",
+ "args" : [
+ "touch",
+ "/poststop"
+ ]
+ }
+ ]
+ },
+ "annotations" : {
+ "hello.world" : "1",
+ "foo" : "bar"
+ }
+}
diff --git a/test/fuzz/fuzz-nspawn-oci/double-free b/test/fuzz/fuzz-nspawn-oci/double-free
new file mode 100644
index 0000000..22e42d3
--- /dev/null
+++ b/test/fuzz/fuzz-nspawn-oci/double-free
@@ -0,0 +1,5 @@
+{"ociVersion": "1.0.0",
+"linux": {"devices": [ { "access": "mmmw;r"}
+] }, "e": "}e"
+ }
+ \ No newline at end of file
diff --git a/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string b/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string
new file mode 100644
index 0000000..675bed0
--- /dev/null
+++ b/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string
@@ -0,0 +1 @@
+{"ociVersion":"1.0.0","process":{"args":[]}}
diff --git a/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string2 b/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string2
new file mode 100644
index 0000000..fb1269b
--- /dev/null
+++ b/test/fuzz/fuzz-nspawn-oci/invalid-read-magic-string2
@@ -0,0 +1 @@
+{"ociVersion":"1.0.0","process":{"args":[""]}} \ No newline at end of file
diff --git a/test/fuzz/fuzz-nspawn-oci/no-mount-source b/test/fuzz/fuzz-nspawn-oci/no-mount-source
new file mode 100644
index 0000000..0bf017c
--- /dev/null
+++ b/test/fuzz/fuzz-nspawn-oci/no-mount-source
@@ -0,0 +1,92 @@
+{
+ "ociVersion": "1.0.0",
+
+ "root": {
+ "path": "rootfs",
+ "readonly": true
+ },
+
+ "process": {
+ "terminal": false,
+ "consoleSize": {
+ "height":6667,
+ "width":6668
+ },
+
+ "user": {
+ "uid": 14,
+ "gid": 14,
+ "additionalGids": [59, 81]
+ },
+
+ "args": [
+ "/tmp/verify.sh"
+ ],
+
+ "env": [
+ "FOO=BAR",
+ "WITHSPACES=FOO BAR",
+ "WITHSHELLCHARS=$ASDF \\\"asdf asdf\\\" !",
+ "WITHCONTROLCHARS=\\123\\125\\010\\020",
+ "TERM=xterm"
+ ],
+
+ "cwd": "/tmp/src",
+
+ "rlimits": [
+ {
+ "type": "RLIMIT_NOFILE",
+ "hard": 1020,
+ "soft": 1020
+ }
+ ]
+ },
+
+ "mounts": [
+ {
+ "destination": "/tmp/src" },
+ {
+ "source": "sysfs",
+ "options": [
+ "mode=777"
+ ]
+ },
+ {
+ "destination": "/sys/fs/cgroup",
+ "type": "cgroup",
+ "source": "cgroup",
+ "options": [
+ "mode=777"
+ ]
+ }
+ ],
+
+ "hooks": {},
+
+ "linux": {
+ "resources": {
+ "devices": [
+ {
+ "allow": false,
+ "access": "rwm"
+ }
+ ]
+ },
+ "namespaces": [
+ {
+ "type": "pid"
+ },
+ {
+ "type": "ipc"
+ },
+ {
+ "type": "mount"
+ }
+ ]
+ },
+
+ "annotations": {
+ "com.example.key1": "value1",
+ "com.example.key2": "value2"
+ }
+}