1 /*
2 * Copyright (C) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "devslinfoadpt_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #include "file_ex.h"
22 #include "securec.h"
23 #include "parameter.h"
24 #include "nativetoken_kit.h"
25 #include "token_setproc.h"
26 #include "accesstoken_kit.h"
27
28 #include "dev_slinfo_adpt.h"
29 #include "dev_slinfo_mgr.h"
30
31 namespace OHOS {
32 static bool g_isForcingFuzz3 = false;
33
34 static uint8_t g_udidInvalid[MAX_UDID_LENGTH + 1] = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF";
35
36 struct DeviceSecurityInfo {
37 uint32_t magicNum {0};
38 uint32_t result {0};
39 uint32_t level {0};
40 };
41
42 extern "C" {
43 extern void OnApiDeviceSecInfoCallback(const DeviceIdentify *identify, struct DeviceSecurityInfo *info);
44 }
45
NativeTokenGetFuzz3(void)46 static void NativeTokenGetFuzz3(void)
47 {
48 uint64_t tokenId3;
49 const char **permsFuzz3 = new const char *[1];
50 permsFuzz3[0] = "ohos.permission.DISTRIBUTED_DATASYNC";
51 NativeTokenInfoParams infoInstanceFuzz1 = {
52 .dcapsNum = 0,
53 .permsNum = 1,
54 .aclsNum = 0,
55 .dcaps = nullptr,
56 .perms = permsFuzz3,
57 .acls = nullptr,
58 .aplStr = "system_basic",
59 };
60
61 infoInstanceFuzz1.processName = "DevSLMgrTest";
62 tokenId3 = GetAccessTokenId(&infoInstanceFuzz1);
63 SetSelfTokenID(tokenId3);
64 OHOS::Security::AccessToken::AccessTokenKit::ReloadNativeTokenInfo();
65 delete[] permsFuzz3;
66 }
67
BeginFuzzCase3(void)68 static void BeginFuzzCase3(void)
69 {
70 std::string isEnforcing;
71 OHOS::LoadStringFromFile("/sys/fs/selinux/enforce", isEnforcing);
72 if (isEnforcing.compare("1") == 0) {
73 g_isForcingFuzz3 = true;
74 OHOS::SaveStringToFile("/sys/fs/selinux/enforce", "0");
75 }
76 NativeTokenGetFuzz3();
77 }
78
EndFuzzCase3(void)79 static void EndFuzzCase3(void)
80 {
81 if (g_isForcingFuzz3) {
82 OHOS::SaveStringToFile("/sys/fs/selinux/enforce", "1");
83 }
84 }
85
GetLocalUdidFuzz3(DEVSLQueryParams * queryParams)86 static int32_t GetLocalUdidFuzz3(DEVSLQueryParams *queryParams)
87 {
88 char udid[MAX_UDID_LENGTH + 1] = {0};
89 int32_t ret = GetDevUdid(udid, MAX_UDID_LENGTH + 1);
90 if (ret != DEVSL_SUCCESS) {
91 return DEVSL_ERROR;
92 }
93
94 (void)memcpy_s(queryParams->udid, MAX_UDID_LENGTH, udid, MAX_UDID_LENGTH);
95 queryParams->udidLen = MAX_UDID_LENGTH;
96 return ret;
97 }
98
FuzzDoDevSlinfoAdpt(const uint8_t * data,size_t size)99 void FuzzDoDevSlinfoAdpt(const uint8_t* data, size_t size)
100 {
101 if (data == nullptr || size <= MAX_UDID_LENGTH) {
102 return;
103 }
104 OnApiDeviceSecInfoCallback(nullptr, nullptr);
105 (void)GetDeviceSecLevelByUdidAsync(nullptr, 0);
106
107 DEVSLQueryParams queryParams;
108 (void)memset_s(&queryParams, sizeof(DEVSLQueryParams), 0, sizeof(DEVSLQueryParams));
109 queryParams.udidLen = MAX_UDID_LENGTH;
110 (void)memcpy_s(queryParams.udid, MAX_UDID_LENGTH, data, MAX_UDID_LENGTH);
111 BeginFuzzCase3();
112 int32_t ret;
113 uint32_t levelInfo = 0;
114 int32_t devLevel = 0;
115 DeviceIdentify devId;
116 DeviceSecurityInfo devInfo;
117 (void)DATASL_OnStart();
118
119 do {
120 ret = GetLocalUdidFuzz3(&queryParams);
121 if (ret != DEVSL_SUCCESS) {
122 break;
123 }
124 ret = GetDeviceSecLevelByUdid(static_cast<const uint8_t *>(g_udidInvalid), MAX_UDID_LENGTH + 1, &devLevel);
125 if (ret == DEVSL_SUCCESS) {
126 break;
127 }
128 (void)GetDeviceSecLevelByUdid(static_cast<const uint8_t *>(queryParams.udid), queryParams.udidLen, &devLevel);
129 (void)DATASL_GetHighestSecLevel(&queryParams, &levelInfo);
130
131 (void)memset_s(&devId, sizeof(devId), 0, sizeof(devId));
132 (void)memcpy_s(devId.identity, MAX_UDID_LENGTH, queryParams.udid, queryParams.udidLen);
133 devId.length = queryParams.udidLen;
134
135 OnApiDeviceSecInfoCallback(&devId, nullptr);
136 OnApiDeviceSecInfoCallback(&devId, &devInfo);
137 } while (0);
138 DATASL_OnStop();
139 EndFuzzCase3();
140 }
141 }
142
143 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)144 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
145 {
146 /* Run your code on data */
147 OHOS::FuzzDoDevSlinfoAdpt(data, size);
148 return 0;
149 }