1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
include <sys/types.h>
include <sys/ioctl.h>
include <sys/mman.h>
include <sys/stat.h>
include <fcntl.h>
include <unistd.h>
include <sys/time.h>
include <dirent.h>
include <poll.h>
include <sys/select.h>
include <sys/param.h>
include <sys/resource.h>
include <time.h>
include <signal.h>
include <sys/wait.h>
syz_execute_func(text ptr[in, text[target]])
pipe(pipefd ptr[out, pipefd])
stat(file ptr[in, filename], statbuf ptr[out, stat])
lstat(file ptr[in, filename], statbuf ptr[out, stat])
chflags(file ptr[in, filename], flags flags[chflags_flags])
fchflags(fd fd, flags flags[chflags_flags])
chflagsat(dirfd fd_dir, file ptr[in, filename], flags flags[chflags_flags], atflags flags[chflagsat_flags])
poll(fds ptr[in, array[pollfd]], nfds len[fds], timeout int32)
select(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timeval])
fcntl$dupfd(fd fd, cmd flags[fcntl_dupfd], arg fd) fd
fcntl$getflags(fd fd, cmd flags[fcntl_getflags])
fcntl$setflags(fd fd, cmd const[F_SETFD], flags flags[fcntl_flags])
fcntl$setstatus(fd fd, cmd const[F_SETFL], flags flags[fcntl_status])
fcntl$lock(fd fd, cmd flags[fcntl_lock], lock ptr[in, flock])
fcntl$getown(fd fd, cmd const[F_GETOWN]) pid
fcntl$setown(fd fd, cmd const[F_SETOWN], pid pid)
ioctl$FIOASYNC(fd fd, cmd const[FIOASYNC], arg ptr[in, int32])
ioctl$FIOGETOWN(fd fd, cmd const[FIOGETOWN], arg ptr[out, int32])
ioctl$FIONBIO(fd fd, cmd const[FIONBIO], arg ptr[in, int32])
ioctl$FIONREAD(fd fd, cmd const[FIONREAD], arg ptr[out, int32])
ioctl$FIOSETOWN(fd fd, cmd const[FIOSETOWN], arg ptr[in, int32])
mknod(file ptr[in, filename], mode flags[mknod_mode], dev int32)
mknod$loop(file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev int32)
chmod(file ptr[in, filename], mode flags[open_mode])
fchmod(fd fd, mode flags[open_mode])
fchmodat(dirfd fd_dir, file ptr[in, filename], mode flags[open_mode], flags flags[at_flags])
chown(file ptr[in, filename], uid uid, gid gid)
lchown(file ptr[in, filename], uid uid, gid gid)
fchown(fd fd, uid uid, gid gid)
fchownat(dirfd fd_dir, file ptr[in, filename], uid uid, gid gid, flags flags[at_flags])
faccessat(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode], flags flags[faccessat_flags])
utimes(filename ptr[in, filename], times ptr[in, itimerval])
utimensat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval], flags flags[utimensat_flags])
execve(file ptr[in, filename], argv ptr[in, array[ptr[in, string]]], envp ptr[in, array[ptr[in, string]]])
getgid() gid
getegid() gid
setuid(uid uid)
setgid(gid gid)
seteuid(euid uid)
setegid(egid gid)
getuid() uid
geteuid() uid
setpgid(pid pid, pgid pid)
getpgid(pid pid) pid
getpgrp() pid
getpid() pid
getppid() pid
setreuid(ruid uid, euid uid)
setregid(rgid gid, egid gid)
getgroups(size len[list], list ptr[inout, array[gid]])
setgroups(size len[list], list ptr[in, array[gid]])
link(old ptr[in, filename], new ptr[in, filename])
linkat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[linkat_flags])
symlinkat(old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
symlink(old ptr[in, filename], new ptr[in, filename])
unlink(path ptr[in, filename])
unlinkat(fd fd_dir, path ptr[in, filename], flags flags[unlinkat_flags])
readlink(path ptr[in, filename], buf buffer[out], siz len[buf])
readlinkat(fd fd_dir, path ptr[in, filename], buf buffer[out], siz len[buf])
rename(old ptr[in, filename], new ptr[in, filename])
renameat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
mkdir(path ptr[in, filename], mode flags[open_mode])
mkdirat(fd fd_dir, path ptr[in, filename], mode flags[open_mode])
rmdir(path ptr[in, filename])
truncate(file ptr[in, filename], pad const[0], len intptr)
ftruncate(fd fd, pad const[0], len intptr)
flock(fd fd, op flags[flock_op])
fsync(fd fd)
# fdatasync(fd fd)
sync()
getdents(fd fd_dir, ent buffer[out], count len[ent])
chroot(dir ptr[in, filename])
# fchroot(fd fd)
chdir(dir ptr[in, filename])
fchdir(fd fd)
getrusage(who flags[rusage_who], usage ptr[out, rusage])
getrlimit(res flags[rlimit_type], rlim ptr[out, rlimit])
setrlimit(res flags[rlimit_type], rlim ptr[in, rlimit])
clock_gettime(id flags[clock_id], tp ptr[out, timespec])
clock_settime(id flags[clock_id], tp ptr[in, timespec])
clock_getres(id flags[clock_id], tp ptr[out, timespec])
nanosleep(req ptr[in, timespec], rem ptr[out, timespec, opt])
getitimer(which flags[getitimer_which], cur ptr[out, itimerval])
setitimer(which flags[getitimer_which], new ptr[in, itimerval], old ptr[out, itimerval, opt])
wait4(pid pid, status ptr[out, int32, opt], options flags[wait_options], ru ptr[out, rusage, opt])
pledge(promises ptr[in, string], execpromises ptr[in, string])
unveil(path ptr[in, filename], permissions ptr[in, string[unveil_permissions]])
openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
pollfd {
fd fd
events flags[pollfd_events, int16]
revents const[0, int16]
}
# prog knowns about this struct type
timespec {
sec intptr
nsec intptr
}
# prog knowns about this struct type
timeval {
sec intptr
usec intptr
}
itimerval {
interv timeval
value timeval
}
# TODO: fd_set needs to be a separate type
fd_set {
mask0 int64
mask1 int64
mask2 int64
mask3 int64
mask4 int64
mask5 int64
mask6 int64
mask7 int64
}
rusage {
utime timeval
stime timeval
maxrss intptr
ixrss intptr
idrss intptr
isrss intptr
minflt intptr
majflt intptr
nswap intptr
inblock intptr
oublock intptr
msgsnd intptr
msgrcv intptr
signals intptr
nvcsw intptr
nivcsw intptr
}
rlimit {
soft intptr
hard intptr
}
flock {
type flags[flock_type, int16]
whence flags[seek_whence, int16]
start intptr
len intptr
pid pid
}
linger {
onoff int32
linger int32
}
ucred {
pid pid
uid uid
gid gid
}
chflags_flags = UF_NODUMP, UF_IMMUTABLE, UF_APPEND, SF_ARCHIVED, SF_IMMUTABLE, SF_APPEND
chflagsat_flags = AT_SYMLINK_NOFOLLOW
pollfd_events = POLLIN, POLLPRI, POLLOUT, POLLERR, POLLHUP, POLLNVAL, POLLRDNORM, POLLRDBAND, POLLWRNORM, POLLWRBAND
mknod_mode = S_IFMT, S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IWOTH, S_IXOTH
at_flags = AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW
linkat_flags = AT_SYMLINK_FOLLOW
unlinkat_flags = 0, AT_REMOVEDIR
flock_op = LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
faccessat_flags = AT_EACCESS, AT_SYMLINK_NOFOLLOW
rusage_who = RUSAGE_SELF, RUSAGE_CHILDREN
rlimit_type = RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_STACK, RLIMIT_STACK
clock_id = CLOCK_REALTIME, CLOCK_MONOTONIC, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID
getitimer_which = ITIMER_REAL, ITIMER_VIRTUAL, ITIMER_PROF
wait_options = WCONTINUED, WNOHANG, WUNTRACED
utimensat_flags = 0, AT_SYMLINK_NOFOLLOW
fcntl_dupfd = F_DUPFD, F_DUPFD_CLOEXEC
fcntl_getflags = F_GETFD, F_GETFL
fcntl_lock = F_SETLK, F_SETLKW, F_GETLK
fcntl_flags = FD_CLOEXEC
fcntl_status = O_APPEND, O_ASYNC, O_NONBLOCK, O_DSYNC, O_RSYNC
flock_type = F_RDLCK, F_WRLCK, F_UNLCK
unveil_permissions = "r", "W", "x", "c"
|
