jagger11

Tho, in C++ I guess almost everybody would use a scoped variable with its desctructor using lambda.

The clang code requires -fblocks/-lBlocksRuntime too, and I was a bit quicker :)

https://github.com/google/honggfuzz/commit/a9db9ddc2e24d157a...

Given that we're talking about telescopes under construction, the largest one will be EELT, no?

You can run it as root, and specifiy users/groups to switch to before executing an app. Though, CLONE_NEWUSER was meant for exactly that - using namespaced without euid==0. Some systems like Debian have a sysctl flag:

kernel.unprivileged_userns_clone

which controls this behavior. Ultimately, it's up to you whether set it to "1", as CLONE_NEWUSER in the past opened many new attack vectors on the Linux kernel. However, I believe that currently the situation is much better, esp. after syzkaller and individual researchers reported and fixed many bugs in this area.

I haven't been looking at systemd-nspawn for some time, but judging from its man page:

- ability to use config files (in nsjail in protobuf format)

- 3 operational modes: one of them allows to listen on a TCP port and run processes on-demand (inetd-style)

- support for cgroups (pid and mem limiting), here rlimits are not enough

- more expressive seccomp-bpf rules

Re kernel versions: Depending on when CLONE_NEWUSER and seccomp-bpf were added to the kernel for different CPU architectures. For x86-64 it was probably around 3.16, for some others it might be even 4.3 (e.g. ppc64). It might even work with earlier versions if you use --disable_clone_newuser and avoid using seccomp-bpf filters.

Re 'proot'. I've never used it (it seems to be a configurator for the mount namespace), but nsjail seems much more advanced: cgroups support, seccomp-bpf via configuration language support, and a few more features (configs, net).

Yes, SECCOMP_RET_TRACE works, but nsjail doesn't have code to support that - it didn't seem that useful when mount namespaces can police access to files.

Otherwise, it's possible to make it support that. Though, a word of caution: ptrace() is complex, and sometimes buggy interface with a lot of corner-cases - iow: it's easy to make a mistake with consequences for security of the whole setup.

PS: It's possible to use SECCOMP_RET_TRAP (TRAP(number) in kafel's - nsjail seccomp-bpf cfg language - nomenclature), and rewrite syscalls in-process with help of SIGSYS signal handler.

author here:

Not exactly, you can technically overwrite a file with bind mounts, e.g. use

nsjail --chroot / -R /dev/null:/etc/passwd -- /bin/sh -i

This will make /etc/passwd empty, but nsjail doesn't rewrite syscalls. In order to do that, you'd have to use SECCOMP_RET_TRACE (TRACE(number) in kafel config lang), and then add some C code to nsjail which will use ptrace() to intercept and rewrite your syscall. It's possible, just not implemented, because it didn't seem like something that's required by users.

author here:

Yup, nsjail doesn't have X hacks (I should work on that), though it offers some profiles for Apache-like type of applications:

https://github.com/google/nsjail/tree/master/configs

I believe nsjail uses one of the most advanced (if not the most advanced) seccomp-bpf config language - kafel: https://github.com/google/kafel

> I'm trying to get them to say "czypy"

You can try to interest "Rada Języka Polskiego" (Polish Language Council) into this topic. Just because we all know, every Polish speaker will follow their advice diligently :).

In early 90's, after the COCOM embargo on import of computers into former then Eastern Block had been lifted, there were initiatives to translate English-sounding word into something more native to Polish language.

An example of a word that badly needed such translation was 'interface', for which a proposed translation was 'międzymordzie' (literally: a thing between two faces) which sounded hilariously bad in Polish. There was another proposal to name 'computer mouse' as something even better, but I've forgotten the name since.

Fortunately, nobody followed, and 'computer mouse' is simply 'mysz' (mouse). I hear, that French had longer lasting successes with their translations.

I'm not sure if it's required (to know the exit code). inputs, both valid and invalid, will activate various paths in djpeg/libjpeg, and that's the basic goal here.

In case you'd like to test persistent fuzzing (should be faster due to a few factors), you can try modifying https://github.com/google/honggfuzz/blob/master/examples/lib... - it will probably take creating main() func which will read data in the AFL_LOOP() loop and call LLVMFuzzerTestOneInput with that input.

honggfuzz (http://honggfuzz.com) will run under cygwin - it uses similar algorithms (feedback driven by code coverage metrics), and last time I checked it under CygWin it worked with clang's -fsanitize-coverage=trace-pc modes well.

Here's your cool, lightweight and easily configurable sandbox - https://github.com/google/nsjail

> All are highly secure and

Not really, those systems get much less attention from sec folk than the Linux kernel (apps aside). Finding a priv escalation in the Linux kernel takes time (most of low hanging fruits have been already found by fuzzing or by code review), while finding it in *BSD kernels requires writing a simple syscall fuzzer and running it for a couple of minutes. I've seen it done live.

Are you maybe thinking about adding more things on this one card? Ethernet, USB, memory (e.g. 1GB by default)...

Maybe even emulation of a faster CPU in FPGA (a'la the Vampire for A600).. though, it'd probably use the CPU slot instead of Z2/Z3.

Also, is it possible to hijack the function of the OCS/ECS/AGA directly via the Zorro slots (proxying the native output gfx output, e.g. with games), or maybe it'd require some kind of hardware bridge between the gfx chipset and your card?

security software doesn't mean secure software

With the use of defer http://pastebin.com/EXZuRAdT you could create it w/o the need to use array_free.

FYI - here's defer implementation for both gcc/clang - http://pastebin.com/EXZuRAdT

I wonder if this is in any way inspired by this - https://github.com/google/honggfuzz/blob/master/common.h ?

I use there defer for both gcc/clang, countof(arr) -> ARRAYSIZE(array)

In any case, yeah, going through gcc/clang internals, and through C11 standards gives people some ways to speed-up and clena-up their implementations a bit.

You can try https://github.com/google/honggfuzz - The basic idea is pretty much the same as with afl-fuzz - maximization of code coverage (more or less).

Some old write-up on the technique can be found here: https://github.com/google/honggfuzz/blob/wiki/AttachingToPid....

You can attach to a process (-p pid) and then feed it with an external, initial input (from pcap, or hand-crafted). Honggfuzz will modify it to maximize code coverage in the network server. I got pretty decent results with e.g. apache (in must be executed with -X, so it doesn't fork/daemonize).