diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 36fe28359b4..78710f55796 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -155,6 +155,9 @@ samba-libs: samba-static: extends: .shared_template +samba-fuzz: + extends: .shared_template + ctdb: extends: .shared_template @@ -230,6 +233,7 @@ pages: - samba-ad-dc-6 - samba-libs - samba-static + - samba-fuzz # - ctdb # TODO - samba-ctdb - samba-ad-dc-ntvfs diff --git a/lib/fuzzing/oss-fuzz/build_samba.sh b/lib/fuzzing/oss-fuzz/build_samba.sh index e4783442b20..63b81af0810 100755 --- a/lib/fuzzing/oss-fuzz/build_samba.sh +++ b/lib/fuzzing/oss-fuzz/build_samba.sh @@ -11,6 +11,9 @@ # # CFLAGS are supplied by the caller, eg the oss-fuzz compile command # +# Additional arguments are passed to configure, to allow this to be +# tested in autobuild.py +# ADDITIONAL_CFLAGS="$CFLAGS" export ADDITIONAL_CFLAGS CFLAGS="" @@ -42,7 +45,9 @@ esac --disable-warnings-as-errors \ --abi-check-disable \ --fuzz-target-ldflags="$LIB_FUZZING_ENGINE" \ - --nonshared-binary=ALL LINK_CC="$CXX" + --nonshared-binary=ALL \ + "$@" \ + LINK_CC="$CXX" make -j diff --git a/lib/fuzzing/oss-fuzz/check_build.sh b/lib/fuzzing/oss-fuzz/check_build.sh new file mode 100755 index 00000000000..cc69cf26418 --- /dev/null +++ b/lib/fuzzing/oss-fuzz/check_build.sh @@ -0,0 +1,25 @@ +#!/bin/sh -eux +# +# A very simple check script to confirm we still provide binaries +# that look like the targets oss-fuzz wants. +# +# A much stronger check is availble in oss-fuzz via +# infra/helper.py check_build samba +# + +# oss-fuzz provides an OUT variable, so for clarity this script +# uses the same. See build_samba.sh +OUT=$1 + +# build_samba.sh will have put a non-zero number of fuzzers here. If +# there are none, this will fail as it becomes literally fuzz_* +for bin in $OUT/fuzz_* +do + # Confirm that the chrpath was reset to lib/ in the same directory + # as the binary + chrpath -l $bin | grep 'RUNPATH=$ORIGIN/lib' + + # Confirm that we link to at least some libraries in this + # directory (shows that the libraries were found and copied). + ldd $bin | grep "$OUT/lib" +done diff --git a/script/autobuild.py b/script/autobuild.py index 2a23c8dbb87..2a0b7da53e5 100755 --- a/script/autobuild.py +++ b/script/autobuild.py @@ -624,7 +624,14 @@ tasks = { # retry with nonshared smbd and smbtorture ("nonshared-distclean", "make distclean"), ("nonshared-configure", "./configure.developer " + samba_configure_params + " --bundled-libraries=talloc,tdb,pytdb,ldb,pyldb,tevent,pytevent --with-static-modules=ALL --nonshared-binary=smbtorture,smbd/smbd"), - ("nonshared-make", "make -j"), + ("nonshared-make", "make -j") + ], + + "samba-fuzz": [ + # build the fuzzers (static) via the oss-fuzz script + ("fuzzers-mkdir-prefix", "mkdir -p ${PREFIX_DIR}"), + ("fuzzers-build", "OUT=${PREFIX_DIR} LIB_FUZZING_ENGINE= SANITIZER=address CXX= CFLAGS= ./lib/fuzzing/oss-fuzz/build_samba.sh --enable-afl"), + ("fuzzers-check", "./lib/fuzzing/oss-fuzz/check_build.sh ${PREFIX_DIR}") ], # Test Samba without python still builds. When this test fails @@ -788,10 +795,11 @@ tasks = { } defaulttasks = list(tasks.keys()) + defaulttasks.remove("pass") defaulttasks.remove("fail") defaulttasks.remove("samba-test-only") - +defaulttasks.remove("samba-fuzz") if os.environ.get("AUTOBUILD_SKIP_SAMBA_O3", "0") == "1": defaulttasks.remove("samba-o3")