diff --git a/test/test-functions b/test/test-functions index 8fba54c9e0..d5462d1be8 100644 --- a/test/test-functions +++ b/test/test-functions @@ -228,6 +228,8 @@ DEBUGTOOLS=( ) is_built_with_asan() { + local _bin="${1:?}" + if ! type -P objdump >/dev/null; then ddebug "Failed to find objdump. Assuming systemd hasn't been built with ASAN." return 1 @@ -235,7 +237,7 @@ is_built_with_asan() { # Borrowed from https://github.com/google/oss-fuzz/blob/cd9acd02f9d3f6e80011cc1e9549be526ce5f270/infra/base-images/base-runner/bad_build_check#L182 local _asan_calls - _asan_calls="$(objdump -dC "$SYSTEMD_JOURNALD" | grep -E "(callq?|brasl?|bl)\s.+__asan" -c)" + _asan_calls="$(objdump -dC "$_bin" | grep -E "(callq?|brasl?|bl)\s.+__asan" -c)" if ((_asan_calls < 1000)); then return 1 else @@ -251,7 +253,7 @@ is_built_with_coverage() { meson configure "${BUILD_DIR:?}" | grep 'b_coverage' | awk '{ print $2 }' | grep -q 'true' } -IS_BUILT_WITH_ASAN=$(is_built_with_asan && echo yes || echo no) +IS_BUILT_WITH_ASAN=$(is_built_with_asan "$SYSTEMD_JOURNALD" && echo yes || echo no) IS_BUILT_WITH_COVERAGE=$(is_built_with_coverage && echo yes || echo no) if get_bool "$IS_BUILT_WITH_ASAN"; then @@ -600,10 +602,6 @@ install_verity_minimal() { # missing $LD_PRELOAD libraries. inst_libs "$ASAN_RT_PATH" inst_library "$ASAN_RT_PATH" - # Create a dummy LSan suppression file otherwise gcc's ASan - # complains as it doesn't exist in the minimal image - # (i.e. when running TEST-29 or TEST-50 under sanitizers) - touch "$initdir/systemd-lsan.supp" fi cp "$os_release" "$initdir/usr/lib/os-release" ln -s ../usr/lib/os-release "$initdir/etc/os-release" @@ -810,20 +808,6 @@ if [[ ! -e "$ASAN_RT_PATH" ]]; then exit 1 fi -# Suppress certain leaks reported by LSan (either in external tools or bogus -# ones) -# Docs: # https://github.com/google/sanitizers/wiki/AddressSanitizerLeakSanitizer#suppressions -# -# - fsck is called by systemd-homed and is reporting a leak we're not interested -# in -# - libLLVM is a "side effect" caused by the previous fsck leak -cat >/systemd-lsan.supp </etc/systemd/system/systemd-journal-flush.service.d/timeout.conf -# D-Bus has troubles during system shutdown causing it to fail. Although it's -# harmless, it causes unnecessary noise in the logs, so let's disable LSan's -# at_exit check just for the dbus.service -mkdir -p /etc/systemd/system/dbus.service.d -printf "[Service]\nEnvironment=ASAN_OPTIONS=leak_check_at_exit=false\n" >/etc/systemd/system/dbus.service.d/disable-lsan.conf - -# Some utilities run via IMPORT/RUN/PROGRAM udev directives fail because -# they're uninstrumented (like dmsetup). Let's add a simple rule which sets -# LD_PRELOAD to the ASan RT library to fix this. -mkdir -p /etc/udev/rules.d -cat >/etc/udev/rules.d/00-set-LD_PRELOAD.rules <"\$_dropin_dir/unset_ld_preload.conf" -} - -unset_ld_preload systemd-remount-fs -unset_ld_preload testsuite- - export ASAN_OPTIONS=\$DEFAULT_ASAN_OPTIONS:log_path=/systemd.asan.log UBSAN_OPTIONS=\$DEFAULT_UBSAN_OPTIONS exec "$ROOTLIBDIR/systemd" "\$@" EOF @@ -2499,6 +2449,9 @@ inst_binary() { local file line local so_regex='([^ ]*/lib[^/]*/[^ ]*\.so[^ ]*)' + # DSOs provided by systemd + local systemd_so_regex='/(libudev|libsystemd.*|.+[\-_]systemd([\-_].+)?|libnss_(mymachines|myhostname|resolve)).so' + local wrap_binary=0 # I love bash! while read -r line; do [[ "$line" = 'not a dynamic executable' ]] && break @@ -2507,6 +2460,12 @@ inst_binary() { # by ldd attempting to use the unprefixed RPATH. [[ "$line" =~ libsystemd.*\ not\ found ]] && continue + # We're built with ASan and the target binary loads one of the systemd's + # DSOs, so we need to tweak the environment before executing the binary + if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$line" =~ $systemd_so_regex ]]; then + wrap_binary=1 + fi + if [[ "$line" =~ $so_regex ]]; then file="${BASH_REMATCH[1]}" [[ -e "${initdir}/$file" ]] && continue @@ -2522,7 +2481,38 @@ inst_binary() { exit 1 fi done < <(LC_ALL=C ldd "$bin" 2>/dev/null) - inst_simple "$bin" "$target" + + # Same as above, but we need to wrap certain libraries unconditionally + # + # login - dlopen()s (not only) systemd's PAM modules + # tar - called by machinectl in TEST-25 + if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$bin" =~ /(login|tar)$ ]]; then + wrap_binary=1 + fi + + # If the target binary is built with ASan support, we don't need to wrap + # it, as it should handle everything by itself + if get_bool "$wrap_binary" && ! is_built_with_asan "$bin"; then + dinfo "Creating ASan-compatible wrapper for binary '$target'" + # Install the target binary with a ".orig" suffix + inst_simple "$bin" "${target}.orig" + # Create a simple shell wrapper in place of the target binary, which + # sets necessary ASan-related env variables and then exec()s the + # suffixed target binary + cat >"$initdir/$target" </tmp/passphrase -LD_PRELOAD="${ASAN_RT_PATH:-}" cryptsetup luksFormat -q --use-urandom $img /tmp/passphrase +cryptsetup luksFormat -q --use-urandom $img /tmp/passphrase # Enroll unlock with default PCR policy env PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto $img