[PATCH v2 4/7] fuzz: Bypass sandboxing for fuzzing builds

[Anshu Kumari <anskuma@redhat.com>]

Skip isolation steps that prevent AFL++ from operating:

- close_range(): AFL++ needs its shared memory fds open
- User namespace and setuid/setgid: the fuzzer runs in a
  separate rootless namespace, not passt's own
- Capability dropping: not needed without real isolation
- Seccomp BPF filters: the fuzz loop uses syscalls
  (epoll_create1, fork, execl).

Signed-off-by: Anshu Kumari <anskuma@redhat.com>
---
 isolation.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/isolation.c b/isolation.c
index a30b329f..0d1e6423 100644
--- a/isolation.c
+++ b/isolation.c
@@ -275,6 +275,7 @@ int isolate_fds(int argc, char **argv)
 		fd = close_from++;
 	}
 
+#ifndef FUZZING
 	if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) {
 		if (errno == ENOSYS || errno == EINVAL) {
 			/* This probably means close_range() or the
@@ -288,6 +289,9 @@ int isolate_fds(int argc, char **argv)
 			die_perror("Failed to close files leaked by parent");
 		}
 	}
+#else
+	(void)close_from;
+#endif /* !FUZZING */
 
 	return fd;
 }
@@ -311,6 +315,7 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
 {
 	uint64_t ns_caps = 0;
 
+#ifndef FUZZING
 	/* First set our UID & GID in the original namespace */
 	if (setgroups(0, NULL)) {
 		/* If we don't have CAP_SETGID, this will EPERM */
@@ -340,6 +345,10 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
 		if (unshare(CLONE_NEWUSER) != 0)
 			die_perror("Couldn't create user namespace");
 	}
+#else
+	(void)uid;
+	(void)gid;
+#endif /* !FUZZING */
 
 	/* Joining a new userns gives us full capabilities; drop the
 	 * ones we don't need.  With --netns-only we haven't changed
@@ -371,7 +380,11 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
 			ns_caps |= BIT(CAP_SYS_PTRACE);
 	}
 
+#ifndef FUZZING
 	drop_caps_ep_except(ns_caps);
+#else
+	(void)ns_caps;
+#endif /* !FUZZING */
 }
 
 /**
@@ -389,6 +402,7 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns,
  */
 int isolate_prefork(const struct ctx *c)
 {
+#ifndef FUZZING
 	int flags = CLONE_NEWIPC | CLONE_NEWNS | CLONE_NEWUTS;
 	uint64_t ns_caps = 0;
 
@@ -452,6 +466,9 @@ int isolate_prefork(const struct ctx *c)
 
 	clamp_caps();
 	drop_caps_ep_except(ns_caps);
+#else
+	(void)c;
+#endif /* !FUZZING */
 
 	return 0;
 }
@@ -466,10 +483,13 @@ int isolate_prefork(const struct ctx *c)
  */
 void isolate_postfork(const struct ctx *c)
 {
+#ifndef FUZZING
 	struct sock_fprog prog;
+#endif /* !FUZZING */
 
 	prctl(PR_SET_DUMPABLE, 0);
 
+#ifndef FUZZING
 	switch (c->mode) {
 	case MODE_PASST:
 		prog.len = (unsigned short)ARRAY_SIZE(filter_passt);
@@ -490,4 +510,7 @@ void isolate_postfork(const struct ctx *c)
 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
 	    prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
 		die_perror("Failed to apply seccomp filter");
+#else
+	(void)c;
+#endif /* !FUZZING */
 }
-- 
2.55.0