fd30aa4062
Delete .github/workflows/kernel-codeql-release.yaml
2026-05-17 15:54:43 +02:00
2587e374b2
Update kernelctf-vuln-verify.yaml
2026-05-17 15:52:18 +02:00
58c1d811c4
Update kernelctf-vuln-verify.yaml
2026-05-17 15:46:11 +02:00
ac367027c6
Update kernelctf-vuln-verify.yaml
2026-05-17 15:44:14 +02:00
81b2b928a9
Update kernelctf-vuln-verify.yaml
2026-05-17 15:39:13 +02:00
d471576485
Update kernelctf-vuln-verify.yaml
2026-05-17 15:33:53 +02:00
6d5ca60169
Update kernelctf-vuln-verify.yaml
2026-05-17 15:28:30 +02:00
741a789b97
Update kernelctf-vuln-verify.yaml
2026-05-17 15:20:39 +02:00
9a02820cab
Update kernelctf-vuln-verify.yaml
2026-05-17 15:11:54 +02:00
44fc55ad5a
Update vuln-verify to provide the same env as repro
2026-05-17 14:59:54 +02:00
6d5ac17b1f
Update vuln verify workflow to install objcopy
2026-05-17 14:04:25 +02:00
62262918b3
kernelCTF: correctly escape g++ in regex
2026-04-22 13:01:27 +00:00
4d60b55550
kernelCTF: GHA: vuln-verify does not run on labels
2026-03-17 23:53:59 +00:00
88a389a56f
kernelCTF: GHA: fix workflow_call
2026-03-17 22:14:52 +00:00
92b330fa0f
kernelCTF: GHA: run vuln-verify for kernelCTF PRs, summary fixes, add --vuln-trigger
2026-03-17 21:34:47 +00:00
df0429c403
kernelCTF: GHA: vuln-verify: remove force verify, enable KVM
2026-03-17 20:41:21 +00:00
a9bb268565
kernelCTF: GHA: vuln-verify: fix Markdown, force verify
2026-03-17 20:36:01 +00:00
dbc49115d7
kernelCTF: GHA: vuln-verify: fix
2026-03-17 20:07:35 +00:00
ea96600258
kernelCTF: GHA: vuln-verify: artifact fix
2026-03-17 19:51:06 +00:00
820ba83368
kernelCTF: GHA: vuln-verify upload logs as artifacts, write summary
2026-03-17 19:46:01 +00:00
b5ff798f4c
kernelCTF: GHA: vuln-verify fix
2026-03-17 19:13:46 +00:00
3fcf07fd75
kernelCTF: GHA: vuln-verify: faster checkout, fix gzip upload, less noisy cache logs
2026-03-17 19:09:54 +00:00
a1d2773964
kernelCTF: GHA: verbose build output for vuln-verify
2026-03-17 17:24:21 +00:00
37e1915258
kernelCTF: GHA: fix vuln-verify 6
2026-03-17 16:57:17 +00:00
6dbbfe9da1
kernelCTF: GHA: fix vuln-verify 5
2026-03-17 16:37:54 +00:00
387bf1e4b6
kernelCTF: GHA: fix vuln-verify 4
2026-03-17 16:35:09 +00:00
df26939f96
kernelCTF: GHA: fix vuln-verify 3
2026-03-17 16:22:39 +00:00
64795d4bbf
kernelCTF: GHA: fix vuln-verify 2
2026-03-17 16:22:05 +00:00
62e7342a46
kernelCTF: GHA: fix vuln-verify
2026-03-17 16:18:30 +00:00
9f3972c34d
kernelCTF: add vuln-verify workflow
2026-03-17 16:10:11 +00:00
5745a3c191
kernelCTF: add vuln-verify workflow
2026-03-17 15:56:18 +00:00
06374d5f0f
kernelctf: move Android dep install script from kernelctf-submission-verification.yaml
2026-03-03 11:14:51 +00:00
484489c406
kernelctf: remove unused .github/copilot-instructions.md
2026-03-03 11:09:12 +00:00
9c2154ae5a
Upgrade GitHub Actions for Node 24 compatibility ( #337 )
...
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com >
2026-03-02 10:25:34 +01:00
0b246115ee
Upgrade GitHub Actions to latest versions ( #338 )
...
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com >
2026-03-02 10:24:48 +01:00
d1e771d08f
Update kernelctf-submission-verification.yaml
2026-02-23 10:50:12 +01:00
818793518e
Create copilot-instructions.md for kernelctf
...
Add instructions for applying Copilot to kernelctf.
2026-01-26 13:30:04 +01:00
7297a9e637
Submission Verification logic for Android submissions ( #289 )
...
1) Disabled AppArmor block for unpriviledged user namespaces. This hapend in ubuntu-latest: https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007 . Added this step to "get_android_dependencies.sh".
2) Using "get_android_dependencies.sh" script to handle dependencies for all execution options: server.py, exploit build, and exploit_reproduction.
3) Optimised exploit reproduction run time, by downloading releases and installing dependencies in parallel.
4) Conducted clean up to free up a bit of extra space for Cuttlefish runs (cleaning compilation leftovers and APT caches).
5) Using "cuttlefish.sh" to run VM in all execution options: server.py and GHA reproducer. Modified "cuttlefish.sh" to add "--test-mode" which allows easy testing by setting "falg" file permissions equivalent to exploit executable. It's disabled in prod. Improved Android16 detection logic (to enable necessary execution flags for "launch_cvd"), as apparently "launch_cvd --help" could fail sometimes. Improved cleaning logic (important as launch_cvd is super nasty and lefts a lot of tmps and random leftovers which could negatively impact next run of the VM)
6) Apparently in ubuntu-latest "sg -c" requires password. So implemented this logic canonical/data-platform-workflows@349e0c8 . This is important as Cuttlefish couldn't run without user being added in groups. By default they suggest reboot to apply those changes, but it's impossible in GHA.
7) "Check PR content" logic is already updated in prod
8) Ensured that in exploit build environment NDK is added to the PATH, so simple Makefiles like:
```
exploit: exploit.c
clang --target=x86_64-linux-android35 -static $^ -o exploit
```
The whole thing was tested with dummy exploit in my fork.
9) Implemented proper timeout check (30 mins) in "cuttlefish.sh"
10) Introduced sparse-checkout for the GHA.
2025-12-04 15:21:19 +01:00
b706f60a9b
Improve kernelCTF auto releaser to handle Android releases ( #284 )
...
- The auto-releaser would wok in a following logic:
1. Access https://androidbuildinternal.googleapis.com/android/internal/build/v3/builds?branches=aosp-android-latest-release&buildAttemptStatus=complete&buildType=submitted&maxResults=1&successful=true&target=aosp_cf_x86_64_only_phone-userdebug to get an information about latest Android build available in JSON format.
2. We take the build number and using fetch_artifact (https://android.googlesource.com/tools/fetch_artifact/ ) attempt to download "kernel_version.txt" artefact from Android build to get all the necessary build details.
3. Using build details check if kernelCTF GCS bucket contains already the release. If not add it to releases that should be processed by kernelctf-release-build action.
- The logic of kernelctf-release-build action updated to handle new naming style of Android releases.
2025-11-27 13:31:33 +01:00
662572c16c
Build Android release and upload to Cloud Bucket ( #277 )
2025-11-18 13:05:48 +01:00
26bcc14b4d
Update kernel-codeql-release.yaml
2025-11-03 09:14:31 +01:00
9fdac8393e
Update kernel-codeql-release.yaml
2025-11-02 09:52:44 +01:00
c79816a8fd
Update kernel-codeql-release.yaml
2025-11-01 07:30:36 +01:00
170fbfd9a5
Comment out config-file in kernel-codeql-release.yaml
...
Comment out config-file line in CodeQL workflow
2025-10-31 11:00:21 +01:00
bf2aa1936b
Enable custom config file for CodeQL analysis
2025-10-29 18:10:38 +01:00
69a5dfa03b
Update kernel-codeql-release.yaml
2025-10-29 16:14:20 +01:00
76a232c60f
Update CodeQL workflow to skip queries
...
Comment out the config-file line and enable skip-queries.
2025-10-29 16:11:07 +01:00
b2ea0b7507
Update kernel-codeql-release.yaml
2025-10-29 14:26:48 +01:00
336ad09ab0
Update kernel-codeql-release.yaml
2025-10-29 14:23:59 +01:00
4267632b1e
don't upload db to avoid wasting space
2025-10-27 23:45:21 +01:00
artmetla