ea96600258
kernelCTF: GHA: vuln-verify: artifact fix
2026-03-17 19:51:06 +00:00
820ba83368
kernelCTF: GHA: vuln-verify upload logs as artifacts, write summary
2026-03-17 19:46:01 +00:00
b5ff798f4c
kernelCTF: GHA: vuln-verify fix
2026-03-17 19:13:46 +00:00
3fcf07fd75
kernelCTF: GHA: vuln-verify: faster checkout, fix gzip upload, less noisy cache logs
2026-03-17 19:09:54 +00:00
a1d2773964
kernelCTF: GHA: verbose build output for vuln-verify
2026-03-17 17:24:21 +00:00
37e1915258
kernelCTF: GHA: fix vuln-verify 6
2026-03-17 16:57:17 +00:00
6dbbfe9da1
kernelCTF: GHA: fix vuln-verify 5
2026-03-17 16:37:54 +00:00
387bf1e4b6
kernelCTF: GHA: fix vuln-verify 4
2026-03-17 16:35:09 +00:00
df26939f96
kernelCTF: GHA: fix vuln-verify 3
2026-03-17 16:22:39 +00:00
64795d4bbf
kernelCTF: GHA: fix vuln-verify 2
2026-03-17 16:22:05 +00:00
62e7342a46
kernelCTF: GHA: fix vuln-verify
2026-03-17 16:18:30 +00:00
9f3972c34d
kernelCTF: add vuln-verify workflow
2026-03-17 16:10:11 +00:00
5745a3c191
kernelCTF: add vuln-verify workflow
2026-03-17 15:56:18 +00:00
06374d5f0f
kernelctf: move Android dep install script from kernelctf-submission-verification.yaml
2026-03-03 11:14:51 +00:00
484489c406
kernelctf: remove unused .github/copilot-instructions.md
2026-03-03 11:09:12 +00:00
9c2154ae5a
Upgrade GitHub Actions for Node 24 compatibility ( #337 )
...
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com >
2026-03-02 10:25:34 +01:00
0b246115ee
Upgrade GitHub Actions to latest versions ( #338 )
...
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com >
2026-03-02 10:24:48 +01:00
d1e771d08f
Update kernelctf-submission-verification.yaml
2026-02-23 10:50:12 +01:00
818793518e
Create copilot-instructions.md for kernelctf
...
Add instructions for applying Copilot to kernelctf.
2026-01-26 13:30:04 +01:00
7297a9e637
Submission Verification logic for Android submissions ( #289 )
...
1) Disabled AppArmor block for unpriviledged user namespaces. This hapend in ubuntu-latest: https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007 . Added this step to "get_android_dependencies.sh".
2) Using "get_android_dependencies.sh" script to handle dependencies for all execution options: server.py, exploit build, and exploit_reproduction.
3) Optimised exploit reproduction run time, by downloading releases and installing dependencies in parallel.
4) Conducted clean up to free up a bit of extra space for Cuttlefish runs (cleaning compilation leftovers and APT caches).
5) Using "cuttlefish.sh" to run VM in all execution options: server.py and GHA reproducer. Modified "cuttlefish.sh" to add "--test-mode" which allows easy testing by setting "falg" file permissions equivalent to exploit executable. It's disabled in prod. Improved Android16 detection logic (to enable necessary execution flags for "launch_cvd"), as apparently "launch_cvd --help" could fail sometimes. Improved cleaning logic (important as launch_cvd is super nasty and lefts a lot of tmps and random leftovers which could negatively impact next run of the VM)
6) Apparently in ubuntu-latest "sg -c" requires password. So implemented this logic canonical/data-platform-workflows@349e0c8 . This is important as Cuttlefish couldn't run without user being added in groups. By default they suggest reboot to apply those changes, but it's impossible in GHA.
7) "Check PR content" logic is already updated in prod
8) Ensured that in exploit build environment NDK is added to the PATH, so simple Makefiles like:
```
exploit: exploit.c
clang --target=x86_64-linux-android35 -static $^ -o exploit
```
The whole thing was tested with dummy exploit in my fork.
9) Implemented proper timeout check (30 mins) in "cuttlefish.sh"
10) Introduced sparse-checkout for the GHA.
2025-12-04 15:21:19 +01:00
b706f60a9b
Improve kernelCTF auto releaser to handle Android releases ( #284 )
...
- The auto-releaser would wok in a following logic:
1. Access https://androidbuildinternal.googleapis.com/android/internal/build/v3/builds?branches=aosp-android-latest-release&buildAttemptStatus=complete&buildType=submitted&maxResults=1&successful=true&target=aosp_cf_x86_64_only_phone-userdebug to get an information about latest Android build available in JSON format.
2. We take the build number and using fetch_artifact (https://android.googlesource.com/tools/fetch_artifact/ ) attempt to download "kernel_version.txt" artefact from Android build to get all the necessary build details.
3. Using build details check if kernelCTF GCS bucket contains already the release. If not add it to releases that should be processed by kernelctf-release-build action.
- The logic of kernelctf-release-build action updated to handle new naming style of Android releases.
2025-11-27 13:31:33 +01:00
662572c16c
Build Android release and upload to Cloud Bucket ( #277 )
2025-11-18 13:05:48 +01:00
26bcc14b4d
Update kernel-codeql-release.yaml
2025-11-03 09:14:31 +01:00
9fdac8393e
Update kernel-codeql-release.yaml
2025-11-02 09:52:44 +01:00
c79816a8fd
Update kernel-codeql-release.yaml
2025-11-01 07:30:36 +01:00
170fbfd9a5
Comment out config-file in kernel-codeql-release.yaml
...
Comment out config-file line in CodeQL workflow
2025-10-31 11:00:21 +01:00
bf2aa1936b
Enable custom config file for CodeQL analysis
2025-10-29 18:10:38 +01:00
69a5dfa03b
Update kernel-codeql-release.yaml
2025-10-29 16:14:20 +01:00
76a232c60f
Update CodeQL workflow to skip queries
...
Comment out the config-file line and enable skip-queries.
2025-10-29 16:11:07 +01:00
b2ea0b7507
Update kernel-codeql-release.yaml
2025-10-29 14:26:48 +01:00
336ad09ab0
Update kernel-codeql-release.yaml
2025-10-29 14:23:59 +01:00
4267632b1e
don't upload db to avoid wasting space
2025-10-27 23:45:21 +01:00
5b927de94c
Update kernel-codeql-release.yaml
2025-10-26 09:26:05 +01:00
41994a6cda
Update CodeQL release workflow to include results
2025-10-26 08:00:08 +01:00
9ef6899cbe
Update kernel-codeql-release.yaml
2025-10-25 23:59:46 +02:00
3fc2d64819
Update kernel-codeql-release.yaml
2025-10-25 23:52:48 +02:00
ff9d2545ec
Automate CodeQL DB generation
2025-10-25 19:41:01 +02:00
da26fc7ac7
Update kernel-codeql-release.yaml
2025-10-25 14:58:53 +02:00
06e93d2efd
Update kernel-codeql-release.yaml
2025-10-25 11:12:12 +02:00
032dba7a22
Update kernel-codeql-release.yaml
2025-10-25 10:58:00 +02:00
ce56c9c807
limit codeql db to 2GB
2025-10-25 10:42:04 +02:00
170366f143
Refactor kernel-codeql-release workflow steps
...
Updated the workflow to install base dependencies and prepare kernel source. Adjusted error handling for the TOKEN variable.
2025-10-24 16:52:32 +02:00
ead56c4d30
Refactor kernel CodeQL release workflow
...
Updated the CodeQL release workflow to reflect changes in repository names and improve tag processing logic.
2025-10-24 16:48:55 +02:00
dca13e4891
kernelCTF: repro: install libkeyutils for kernelXDK
2025-10-22 18:52:36 +00:00
68ac012885
kernelXDK: repro: install kernelXDK
2025-10-22 18:31:14 +00:00
8ab623118e
[v8ctf] Automation: grant write permissions
2025-06-25 10:16:39 +02:00
2bebc3a92a
[v8ctf] Automation: add temporary workflow_dispatch trigger
2025-06-25 10:08:50 +02:00
95a4dffedd
[v8ctf] Automation: git add untracked files
2025-06-25 10:03:51 +02:00
34094449af
[v8ctf] Create a github workflow that automatically updates challenges ( #211 )
2025-06-12 06:04:42 +02:00
87cb1fff28
kernelCTF: GHA: run apt-get update too
2025-03-28 13:31:25 +01:00
Tamas Koczka