7297a9e637
Submission Verification logic for Android submissions ( #289 )
...
1) Disabled AppArmor block for unpriviledged user namespaces. This hapend in ubuntu-latest: https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007 . Added this step to "get_android_dependencies.sh".
2) Using "get_android_dependencies.sh" script to handle dependencies for all execution options: server.py, exploit build, and exploit_reproduction.
3) Optimised exploit reproduction run time, by downloading releases and installing dependencies in parallel.
4) Conducted clean up to free up a bit of extra space for Cuttlefish runs (cleaning compilation leftovers and APT caches).
5) Using "cuttlefish.sh" to run VM in all execution options: server.py and GHA reproducer. Modified "cuttlefish.sh" to add "--test-mode" which allows easy testing by setting "falg" file permissions equivalent to exploit executable. It's disabled in prod. Improved Android16 detection logic (to enable necessary execution flags for "launch_cvd"), as apparently "launch_cvd --help" could fail sometimes. Improved cleaning logic (important as launch_cvd is super nasty and lefts a lot of tmps and random leftovers which could negatively impact next run of the VM)
6) Apparently in ubuntu-latest "sg -c" requires password. So implemented this logic canonical/data-platform-workflows@349e0c8 . This is important as Cuttlefish couldn't run without user being added in groups. By default they suggest reboot to apply those changes, but it's impossible in GHA.
7) "Check PR content" logic is already updated in prod
8) Ensured that in exploit build environment NDK is added to the PATH, so simple Makefiles like:
```
exploit: exploit.c
clang --target=x86_64-linux-android35 -static $^ -o exploit
```
The whole thing was tested with dummy exploit in my fork.
9) Implemented proper timeout check (30 mins) in "cuttlefish.sh"
10) Introduced sparse-checkout for the GHA.
2025-12-04 15:21:19 +01:00
b706f60a9b
Improve kernelCTF auto releaser to handle Android releases ( #284 )
...
- The auto-releaser would wok in a following logic:
1. Access https://androidbuildinternal.googleapis.com/android/internal/build/v3/builds?branches=aosp-android-latest-release&buildAttemptStatus=complete&buildType=submitted&maxResults=1&successful=true&target=aosp_cf_x86_64_only_phone-userdebug to get an information about latest Android build available in JSON format.
2. We take the build number and using fetch_artifact (https://android.googlesource.com/tools/fetch_artifact/ ) attempt to download "kernel_version.txt" artefact from Android build to get all the necessary build details.
3. Using build details check if kernelCTF GCS bucket contains already the release. If not add it to releases that should be processed by kernelctf-release-build action.
- The logic of kernelctf-release-build action updated to handle new naming style of Android releases.
2025-11-27 13:31:33 +01:00
662572c16c
Build Android release and upload to Cloud Bucket ( #277 )
2025-11-18 13:05:48 +01:00
26bcc14b4d
Update kernel-codeql-release.yaml
2025-11-03 09:14:31 +01:00
9fdac8393e
Update kernel-codeql-release.yaml
2025-11-02 09:52:44 +01:00
c79816a8fd
Update kernel-codeql-release.yaml
2025-11-01 07:30:36 +01:00
170fbfd9a5
Comment out config-file in kernel-codeql-release.yaml
...
Comment out config-file line in CodeQL workflow
2025-10-31 11:00:21 +01:00
bf2aa1936b
Enable custom config file for CodeQL analysis
2025-10-29 18:10:38 +01:00
69a5dfa03b
Update kernel-codeql-release.yaml
2025-10-29 16:14:20 +01:00
76a232c60f
Update CodeQL workflow to skip queries
...
Comment out the config-file line and enable skip-queries.
2025-10-29 16:11:07 +01:00
b2ea0b7507
Update kernel-codeql-release.yaml
2025-10-29 14:26:48 +01:00
336ad09ab0
Update kernel-codeql-release.yaml
2025-10-29 14:23:59 +01:00
4267632b1e
don't upload db to avoid wasting space
2025-10-27 23:45:21 +01:00
5b927de94c
Update kernel-codeql-release.yaml
2025-10-26 09:26:05 +01:00
41994a6cda
Update CodeQL release workflow to include results
2025-10-26 08:00:08 +01:00
9ef6899cbe
Update kernel-codeql-release.yaml
2025-10-25 23:59:46 +02:00
3fc2d64819
Update kernel-codeql-release.yaml
2025-10-25 23:52:48 +02:00
ff9d2545ec
Automate CodeQL DB generation
2025-10-25 19:41:01 +02:00
da26fc7ac7
Update kernel-codeql-release.yaml
2025-10-25 14:58:53 +02:00
06e93d2efd
Update kernel-codeql-release.yaml
2025-10-25 11:12:12 +02:00
032dba7a22
Update kernel-codeql-release.yaml
2025-10-25 10:58:00 +02:00
ce56c9c807
limit codeql db to 2GB
2025-10-25 10:42:04 +02:00
170366f143
Refactor kernel-codeql-release workflow steps
...
Updated the workflow to install base dependencies and prepare kernel source. Adjusted error handling for the TOKEN variable.
2025-10-24 16:52:32 +02:00
ead56c4d30
Refactor kernel CodeQL release workflow
...
Updated the CodeQL release workflow to reflect changes in repository names and improve tag processing logic.
2025-10-24 16:48:55 +02:00
dca13e4891
kernelCTF: repro: install libkeyutils for kernelXDK
2025-10-22 18:52:36 +00:00
68ac012885
kernelXDK: repro: install kernelXDK
2025-10-22 18:31:14 +00:00
8ab623118e
[v8ctf] Automation: grant write permissions
2025-06-25 10:16:39 +02:00
2bebc3a92a
[v8ctf] Automation: add temporary workflow_dispatch trigger
2025-06-25 10:08:50 +02:00
95a4dffedd
[v8ctf] Automation: git add untracked files
2025-06-25 10:03:51 +02:00
34094449af
[v8ctf] Create a github workflow that automatically updates challenges ( #211 )
2025-06-12 06:04:42 +02:00
87cb1fff28
kernelCTF: GHA: run apt-get update too
2025-03-28 13:31:25 +01:00
2b1a1adbca
GHA: remove jekyll-gh-pages.yml workflow as GHA has a built-in one
2025-03-13 15:25:53 +00:00
c60a0c6027
kernelCTF: add draft style guide
2025-03-13 15:24:20 +00:00
6faab0ec61
kernelCTF: GHA: fix repro artifact filename
2025-03-12 12:44:41 +00:00
d8412c58fa
kernelCTF: GHA: fix workflow syntax error
2025-03-03 15:24:16 +00:00
f56b903d0e
kernelCTF: GHA: fail if the generated binary does not have debug_info
2025-03-03 15:23:08 +00:00
96873cbc5d
kernelCTF: GHA: separate artifact names
2025-03-03 15:19:42 +00:00
c111d81ec5
kernelCTF: GHA: fix verify all workflow
2025-03-03 14:31:43 +00:00
71cdaa2466
Feature/debug build ( #169 )
...
* kernelCTF: GHA: add debug build for exploits
* kernelCTF: GHA: add workflow to trigger PR verification on all PRs
2025-03-03 15:18:41 +01:00
af4dba5827
GHA: run repro on ubuntu-latest since it also supports nested virtualization
2025-02-27 19:23:13 +01:00
ac459baf86
GHA: more fixes in jekyll-gh-pages.yml
2025-02-12 18:19:24 +01:00
642db688d2
GHA: update upload-artifact version in jekyll-gh-pages.yml
...
Old version became deprecated and could not be used anymore: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
2025-02-12 18:08:36 +01:00
817de537c7
Update upload-artifact in kernelctf-submission-verification.yaml
2024-10-25 14:21:27 +02:00
5ba813ff20
Switch version for download-artifact from precise to general
2024-10-21 11:43:45 +02:00
4cfc925540
Bump auth version in auto-releaser
2024-10-21 11:42:00 +02:00
490d264024
Bump versions of auth and upload-cloud-storage in subm verification.
2024-10-21 11:40:57 +02:00
38ca27a57e
Bump versions of auth and upload-cloud-storage
2024-10-21 11:39:49 +02:00
43a5a816c3
kernelCTF: GHA: add mitigation-v3b release without nftables
2024-09-27 21:30:52 +00:00
ebe282ba7b
Update upload / download artifact to v4 in kernelctf-submission-verification.yaml
2024-09-25 17:42:19 +02:00
54fe51676f
Update upload / download artifact to v4 in kernelctf-release-build.yaml
2024-09-25 17:41:17 +02:00
artmetla