mirror of
https://github.com/google/security-research
synced 2026-06-08 14:27:23 +00:00
artmetla
7297a9e637
1) Disabled AppArmor block for unpriviledged user namespaces. This hapend in ubuntu-latest: https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007. Added this step to "get_android_dependencies.sh". 2) Using "get_android_dependencies.sh" script to handle dependencies for all execution options: server.py, exploit build, and exploit_reproduction. 3) Optimised exploit reproduction run time, by downloading releases and installing dependencies in parallel. 4) Conducted clean up to free up a bit of extra space for Cuttlefish runs (cleaning compilation leftovers and APT caches). 5) Using "cuttlefish.sh" to run VM in all execution options: server.py and GHA reproducer. Modified "cuttlefish.sh" to add "--test-mode" which allows easy testing by setting "falg" file permissions equivalent to exploit executable. It's disabled in prod. Improved Android16 detection logic (to enable necessary execution flags for "launch_cvd"), as apparently "launch_cvd --help" could fail sometimes. Improved cleaning logic (important as launch_cvd is super nasty and lefts a lot of tmps and random leftovers which could negatively impact next run of the VM) 6) Apparently in ubuntu-latest "sg -c" requires password. So implemented this logic canonical/data-platform-workflows@349e0c8. This is important as Cuttlefish couldn't run without user being added in groups. By default they suggest reboot to apply those changes, but it's impossible in GHA. 7) "Check PR content" logic is already updated in prod 8) Ensured that in exploit build environment NDK is added to the PATH, so simple Makefiles like: ``` exploit: exploit.c clang --target=x86_64-linux-android35 -static $^ -o exploit ``` The whole thing was tested with dummy exploit in my fork. 9) Implemented proper timeout check (30 mins) in "cuttlefish.sh" 10) Introduced sparse-checkout for the GHA.