Skip to content

Commit 1f5c8e5

Browse files
bcolesbcoles
committed
fixtures: capture Android at both vantages
Two captures from a booted Android 13 device (GKI 5.15.119-android13-8): one as uid 2000 in u:r:shell:s0 under an enforcing policy, one as root with kptr_restrict cleared. The unprivileged one is the shape nothing in the corpus had -- a zero-byte /etc/group, the kptr_restrict and dmesg_restrict sysctls hidden outright rather than merely unreadable, and perf_event_paranoid at -1 -- so replaying it exercises the group gate table's fallback and the MAC-gated vantage. The root one carries ground truth and validates: the guaranteed window contains _text, and 0xffffffffa4200000 is a randomized base rather than the default. collect captured no vantage: it read the kernel facts and none of the paths the analysis uses to establish where it stands, so any capture replayed as an unconfined root shell on a host with no mandatory access control. It now takes the identity, the active LSM and the container markers too. /etc/group's member list names the system's users and inference reads only name and gid, so --anonymize drops it. Android has no /etc/os-release and a root-only build.prop, so the distro is read from the property service, which answers regardless of who asks.
1 parent 49e3566 commit 1f5c8e5

67 files changed

Lines changed: 2370 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎extra/collect‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,13 @@ if [ -r /etc/os-release ]; then
120120
_id=$(sed -n 's/^ID=//p' /etc/os-release 2>/dev/null | tr -d '"' | head -1)
121121
_ver=$(sed -n 's/^VERSION_ID=//p' /etc/os-release 2>/dev/null | tr -d '"' | head -1)
122122
DISTRO="${_id:-unknown}-${_ver:-}"
123+
elif command -v getprop >/dev/null 2>&1; then
124+
# Android ships no /etc/os-release, and /system/build.prop is root-only, so
125+
# an unprivileged capture would otherwise be filed as "unknown". The property
126+
# service answers regardless of who asks.
127+
_rel=$(getprop ro.build.version.release 2>/dev/null)
128+
_sdk=$(getprop ro.build.version.sdk 2>/dev/null)
129+
[ -n "${_rel:-}${_sdk:-}" ] && DISTRO="android-${_rel:-$_sdk}"
123130
fi
124131

125132
# Sanitize a token for use in a filename.
@@ -271,6 +278,22 @@ done
271278

272279
grab_tree /sys/firmware/memmap
273280

281+
# ---------------------------------------------------------------------------
282+
# Vantage: what the analysis reads to establish where it stands rather than
283+
# what the kernel looks like. A capture without these replays as an unconfined
284+
# root shell on a host with no mandatory access control, which is the one
285+
# vantage most systems do not have -- and on a system whose sources are gated
286+
# by policy rather than by their absence, the vantage IS the finding.
287+
# ---------------------------------------------------------------------------
288+
for f in \
289+
/proc/self/status /proc/self/attr/current /etc/group \
290+
/sys/kernel/security/lsm /sys/module/apparmor/parameters/enabled \
291+
/sys/fs/selinux/enforce /sys/fs/selinux/policyvers /sys/fs/selinux/mls \
292+
/proc/self/cgroup /proc/1/cgroup /.dockerenv /run/.containerenv
293+
do
294+
grab "$f"
295+
done
296+
274297
# iSCSI transports: `handle` is the address of the registering driver's static
275298
# struct iscsi_transport (CVE-2021-27363), one per transport the host has
276299
# loaded. Read by sysfs_iscsi_transport_handle, which enumerates the class.
@@ -370,6 +393,21 @@ if [ "$ANON" -eq 1 ]; then
370393
grep -v -e '^model name' -e '^Model' -e '^Hardware' -e '^Serial' "$ci" \
371394
> "$ci.tmp" 2>/dev/null && mv "$ci.tmp" "$ci"
372395
fi
396+
# /etc/group's fourth field lists the account names in each group, which
397+
# names the system's users. Inference reads only the name and the gid, so the
398+
# member list is dropped rather than scrubbed. A trailing colon is kept: the
399+
# field is empty, not missing.
400+
gf="$OUT/sysroot/etc/group"
401+
if [ -f "$gf" ]; then
402+
sed -E 's/^([^:]*:[^:]*:[^:]*:).*$/\1/' "$gf" > "$gf.tmp" 2>/dev/null \
403+
&& mv "$gf.tmp" "$gf"
404+
fi
405+
# Identity, not secrets: the collecting process's own uid/gid/groups are the
406+
# vantage being recorded. Only the name it ran under is scrubbed.
407+
scrub_secrets "$OUT/sysroot/proc/self/status"
408+
# Container ids embed the runtime's own UUIDs, which scrub_secrets rewrites.
409+
scrub_secrets "$OUT/sysroot/proc/self/cgroup"
410+
scrub_secrets "$OUT/sysroot/proc/1/cgroup"
373411
scrub_secrets "$OUT/sysroot/proc/cmdline"
374412
scrub_secrets "$OUT/sysroot/proc/version"
375413
scrub_secrets "$OUT/verbose.txt"
@@ -412,6 +450,11 @@ fi
412450
echo " sysroot/ raw /proc, /sys, /boot facts the analysis reads."
413451
echo " Includes proc/cmdline (may carry boot secrets),"
414452
echo " proc/cpuinfo, proc/iomem, proc/modules."
453+
echo " Also the vantage: the collecting process's identity"
454+
echo " (proc/self/status, proc/self/attr/current), the"
455+
echo " active LSM, and etc/group. With --anonymize the"
456+
echo " group member lists are dropped, since they name the"
457+
echo " system's users and inference reads only name + gid."
415458
echo " dmesg.txt kernel log, if permitted (hostnames, MACs, serials)."
416459
echo " verbose.txt kasld output, including leaked kernel addresses."
417460
if [ "$WANT_KALLSYMS" -eq 1 ]; then

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/meta.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
collect_version: 2
2+
collected_utc: Sat Aug 15 07:46:34 UTC 2026
3+
uname_m_raw: x86_64
4+
arch_canonical: x86_64
5+
kernel_release: 5.15.119-android13-8-00034-gd34029c8258b-ab10871489
6+
distro: android-13
7+
kasld: kasld 0.3.1-dev
8+
suggested_fixture: tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/
9+
anonymized: 1
10+
kallsyms: 1

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sizes.txt‎

Whitespace-only changes.

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/.collect-notes‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
absent: /sys/kernel/security/lockdown
2+
absent: /sys/kernel/boot_params/setup_data
3+
absent: /sys/kernel/security/lsm
4+
absent: /sys/module/apparmor/parameters/enabled
5+
absent: /.dockerenv
6+
absent: /run/.containerenv
7+
absent: /sys/class/iscsi_transport
8+
absent: /proc/device-tree/chosen
9+
absent: /proc/device-tree/rtas
10+
absent: /sys/firmware/devicetree/base/chosen
11+
absent: /sys/firmware/devicetree/base/rtas
12+
absent: /sys/firmware/fdt
13+
absent: /boot/config-5.15.119-android13-8-00034-gd34029c8258b-ab10871489
14+
absent: /boot/vmlinuz-5.15.119-android13-8-00034-gd34029c8258b-ab10871489
15+
absent: /boot/Image-5.15.119-android13-8-00034-gd34029c8258b-ab10871489
16+
absent: /boot/vmlinux-5.15.119-android13-8-00034-gd34029c8258b-ab10871489
17+
absent: /boot/System.map-5.15.119-android13-8-00034-gd34029c8258b-ab10871489
18+
anonymized: host identity, CPU brand, UUIDs/MACs, sensitive cmdline values redacted

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/etc/group‎

Whitespace-only changes.

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/proc/1/cgroup‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
4:memory:/
2+
3:cpuset:/
3+
2:cpu:/
4+
1:blkio:/
5+
0::/

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/proc/cmdline‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
stack_depot_disable=on cgroup_disable=pressure 8250.nr_uarts=1 clocksource=pit no_timer_check console=0 loop.max_part=7 ramoops.mem_address=0xff018000 ramoops.mem_size=0x10000 memmap=0x10000$0xff018000 printk.devkmsg=on bootconfig mac80211_hwsim.radios=0

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/proc/config.gz‎

40.1 KB
Binary file not shown.

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/proc/cpuinfo‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
processor : 0
2+
vendor_id : AuthenticAMD
3+
cpu family : 6
4+
model : 6
5+
stepping : 3
6+
microcode : 0x1000065
7+
cpu MHz : 0.001
8+
cache size : 512 KB
9+
physical id : 0
10+
siblings : 3
11+
core id : 0
12+
cpu cores : 3
13+
apicid : 0
14+
initial apicid : 0
15+
fpu : yes
16+
fpu_exception : yes
17+
cpuid level : 16
18+
wp : yes
19+
flags : fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx lm nopl cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt aes xsave avx f16c hypervisor lahf_lm cmp_legacy abm 3dnowprefetch vmmcall
20+
bugs : fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass
21+
bogomips : 7197.53
22+
TLB size : 1024 4K pages
23+
clflush size : 64
24+
cache_alignment : 64
25+
address sizes : 40 bits physical, 48 bits virtual
26+
power management:
27+
28+
processor : 1
29+
vendor_id : AuthenticAMD
30+
cpu family : 6
31+
model : 6
32+
stepping : 3
33+
microcode : 0x1000065
34+
cpu MHz : 0.001
35+
cache size : 512 KB
36+
physical id : 0
37+
siblings : 3
38+
core id : 1
39+
cpu cores : 3
40+
apicid : 1
41+
initial apicid : 1
42+
fpu : yes
43+
fpu_exception : yes
44+
cpuid level : 16
45+
wp : yes
46+
flags : fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx lm nopl cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt aes xsave avx f16c hypervisor lahf_lm cmp_legacy abm 3dnowprefetch vmmcall
47+
bugs : fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass
48+
bogomips : 7197.53
49+
TLB size : 1024 4K pages
50+
clflush size : 64
51+
cache_alignment : 64
52+
address sizes : 40 bits physical, 48 bits virtual
53+
power management:
54+
55+
processor : 2
56+
vendor_id : AuthenticAMD
57+
cpu family : 6
58+
model : 6
59+
stepping : 3
60+
microcode : 0x1000065
61+
cpu MHz : 0.001
62+
cache size : 512 KB
63+
physical id : 0
64+
siblings : 3
65+
core id : 2
66+
cpu cores : 3
67+
apicid : 2
68+
initial apicid : 2
69+
fpu : yes
70+
fpu_exception : yes
71+
cpuid level : 16
72+
wp : yes
73+
flags : fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx lm nopl cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt aes xsave avx f16c hypervisor lahf_lm cmp_legacy abm 3dnowprefetch vmmcall
74+
bugs : fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass
75+
bogomips : 7197.53
76+
TLB size : 1024 4K pages
77+
clflush size : 64
78+
cache_alignment : 64
79+
address sizes : 40 bits physical, 48 bits virtual
80+
power management:
81+

‎tests/fixtures/x86_64/android-13-5.15.119-android13-8-00034-gd34029c8258b-ab10871489-root/sysroot/proc/iomem‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
00000000-00000fff : Reserved
2+
00001000-0009fbff : System RAM
3+
0009fc00-0009ffff : Reserved
4+
000a0000-000bffff : PCI Bus 0000:00
5+
000c0000-000c0dff : Video ROM
6+
000f0000-000fffff : Reserved
7+
000f0000-000fffff : System ROM
8+
00100000-7ffd3fff : System RAM
9+
31000000-32804c4a : Kernel code
10+
32a00000-339f9fff : Kernel rodata
11+
33a00000-33bfa9ff : Kernel data
12+
33db4000-33ffffff : Kernel bss
13+
7ffd4000-7fffffff : Reserved
14+
80000000-febfffff : PCI Bus 0000:00
15+
feb80000-febbffff : 0000:00:09.0
16+
febc0000-febc0fff : 0000:00:03.0
17+
febc1000-febc1fff : 0000:00:04.0
18+
febc2000-febc2fff : 0000:00:05.0
19+
febc3000-febc3fff : 0000:00:06.0
20+
febc4000-febc4fff : 0000:00:07.0
21+
febc5000-febc5fff : 0000:00:08.0
22+
febc6000-febc6fff : 0000:00:09.0
23+
febc7000-febc7fff : 0000:00:0a.0
24+
febc8000-febc8fff : 0000:00:0b.0
25+
febc8000-febc8fff : Address space control
26+
febc9000-febc9fff : 0000:00:0c.0
27+
febca000-febcafff : 0000:00:0e.0
28+
febcb000-febcbfff : 0000:00:0f.0
29+
febcc000-febccfff : 0000:00:10.0
30+
febcd000-febcdfff : 0000:00:11.0
31+
febce000-febcefff : 0000:00:12.0
32+
febcf000-febcffff : 0000:00:13.0
33+
febd0000-febd0fff : 0000:00:14.0
34+
febd1000-febd1fff : 0000:00:15.0
35+
febd2000-febd2fff : 0000:00:16.0
36+
febd3000-febd3fff : 0000:00:17.0
37+
febd4000-febd4fff : 0000:00:18.0
38+
febd5000-febd5fff : 0000:00:19.0
39+
febd6000-febd6fff : 0000:00:1a.0
40+
febd7000-febd7fff : 0000:00:1b.0
41+
fec00000-fec003ff : IOAPIC 0
42+
fed00000-fed003ff : HPET 0
43+
fed00000-fed003ff : PNP0103:00
44+
fee00000-fee00fff : Local APIC
45+
feffc000-feffffff : Reserved
46+
ff001000-ff002fff : GFSH0003:00
47+
ff010000-ff010fff : GFSH0001:00
48+
ff011000-ff011fff : GFSH0002:00
49+
ff012000-ff0120ff : GFSH0004:00
50+
ff013000-ff0130ff : GFSH0005:00
51+
ff014000-ff015fff : GFSH0006:00
52+
ff016000-ff016fff : GFSH0007:00
53+
ff017000-ff017fff : GFSH0008:00
54+
ff018000-ff027fff : Reserved
55+
ff018000-ff018fff : ramoops:dmesg(0/12)
56+
ff019000-ff019fff : ramoops:dmesg(1/12)
57+
ff01a000-ff01afff : ramoops:dmesg(2/12)
58+
ff01b000-ff01bfff : ramoops:dmesg(3/12)
59+
ff01c000-ff01cfff : ramoops:dmesg(4/12)
60+
ff01d000-ff01dfff : ramoops:dmesg(5/12)
61+
ff01e000-ff01efff : ramoops:dmesg(6/12)
62+
ff01f000-ff01ffff : ramoops:dmesg(7/12)
63+
ff020000-ff020fff : ramoops:dmesg(8/12)
64+
ff021000-ff021fff : ramoops:dmesg(9/12)
65+
ff022000-ff022fff : ramoops:dmesg(10/12)
66+
ff023000-ff023fff : ramoops:dmesg(11/12)
67+
ff024000-ff024fff : ramoops:dmesg(12/12)
68+
ff025000-ff025fff : ramoops:console
69+
ff026000-ff026554 : ramoops:ftrace(0/2)
70+
ff026555-ff026aa9 : ramoops:ftrace(1/2)
71+
ff026aaa-ff026ffe : ramoops:ftrace(2/2)
72+
ff026fff-ff027ffe : ramoops:pmsg
73+
fffc0000-ffffffff : Reserved
74+
400000000-80005ffff : PCI Bus 0000:00
75+
400000000-7ffffffff : 0000:00:0b.0
76+
400000000-7ffffffff : Address space area
77+
800000000-800003fff : 0000:00:02.0
78+
800000000-800003fff : virtio-pci-modern
79+
800004000-800007fff : 0000:00:03.0
80+
800004000-800007fff : virtio-pci-modern
81+
800008000-80000bfff : 0000:00:04.0
82+
800008000-80000bfff : virtio-pci-modern
83+
80000c000-80000ffff : 0000:00:05.0
84+
80000c000-80000ffff : virtio-pci-modern
85+
800010000-800013fff : 0000:00:06.0
86+
800010000-800013fff : virtio-pci-modern
87+
800014000-800017fff : 0000:00:07.0
88+
800014000-800017fff : virtio-pci-modern
89+
800018000-80001bfff : 0000:00:08.0
90+
800018000-80001bfff : virtio-pci-modern
91+
80001c000-80001ffff : 0000:00:09.0
92+
80001c000-80001ffff : virtio-pci-modern
93+
800020000-800023fff : 0000:00:0a.0
94+
800020000-800023fff : virtio-pci-modern
95+
800024000-800027fff : 0000:00:0c.0
96+
800024000-800027fff : virtio-pci-modern
97+
800028000-80002bfff : 0000:00:0d.0
98+
800028000-80002bfff : virtio-pci-modern
99+
80002c000-80002ffff : 0000:00:0e.0
100+
80002c000-80002ffff : virtio-pci-modern
101+
800030000-800033fff : 0000:00:0f.0
102+
800030000-800033fff : virtio-pci-modern
103+
800034000-800037fff : 0000:00:10.0
104+
800034000-800037fff : virtio-pci-modern
105+
800038000-80003bfff : 0000:00:11.0
106+
800038000-80003bfff : virtio-pci-modern
107+
80003c000-80003ffff : 0000:00:12.0
108+
80003c000-80003ffff : virtio-pci-modern
109+
800040000-800043fff : 0000:00:13.0
110+
800040000-800043fff : virtio-pci-modern
111+
800044000-800047fff : 0000:00:14.0
112+
800044000-800047fff : virtio-pci-modern
113+
800048000-80004bfff : 0000:00:15.0
114+
800048000-80004bfff : virtio-pci-modern
115+
80004c000-80004ffff : 0000:00:16.0
116+
80004c000-80004ffff : virtio-pci-modern
117+
800050000-800053fff : 0000:00:17.0
118+
800050000-800053fff : virtio-pci-modern
119+
800054000-800057fff : 0000:00:18.0
120+
800054000-800057fff : virtio-pci-modern
121+
800058000-80005bfff : 0000:00:19.0
122+
800058000-80005bfff : virtio-pci-modern
123+
80005c000-80005ffff : 0000:00:1b.0
124+
80005c000-80005ffff : virtio-pci-modern

0 commit comments

Comments
 (0)