dbus-fuzzer / dfuzzer

D-Bus fuzzer
GNU General Public License v3.0
38 stars 10 forks source link

Allow probing destructive methods when running unprivileged #141

Open mrc0mmand opened 7 months ago

mrc0mmand commented 7 months ago

I think it would be great if it was possible to skip destructive methods when dfuzzer is privileged enough to actually call them and call them when it's unprivileged. It should make it possible to poke all those polkit/dbus rules.

Originally posted by @evverx in https://github.com/dbus-fuzzer/dfuzzer/issues/140#issuecomment-1914852689

mrc0mmand commented 7 months ago

(Just filing it as a new issue, so it won't get lost)

One potential solution could be, maybe, introducing "destruct-ability levels", that would be paired with a corresponding dfuzzer option. I.e. you would have levels 0 and 1 defined as "always destructive" and "destructive when privileged", then some kind of tag that could be used in the suppression file, and then by running dfuzzer --level=1 you'd run only "destructive when privileged" methods + any untagged methods. Similarly, --level=0 would run all methods from the previous case + "always destructive" ones. Or something like that. Just an idea I got after reading https://github.com/dbus-fuzzer/dfuzzer/pull/140#issuecomment-1914891098.

evverx commented 7 months ago

I'd go with something like

methodA destructive
methodB alwaysdestructive

and run methodA in unprivileged mode. In privileged mode they both would be skipped. The modes could be detected automatically depending on whether dfuzzer is run as root or not.

--level=0 would run all methods from the previous case + "always destructive" ones

Having thought about this I think it can't be covered because if all the methods were allowed in privileged mode dfuzzer would just reboot the machine before it could reach the other methods.