etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
init (4110B)
      1 #!/bin/sh
      2 #
      3 # /init — minimal initramfs init for the linux-usb-stack fuzzing VM.
      4 #
      5 # Goals:
      6 #   1. Mount virtual filesystems (proc, sysfs, debugfs, configfs)
      7 #   2. Configure networking for syzkaller SSH access (10.0.2.15/24)
      8 #   3. Load USB kernel modules (raw_gadget, dummy_hcd, xhci_pci, ehci_pci)
      9 #   4. Start dropbear SSH server on port 22
     10 #
     11 # syzkaller connects via SSH, uploads syz-executor, and drives the fuzzer.
     12 # The VM stays alive in a sleep loop until syzkaller kills it.
     13 
     14 set -e
     15 
     16 # ── virtual filesystems ────────────────────────────────────────────────
     17 mount -t proc     proc     /proc
     18 mount -t sysfs    sysfs    /sys
     19 mount -t devtmpfs devtmpfs /dev
     20 mkdir -p /dev/pts
     21 mount -t devpts   devpts   /dev/pts
     22 mount -t tmpfs    tmpfs    /tmp
     23 mount -t tmpfs    tmpfs    /run
     24 
     25 # debugfs: required for KCOV (/sys/kernel/debug/kcov)
     26 mount -t debugfs  debugfs  /sys/kernel/debug 2>/dev/null || true
     27 
     28 # configfs: required for USB gadget framework
     29 # syzkaller-gadget-fw profile creates gadget dirs here
     30 mount -t configfs configfs /sys/kernel/config 2>/dev/null || true
     31 
     32 # ── kernel tuning ──────────────────────────────────────────────────────
     33 echo 1 > /proc/sys/kernel/printk
     34 echo 1 > /proc/sys/kernel/panic_on_oops
     35 echo 1 > /proc/sys/kernel/panic
     36 
     37 # ── networking (QEMU user-mode: 10.0.2.15/24, gateway 10.0.2.2) ───────
     38 ip link set lo   up
     39 ip link set eth0 up
     40 ip addr add 10.0.2.15/24 dev eth0
     41 ip route add default via 10.0.2.2 dev eth0
     42 
     43 # ── USB kernel modules ─────────────────────────────────────────────────
     44 # If built as =y these are no-ops. If =m they load here.
     45 # dummy_hcd: virtual USB host+device controller pair.
     46 #   Required for raw_gadget to work — raw_gadget presents a fake USB device
     47 #   to the kernel's USB host stack via dummy_hcd's host side.
     48 modprobe dummy_hcd      2>/dev/null || true
     49 
     50 # usb_raw_gadget: exposes gadget endpoint to userspace via /dev/raw-gadget.
     51 #   syzkaller's syz_usb_connect pseudo-syscall opens this device and sends
     52 #   crafted USB descriptors to the kernel.
     53 modprobe usb_raw_gadget 2>/dev/null || true
     54 
     55 # Host controller drivers: exercised when dummy_hcd connects a fake device
     56 # and the kernel's USB core tries to enumerate it through xhci/ehci code.
     57 modprobe xhci_pci       2>/dev/null || true
     58 modprobe ehci_pci       2>/dev/null || true
     59 
     60 # USB class drivers: bind automatically when a compatible fake device enumerates.
     61 modprobe usbhid         2>/dev/null || true
     62 modprobe usb_storage    2>/dev/null || true
     63 
     64 # ── SSH setup for syzkaller ────────────────────────────────────────────
     65 # authorized_keys was baked in at initramfs build time (setup.sh injects
     66 # the public key matching qemu/id_rsa used by syz-manager).
     67 mkdir -p /root/.ssh
     68 chmod 700 /root/.ssh
     69 # authorized_keys is already present from initramfs assembly
     70 chmod 600 /root/.ssh/authorized_keys 2>/dev/null || true
     71 
     72 # Generate ephemeral dropbear host keys (new each VM boot)
     73 mkdir -p /etc/dropbear
     74 dropbearkey -t rsa   -f /etc/dropbear/dropbear_rsa_host_key  2>/dev/null
     75 dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key 2>/dev/null
     76 
     77 # Start dropbear SSH daemon
     78 # -s: no password auth  -g: no root password login  -E: log to stderr
     79 dropbear -s -g -E -p 22
     80 
     81 echo "usb-fuzz: VM ready — SSH on :22, configfs at /sys/kernel/config"
     82 
     83 # ── keep init alive ────────────────────────────────────────────────────
     84 # syzkaller SSHs in and runs syz-executor independently.
     85 # Kernel panics from KASAN/UBSAN cause an immediate reboot (panic_on_oops=1),
     86 # which syzkaller detects as a VM crash → crash is recorded → VM rebooted.
     87 while true; do
     88     sleep 60
     89 done