diff --git a/GNUmakefile b/GNUmakefile index e4f486fe..bf642b9a 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -32,7 +32,7 @@ VERSION = $(shell grep '^$(HASH)define VERSION ' ../config.h | cut -d '"' -f # PROGS intentionally omit afl-as, which gets installed elsewhere. PROGS = afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze -SH_PROGS = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config +SH_PROGS = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config afl-persistent-config MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8 ASAN_OPTIONS=detect_leaks=0 diff --git a/README.md b/README.md index 8fcc31ff..35f6c278 100644 --- a/README.md +++ b/README.md @@ -623,6 +623,13 @@ system for optimal speed - which afl-fuzz checks and bails otherwise. Set `export AFL_SKIP_CPUFREQ=1` for afl-fuzz to skip this check if you cannot run afl-system-config with root privileges on the host for whatever reason. +Note there is also `sudo afl-persistent-config` which sets additional permanent +boot options for a much better fuzzing performance. + +Note that both scripts improve your fuzzing performance but also decrease your +system protection against attacks! So set strong firewall rules and only +expose SSH as a network service if you use these (which is highly recommended). + If you have an input corpus from step 2 then specify this directory with the `-i` option. Otherwise create a new directory and create a file with any content as test data in there. diff --git a/afl-persistent-config b/afl-persistent-config index 3c280e55..a6b05e07 100755 --- a/afl-persistent-config +++ b/afl-persistent-config @@ -2,58 +2,131 @@ # written by jhertz # +test "$1" = "-h" -o "$1" = "-hh" && { + echo 'afl-persistent-config' + echo + echo $0 + echo + echo afl-persistent-config has no command line options + echo + echo afl-persistent-config permanently reconfigures the system to a high performance fuzzing state. + echo "WARNING: this reduces the security of the system!" + echo + echo Note that there is also afl-system-config which sets additional runtime + echo configuration options. + exit 0 +} + +echo +echo "WARNING: This scripts makes permanent configuration changes to the system to" +echo " increase the performance for fuzzing. As a result, the system also" +echo " becomes less secure against attacks! If you use this script, setup" +echo " strong firewall rules and only make SSH available as a network" +echo " service!" +echo +echo -n "Type \"YES\" to continue: " +read ANSWER +if [[ "$ANSWER" != "YES" ]]; then + echo Input was not YES, aborting ... + exit 1 +fi + +echo PLATFORM=`uname -s` - # check that we're on Mac -if [[ ! "$PLATFORM" = "Darwin" ]] ; then - echo "This script is for Mac OS" - exit 1 -fi +if [[ "$PLATFORM" = "Darwin" ]] ; then -# check if UID == 0 -if [[ $EUID -ne 0 ]]; then - echo "You really should be root to do this" - exit 1 -fi + # check if UID == 0 + if [[ "$EUID" -ne 0 ]]; then + echo "You need to be root to do this. E.g. use \"sudo\"" + exit 1 + fi -# check if SIP is disabled -if [[ ! $(csrutil status | grep "disabled") ]]; then - echo "SIP needs to be disabled" - exit 1 -fi + # check if SIP is disabled + if [[ ! $(csrutil status | grep "disabled") ]]; then + echo "SIP needs to be disabled. Restart and press Command-R at reboot, Utilities => Terminal => enter \"csrutil disable\"" + exit 1 + fi -echo "Okay cool, checks passed" + echo "Checks passed." -echo "Installing plist" + echo "Installing /Library/LaunchDaemons/shm_setup.plist" -cat << EOF > /Library/LaunchDaemons/shm_setup.plist + cat << EOF > /Library/LaunchDaemons/shm_setup.plist - - Label - shmemsetup - UserName - root - GroupName - wheel - ProgramArguments - - /usr/sbin/sysctl - -w - kern.sysv.shmmax=268435456 - kern.sysv.shmmni=128 - kern.sysv.shmseg=32 - kern.sysv.shmall=65536 - - KeepAlive - - RunAtLoad - - + + Label + shmemsetup + UserName + root + GroupName + wheel + ProgramArguments + + /usr/sbin/sysctl + -w + kern.sysv.shmmax=268435456 + kern.sysv.shmmni=128 + kern.sysv.shmseg=32 + kern.sysv.shmall=65536 + + KeepAlive + + RunAtLoad + + EOF -echo "Reboot and enjoy your fuzzing" + echo + echo "Reboot and enjoy your fuzzing" + exit 0 +fi +if [[ "$PLATFORM" = "Linux" ]] ; then + + # check if UID == 0 + if [[ "$EUID" -ne 0 ]]; then + echo "You need to be root to do this. E.g. use \"sudo\"" + exit 1 + fi + + echo "Checks passed." + + test -d /etc/sysctl.d || echo Error: /etc/sysctl.d directory not found, cannot install shmem config + test -d /etc/sysctl.d -a '!' -e /etc/sysctl.d/99-fuzzing && { + echo "Installing /etc/sysctl.d/99-fuzzing" + cat << EOF > /etc/sysctl.d/99-fuzzing +kernel.core_uses_pid=0 +kernel.core_pattern=core +kernel.randomize_va_space=0 +kernel.sched_child_runs_first=1 +kernel.sched_autogroup_enabled=1 +kernel.sched_migration_cost_ns=50000000 +kernel.sched_latency_ns=250000000 +EOF + } + + egrep -q '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub 2>/dev/null || echo Error: /etc/default/grub with GRUB_CMDLINE_LINUX_DEFAULT is not present, cannot set boot options + egrep -q '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub 2>/dev/null && { + egrep '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub | egrep -q hardened_usercopy=off || { + echo "Configuring performance boot options" + LINE=`egrep '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub | sed 's/^GRUB_CMDLINE_LINUX_DEFAULT=//' | tr -d '"'` + OPTIONS="$LINE ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off" + echo Setting boot options in /etc/default/grub to GRUB_CMDLINE_LINUX_DEFAULT=\"$OPTIONS\" + sed -i "s|^GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT=\"$OPTIONS\"|" /etc/default/grub + } + } + + echo + echo "Reboot and enjoy your fuzzing" + exit 0 +fi + + + +echo "Error: Unknown platform \"$PLATFORM\", currently supported are Linux and MacOS." +exit 1 diff --git a/afl-system-config b/afl-system-config index e149e4cd..a2ffa490 100755 --- a/afl-system-config +++ b/afl-system-config @@ -6,10 +6,12 @@ test "$1" = "-h" -o "$1" = "-hh" && { echo echo afl-system-config has no command line options echo - echo afl-system reconfigures the system to a high performance fuzzing state + echo afl-system-config reconfigures the system to a high performance fuzzing state. echo "WARNING: this reduces the security of the system!" echo - exit 1 + echo Note that there is also afl-persistent-config which sets additional permanent + echo configuration options. + exit 0 } DONE= diff --git a/docs/Changelog.md b/docs/Changelog.md index d81fdf49..74bdc4b1 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -13,6 +13,9 @@ sending a mail to . custom_mutators - added optimin, a faster and better corpus minimizer by Adrian Herrera. Thank you! + - added afl-persistent-config script to set perform permanent system + configuration setting for fuzzing, for Linux and Macos. + thanks to jhertz! ### Version ++3.14c (release) diff --git a/docs/perf_tips.md b/docs/perf_tips.md index 9c31e56b..1e8fd4d0 100644 --- a/docs/perf_tips.md +++ b/docs/perf_tips.md @@ -170,6 +170,7 @@ spectre_v2=off stf_barrier=off ``` In most Linux distributions you can put this into a `/etc/default/grub` variable. + You can use `sudo afl-persistent-config` to set these options for you. The following list of changes are made when executing `afl-system-config`: