[PATCH 1/2] ci: turn on CIFuzz

[PATCH 1/2] ci: turn on CIFuzz

[Evgeny Vereshchagin]

Now that almost all the bugs reported by OSS-Fuzz have been
fixed libsepol/cil should be stable enough to get CIFuzz working
more or less reliably. It should help to catch regressions/new bugs
faster.

https://google.github.io/oss-fuzz/getting-started/continuous-integration/

The patch was tested on GitHub in https://github.com/SELinuxProject/selinux/pull/285
The CIFuzz job can be found at https://github.com/SELinuxProject/selinux/actions/runs/1017865690

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
---
 .github/workflows/cifuzz.yml | 39 ++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/cifuzz.yml

diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
new file mode 100644
index 00000000..5c2233a2
--- /dev/null
+++ b/.github/workflows/cifuzz.yml
@@ -0,0 +1,39 @@
+---
+name: CIFuzz
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    if: github.repository == 'SELinuxProject/selinux'
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined, memory]
+    steps:
+      - name: Build Fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'selinux'
+          dry-run: false
+          allowed-broken-targets-percentage: 0
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Run Fuzzers (${{ matrix.sanitizer }})
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'selinux'
+          fuzz-seconds: 180
+          dry-run: false
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Upload Crash
+        uses: actions/upload-artifact@v1
+        if: failure() && steps.build.outcome == 'success'
+        with:
+          name: ${{ matrix.sanitizer }}-artifacts
+          path: ./out/artifacts
-- 
2.31.1

[PATCH 2/2] README: add OSS-Fuzz/CIFuzz badges

[Evgeny Vereshchagin]

It should make it easier to keep track of what's going on there

Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 4d33686d..d1338e87 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,8 @@ SELinux Userspace
 
 ![SELinux logo](https://github.com/SELinuxProject.png)
 [![Build Status](https://travis-ci.org/SELinuxProject/selinux.svg?branch=master)](https://travis-ci.org/SELinuxProject/selinux)
+[![OSS-Fuzz Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/selinux.svg)](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#selinux)
+[![CIFuzz Status](https://github.com/SELinuxProject/selinux/actions/workflows/cifuzz.yml/badge.svg)](https://github.com/SELinuxProject/selinux/actions/workflows/cifuzz.yml)
 
 Please submit all bug reports and patches to <selinux@vger.kernel.org>.
 
-- 
2.31.1

Re: [PATCH 1/2] ci: turn on CIFuzz

[Nicolas Iooss]

On Sat, Jul 10, 2021 at 2:11 PM Evgeny Vereshchagin <evvers@ya.ru> wrote:
>
> Now that almost all the bugs reported by OSS-Fuzz have been
> fixed libsepol/cil should be stable enough to get CIFuzz working
> more or less reliably. It should help to catch regressions/new bugs
> faster.
>
> https://google.github.io/oss-fuzz/getting-started/continuous-integration/
>
> The patch was tested on GitHub in https://github.com/SELinuxProject/selinux/pull/285
> The CIFuzz job can be found at https://github.com/SELinuxProject/selinux/actions/runs/1017865690
>
> Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>

For both patches:

Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>

If nobody else has comments, I will apply them tomorrow.
Thanks!
Nicolas

> ---
>  .github/workflows/cifuzz.yml | 39 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 39 insertions(+)
>  create mode 100644 .github/workflows/cifuzz.yml
>
> diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
> new file mode 100644
> index 00000000..5c2233a2
> --- /dev/null
> +++ b/.github/workflows/cifuzz.yml
> @@ -0,0 +1,39 @@
> +---
> +name: CIFuzz
> +on:
> +  push:
> +    branches:
> +      - master
> +  pull_request:
> +    branches:
> +      - master
> +jobs:
> +  Fuzzing:
> +    runs-on: ubuntu-latest
> +    if: github.repository == 'SELinuxProject/selinux'
> +    strategy:
> +      fail-fast: false
> +      matrix:
> +        sanitizer: [address, undefined, memory]
> +    steps:
> +      - name: Build Fuzzers (${{ matrix.sanitizer }})
> +        id: build
> +        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
> +        with:
> +          oss-fuzz-project-name: 'selinux'
> +          dry-run: false
> +          allowed-broken-targets-percentage: 0
> +          sanitizer: ${{ matrix.sanitizer }}
> +      - name: Run Fuzzers (${{ matrix.sanitizer }})
> +        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
> +        with:
> +          oss-fuzz-project-name: 'selinux'
> +          fuzz-seconds: 180
> +          dry-run: false
> +          sanitizer: ${{ matrix.sanitizer }}
> +      - name: Upload Crash
> +        uses: actions/upload-artifact@v1
> +        if: failure() && steps.build.outcome == 'success'
> +        with:
> +          name: ${{ matrix.sanitizer }}-artifacts
> +          path: ./out/artifacts
> --
> 2.31.1
>

Re: [PATCH 1/2] ci: turn on CIFuzz

[Nicolas Iooss]

On Mon, Jul 12, 2021 at 9:31 AM Nicolas Iooss <nicolas.iooss@m4x.org> wrote:
>
> On Sat, Jul 10, 2021 at 2:11 PM Evgeny Vereshchagin <evvers@ya.ru> wrote:
> >
> > Now that almost all the bugs reported by OSS-Fuzz have been
> > fixed libsepol/cil should be stable enough to get CIFuzz working
> > more or less reliably. It should help to catch regressions/new bugs
> > faster.
> >
> > https://google.github.io/oss-fuzz/getting-started/continuous-integration/
> >
> > The patch was tested on GitHub in https://github.com/SELinuxProject/selinux/pull/285
> > The CIFuzz job can be found at https://github.com/SELinuxProject/selinux/actions/runs/1017865690
> >
> > Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
>
> For both patches:
>
> Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> If nobody else has comments, I will apply them tomorrow.
> Thanks!
> Nicolas

Merged.
Thanks!
Nicolas

> > ---
> >  .github/workflows/cifuzz.yml | 39 ++++++++++++++++++++++++++++++++++++
> >  1 file changed, 39 insertions(+)
> >  create mode 100644 .github/workflows/cifuzz.yml
> >
> > diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
> > new file mode 100644
> > index 00000000..5c2233a2
> > --- /dev/null
> > +++ b/.github/workflows/cifuzz.yml
> > @@ -0,0 +1,39 @@
> > +---
> > +name: CIFuzz
> > +on:
> > +  push:
> > +    branches:
> > +      - master
> > +  pull_request:
> > +    branches:
> > +      - master
> > +jobs:
> > +  Fuzzing:
> > +    runs-on: ubuntu-latest
> > +    if: github.repository == 'SELinuxProject/selinux'
> > +    strategy:
> > +      fail-fast: false
> > +      matrix:
> > +        sanitizer: [address, undefined, memory]
> > +    steps:
> > +      - name: Build Fuzzers (${{ matrix.sanitizer }})
> > +        id: build
> > +        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
> > +        with:
> > +          oss-fuzz-project-name: 'selinux'
> > +          dry-run: false
> > +          allowed-broken-targets-percentage: 0
> > +          sanitizer: ${{ matrix.sanitizer }}
> > +      - name: Run Fuzzers (${{ matrix.sanitizer }})
> > +        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
> > +        with:
> > +          oss-fuzz-project-name: 'selinux'
> > +          fuzz-seconds: 180
> > +          dry-run: false
> > +          sanitizer: ${{ matrix.sanitizer }}
> > +      - name: Upload Crash
> > +        uses: actions/upload-artifact@v1
> > +        if: failure() && steps.build.outcome == 'success'
> > +        with:
> > +          name: ${{ matrix.sanitizer }}-artifacts
> > +          path: ./out/artifacts
> > --
> > 2.31.1
> >