Welcome Back & Remarks & Code Aware Services in the Service of Vulnerability Detection
Channel: The Linux Foundation
Date: 2022-08-08

Welcome Back & Remarks - James Morris & Code Aware Services in the Service of Vulnerability Detection - Bartosz Zator, Samsung R&D Institute Poland

Welcome back to Day 2 of LSS NA 2022! 

Modern software products have multiple configurations, hundreds of modules and various custom build steps, which makes it difficult to grasp the detailed subset of source code that gets shipped. Ensuring reliability and security of a complex product is even more difficult. We need tools that help engineers navigate through the growing complexity. In this talk we present Code Aware Services (CAS) developed while working on Android Linux kernel. CAS is a set of tools for extracting information from the build process and the source code. This includes data such as how a particular software image is created or information on functions, types and dependencies across them. CAS makes this data easily accessible to external applications. First, we present CAS components: our low-overhead build tracer kernel module and a clang-based source code processor. We then present examples of real tools built on top of CAS, such as web-based security code review system, support for structure-aware fuzzing of kernel components or an automated generator of off-target fuzzing harness code. Finally, we discuss possible directions of using CAS for general source code operations, e.g. smart indexing.