pam-ipmi: initial integration for openbmc/pam-ipmi (google#15823)

This pull request integrates the pam-ipmi project into OSS-Fuzz,
enabling continuous
  fuzzing of its special group password management and encryption logic.

  Summary of Changes

  1. Project Configuration
* Added projects/pam-ipmi/project.yaml with project metadata and contact
information.
* Added projects/pam-ipmi/Dockerfile to install build-time dependencies
(libpam0g-dev,
     libssl-dev, meson, ninja-build) and prepare the build environment.

  2. Build & Integration
   * Added projects/pam-ipmi/build.sh to:
* Compile src/pam_ipmisave/pam_ipmisave.c with address sanitizer
instrumentation.
       * Link the fuzzer harness against libcrypto and libpam.
       * Package the seed corpus for the fuzzing engine.

  3. Fuzzer Harness
   * Added projects/pam-ipmi/pam_ipmi_fuzzer.c:
* Targets update_pass_special_file, the core logic responsible for
parsing,
decrypting, updating, and re-encrypting the IPMI special password file
         (/etc/ipmi_pass).
* Mocks file system locks (lckpwdf/ulckpwdf) to allow safe execution
within the
         fuzzing container.
* Provides a structured input split to exercise different usernames,
passwords, and
         initial file states.

  4. Seed Corpus
* Added projects/pam-ipmi/corpus/seed1, containing a valid
metapassstruct header to
assist the fuzzer in reaching the deeper decryption and modification
logic.

  Coverage Impact
Local coverage analysis shows that the fuzzer currently exercises the
early parsing and
error-handling paths of the target function. Fixing the identified
buffer overflow will
allow the fuzzer to penetrate the remaining ~80% of the code, including
the
  OpenSSL-based encryption and decryption routines.

Author: javanlacerda

projects/pam-ipmi/Dockerfile

@@ -0,0 +1,22 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder
+RUN apt-get update && apt-get install -y make autoconf automake libtool libpam0g-dev libssl-dev meson ninja-build
+RUN git clone --depth 1 https://github.com/openbmc/pam-ipmi pam-ipmi
+COPY build.sh pam_ipmi_fuzzer.c $SRC/
+COPY corpus $SRC/corpus
+WORKDIR $SRC/pam-ipmi

projects/pam-ipmi/build.sh

@@ -0,0 +1,25 @@
+#!/bin/bash -eu
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+# Compile the source file with instrumentation
+$CC $CFLAGS -c $SRC/pam-ipmi/src/pam_ipmisave/pam_ipmisave.c -o pam_ipmisave.o
+
+# Compile and link the fuzzer
+$CC $CFLAGS $LIB_FUZZING_ENGINE $SRC/pam_ipmi_fuzzer.c pam_ipmisave.o -o $OUT/pam_ipmi_fuzzer -lcrypto -lpam
+
+# Package the corpus
+zip -j $OUT/pam_ipmi_fuzzer_seed_corpus.zip $SRC/corpus/*

projects/pam-ipmi/corpus/seed1

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdio.h>
+
+#include <security/pam_modules.h>
+#include <security/pam_ext.h>
+
+// Mocking some functions that might be problematic
+int lckpwdf(void) { return 0; }
+int ulckpwdf(void) { return 0; }
+
+// The function we want to fuzz
+int update_pass_special_file(const pam_handle_t *pamh, const char *keyfilename,
+			     const char *filename, const char *forwho,
+			     const char *towhat);
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    if (size < 10) return 0;
+
+    char key_file[] = "/tmp/fuzz_key_XXXXXX";
+    int key_fd = mkstemp(key_file);
+    if (key_fd == -1) return 0;
+    // key file must be 8 bytes as per pam_ipmisave.c: MAX_KEY_SIZE
+    uint8_t key_data[8] = {0};
+    if (size >= 8) {
+        memcpy(key_data, data, 8);
+        data += 8;
+        size -= 8;
+    }
+    write(key_fd, key_data, 8);
+    close(key_fd);
+
+    char pass_file[] = "/tmp/fuzz_pass_XXXXXX";
+    int pass_fd = mkstemp(pass_file);
+    if (pass_fd == -1) {
+        unlink(key_file);
+        return 0;
+    }
+    if (size > 0) {
+        // Use half of remaining data for the initial pass file content
+        size_t initial_file_size = size / 2;
+        write(pass_fd, data, initial_file_size);
+        data += initial_file_size;
+        size -= initial_file_size;
+    }
+    close(pass_fd);
+
+    if (size < 2) {
+        unlink(key_file);
+        unlink(pass_file);
+        return 0;
+    }
+
+    // Use the rest for username and password
+    size_t user_len = size / 2;
+    char *user = malloc(user_len + 1);
+    memcpy(user, data, user_len);
+    user[user_len] = '\0';
+    data += user_len;
+    size -= user_len;
+
+    char *pass = malloc(size + 1);
+    memcpy(pass, data, size);
+    pass[size] = '\0';
+
+    // Call the function
+    update_pass_special_file(NULL, key_file, pass_file, user, pass);
+
+    free(user);
+    free(pass);
+    unlink(key_file);
+    unlink(pass_file);
+
+    return 0;
+}

projects/pam-ipmi/pam_ipmi_fuzzer.c

@@ -0,0 +1,14 @@
+homepage: "https://github.com/openbmc/pam-ipmi"
+language: c
+primary_contact: "javanlacerda@google.com"
+auto_ccs:
+  - "pedroysb@google.com"
+  - "cloud-ti-fuzzing+bugs@google.com"
+fuzzing_engines:
+  - libfuzzer
+sanitizers:
+  - address
+  - undefined
+architectures:
+  - x86_64
+main_repo: "https://github.com/openbmc/pam-ipmi"