The operation of the syzkaller
syz-manager process is governed by a configuration file, passed at invocation time with the
-config option. This configuration can be based on the example; the file is in JSON format with the following keys in its top-level object:
http: URL that will display information about the running
email_addrs: Optional list of email addresses to receive notifications when bugs are encountered for the first time. Mailx is the only supported mailer. Please set it up prior to using this function.
workdir: Location of a working directory for the
syz-managerprocess. Outputs here include:
<workdir>/crashes/*: crash output files (see Crash Reports)
<workdir>/corpus.db: corpus with interesting programs
<workdir>/instance-x: per VM instance temporary files
syzkaller: Location of the
syz-managerwill look for binaries in
binsubdir (does not have to be
syzkallercheckout as long as it preserves
kernel_obj: Directory with object files (e.g.
vmlinuxfor linux) (used for report symbolization and coverage reports, optional).
procs: Number of parallel test processes in each VM (4 or 8 would be a reasonable number).
image: Location of the disk image file for the QEMU instance; a copy of this file is passed as the
sshkey: Location (on the host machine) of a root SSH identity to use for communicating with the virtual machine.
sandbox: Sandboxing mode, the following modes are supported:
enable_syscalls: List of syscalls to test (optional).
disable_syscalls: List of system calls that should be treated as disabled (optional).
suppressions: List of regexps for known bugs.
type: Type of virtual machine to use, e.g.
vm: object with VM-type-specific parameters; for example, for
qemutype paramters include:
count: Number of VMs to run in parallel.
kernel: Location of the
bzImagefile for the kernel to be tested; this is passed as the
cmdline: Additional command line options for the booting kernel, for example
cpu: Number of CPUs to simulate in the VM (not currently used).
mem: Amount of memory (in MiB) for the VM; this is passed as the
See also config.go for all config parameters.