af79dfc438
Bug 1041775 Part 1: Update Chromium sandbox code to commit 9522fad406dd161400daa518075828e47bd47f60. r=jld,aklotz
...
--HG--
rename : security/sandbox/chromium/sandbox/linux/sandbox_export.h => security/sandbox/chromium/sandbox/sandbox_export.h
2014-11-18 13:48:21 +00:00
ba22404db5
Bug 1095926 - Fix -Wcomment warning in OCSP test and mark some OCSP tests as FAIL_ON_WARNINGS. r=briansmith
2014-10-11 20:13:45 -07:00
59573e5f85
Bug 1077057 - Expose Linux sandboxing information to JS via nsSystemInfo. r=kang r=froydnj
...
This adds "hasSeccompBPF" for seccomp-bpf support; other "has" keys
will be added in the future (e.g., user namespaces).
This also adds "canSandboxContent" and "canSandboxMedia", which are
absent if the corresponding type of sandboxing isn't enabled at build
type (or is disabled with environment variables), and otherwise present
as a boolean indicating whether that type of sandboxing is supported.
Currently this is always the same as hasSeccompBPF, but that could change
in the future.
Some changes have been made to the "mozilla/Sandbox.h" interface to
support this; the idea is that the MOZ_DISABLE_*_SANDBOX environment
variables should be equivalent to disabling MOZ_*_SANDBOX at build time.
2014-11-06 13:11:00 +01:00
e6ede214a5
Bug 1093893 - Fix B2G sandbox for ICS Bionic pthread_kill(). r=kang
2014-11-06 11:04:14 -08:00
5cc944a89b
Bug 1076903: Add a Chromium LICENSE file to security/sandbox/win/src. r=gerv
2014-11-03 15:34:26 +00:00
436338cb49
Bug 1076385 - Sandbox the content process on Mac. r=smichaud
2014-10-30 13:33:17 -05:00
47c853314f
Bug 1077148 part 4 - Add and use new moz.build templates for Gecko programs and libraries. r=gps
...
There are, sadly, many combinations of linkage in use throughout the tree.
The main differentiator, though, is between program/libraries related to
Gecko or not. Kind of. Some need mozglue, some don't. Some need dependent
linkage, some standalone.
Anyways, these new templates remove the need to manually define the
right dependencies against xpcomglue, nspr, mozalloc and mozglue
in most cases.
Places that build programs and were resetting MOZ_GLUE_PROGRAM_LDFLAGS
or that build libraries and were resetting MOZ_GLUE_LDFLAGS can now
just not use those Gecko-specific templates.
2014-10-30 13:06:12 +09:00
5ec3c350dd
Bug 1081242 - Make ASAN's error reporting work while sandboxed on Linux. r=kang
2014-10-21 11:18:00 +02:00
82a97e04c9
Bug 1078838 - Restrict clone(2) flags for sandboxed content processes. r=kang
...
--HG--
extra : amend_source : f80a3a672f5496f76d8649f0c8ab905044ea81ac
2014-10-20 12:29:25 -07:00
67e50f1aa1
Bug 1080165 - Allow setpriority() to fail without crashing in media plugins on Linux. r=kang
2014-10-16 12:42:00 +02:00
b9708b293b
Bug 1083701: When pre-Vista, for testing purposes allow stdout/err to be inherited by sandboxed process when an env var is set. r=tabraldes
2014-10-17 09:42:09 +01:00
64a69cb8af
Bug 1080567: Don't report registry NAME_NOT_FOUND errors for the Windows warn only sandbox. r=tabraldes
2014-10-13 15:12:28 +01:00
56cddbd763
Bug 1080077 - For sandbox failures with no crash reporter, log the C stack. r=kang
...
This is mostly for ASAN builds, which --disable-crash-reporter, but also
fixes a related papercut: debug builds don't use the crash reporter
unless overridden with an environment variable.
Note: this is Linux-only, so NS_StackWalk is always part of the build;
see also bug 1063455.
2014-10-13 18:48:17 -07:00
94adb30f77
Bug 1062709 (part 2, attempt 2) - Clean up stack printing and fixing. r=dbaron.
...
--HG--
extra : rebase_source : 626fd23a14ec90cfc9807c3d555169ec6463d19d
2014-09-01 22:56:05 -07:00
2eb56008e2
Bug 1062709 (part 1, attempt 2) - Add a frame number argument to NS_WalkStackCallback. r=dbaron.
...
--HG--
extra : rebase_source : 4f7060a9ae0bed180899651c50e8ea8857e72d63
2014-09-10 21:47:01 -07:00
5043e01249
Bug 1068410 - Convert remote crash dump to use pipe instead of socketpair in the child. r=kang r=ted
2014-10-03 14:55:03 -07:00
2d0f9579b5
Backed out changeset a0b82c954206 (bug 1062709) for Windows mochitest 5 hangs
2014-10-03 15:06:16 +01:00
9e223d8a19
Backed out changeset 7a1b7d7eba12 (bug 1062709)
2014-10-03 15:05:26 +01:00
5a257b83f9
Bug 1062709 (part 2) - Clean up stack printing and fixing. r=dbaron.
...
--HG--
extra : rebase_source : 18158d4474cb8826813a3866eba57b710e14db99
2014-09-01 22:56:05 -07:00
c9c64de53c
Bug 1062709 (part 1) - Add a frame number argument to NS_WalkStackCallback. r=dbaron.
...
--HG--
extra : rebase_source : 0f9b2d6310433ed56f5552706fcf2a96571aee25
2014-09-10 21:47:01 -07:00
27ae4de9b6
Bug 1068000 - Add client side chrome.* pipe rule for Windows content sandbox. r=tabraldes
2014-09-16 15:44:25 +01:00
9fd62691c6
Bug 1069700 - Fix recursive crash when non-content children violate sandbox policy. r=kang
2014-09-18 18:17:00 -04:00
4728b78382
bug 1062567 - prevent gcc lto builds from dropping SyscallAsm on the floor r=froydnj
2014-09-15 19:46:14 -04:00
61056aa4db
Bug 1018988 - Set up a low integrity temp directory when using the Windows content sandbox. r=mrbkap r=tabraldes r=froydnj
2014-09-10 12:36:17 +01:00
33eaabbf1f
Bug 1063455 - Define MOZ_STACKWALKING when NS_StackWalk is available and replace other instances of the same #if logic. r=mshal, r=froydnj
2014-09-08 18:25:20 +01:00
af04cea2d8
Bug 1059038 - Move mozilla::unused from xpcom/glue to mfbt. r=Waldo
...
--HG--
rename : xpcom/glue/unused.cpp => mfbt/unused.cpp
rename : xpcom/glue/unused.h => mfbt/unused.h
2014-08-29 10:11:00 +02:00
a9431992d5
Bug 1018966 - Part 2: Make warn only sandbox changes to the Chromium code. r=tabraldes
2014-09-03 10:31:53 +01:00
f19448274c
Bug 1018966 - Part 1: Add the main warn only sandbox machinery - with no Chromium code changes. r=bsmedberg
...
This change also includes the content sandboxing code on Windows Nightly by defining MOZ_CONTENT_SANDBOX=1.
Whether the content sandbox is disabled, in warn only mode, or enabled is controlled by a new pref: browser.tabs.remote.sandbox=(off/warn/on)
2014-06-11 15:32:37 +01:00
d578571a85
Backed out changeset 5adabc2818b2 (bug 1018966) for b2g bustage
2014-09-04 15:14:41 +02:00
39fa254326
Backed out changeset 5d21dd9ca51e (bug 1018966) for b2g Build bustage
2014-09-04 15:13:14 +02:00
ad41895771
Bug 1018966 - Part 2: Make warn only sandbox changes to the Chromium code. r=tabraldes
2014-09-03 10:31:53 +01:00
0fdb849687
Bug 1018966 - Part 1: Add the main warn only sandbox machinery - with no Chromium code changes. r=bsmedberg r=tabraldes
...
This change also includes the content sandboxing code on Windows Nightly by defining MOZ_CONTENT_SANDBOX=1.
Whether the content sandbox is disabled, in warn only mode, or enabled is controlled by a new pref: browser.tabs.remote.sandbox=(off/warn/on)
2014-06-11 15:32:37 +01:00
4b99580194
Bug 1059113 - Use templates for shared libraries and frameworks. r=gps
...
Also force to use the existing template for XPCOM components.
2014-09-04 09:04:45 +09:00
ed70c5f377
Bug 1041941 - Use templates for programs, simple programs, libraries and C++ unit tests. r=gps
2014-09-03 14:10:54 +09:00
1dfa299843
Bug 1061085 - Clean up misused export macros from bug 1041886. r=glandium
2014-08-31 23:23:00 +02:00
ba6539ecd7
bug 1027906. Set delayed token level for GMP plugin processes to USER_RESTRICTED. Whitelist certain files and registry keys that are required for EME plugins to successfully load. r=bobowen. r=jesup. r=bent.
2014-08-29 17:34:26 -07:00
1ea7e357ca
Bug 1059602 - Make libxul -> libmozsandbox dependency not a weak symbol. r=glandium
...
MFBT_API is not the right macro for this; it changes the affected
definition/usage to a weak symbol, for reasons explained in the comments
on its definition.
This was causing the linker to drop the dependency from libmozglue
to libmozsandbox, in some cases (--as-needed, with a linker that
doesn't consider weak symbols "needed"), and thus load libxul with
gSandboxCrashFunc relocated to address 0 (the expected behavior of an
unresolved weak symbol), which caused crashes when writing to it on
startup.
--HG--
extra : amend_source : b99fded391ae90b1311f4cabaf40f15e6414f245
2014-08-28 23:23:13 -07:00
db45c0b01a
Bug 1023941 - Part 2: Static-link the CRT into plugin-container.exe. r=glandium,f=tabraldes
...
--HG--
rename : security/sandbox/moz.build => security/sandbox/objs.mozbuild
extra : rebase_source : e0b1515a4729ecfe82a67b6439d9a38453f7556a
2014-08-28 14:50:10 +12:00
3f1e2a85b6
Bug 1041886 - Fix no-opt-only build bustage caused by mozilla::unused. r=glandium
...
See also bug 1059038.
2014-08-26 19:23:44 -07:00
3ae6c90876
Bug 1054616 - Clean up logging-related shims for Linux sandboxing. r=kang
2014-08-26 13:54:16 -07:00
23c21aa709
Bug 1041886 - Separate Linux sandbox code into its own shared library. r=kang r=glandium
...
This creates libmozsandbox.so on builds that use sandboxing
(MOZ_CONTENT_SANDBOX or MOZ_GMP_SANDBOX).
The unavoidably libxul-dependent parts, for invoking the crash reporter
and printing the JS context, are separated into glue/SandboxCrash.cpp
and invoked via a callback.
2014-08-26 13:54:09 -07:00
e020caf2de
Bug 1041886 - Break out Linux sandbox logging into its own header. r=kang
2014-08-26 13:54:03 -07:00
dfc4c053b1
Bug 1056936 - Specify full path to plugin-container in sandbox rules. r=rjesup
2014-08-25 15:01:04 -05:00
f2fb78225b
Bug 1055541 - Fix build failure on VS2013 with --enable-warnings-as-errors due to Warning C4996. r=ehsan
2014-08-20 04:09:03 +09:00
64bed2314d
Bug 1052033 - Fix warnings in security/sandbox and mark as FAIL_ON_WARNINGS. r=smichaud
2014-08-09 14:25:24 -07:00
1c8a8d2d9b
No bug - Add trailing newlines for non-Android Linux sandbox logging. r=kang
...
--HG--
extra : rebase_source : c0e936b62289c0e5eecad41fce9afac881fe4667
2014-08-14 15:39:14 -07:00
033a6785eb
Bug 1043733 - Require sandboxing to load Gecko Media Plugins on Linux. r=jesup r=kang
...
Also refactors how sandbox support and disabling are handled, and allows
simulating a lack of sandbox support with an env var (for testing
without rebuilding a kernel).
2014-08-12 21:28:27 -07:00
844fdf04eb
Bug 1012949 - Sandbox the OpenH264 plugin for Mac r=rjesup,areinald,ted a=PatchNeedsToLandToday
2014-08-08 11:55:22 -05:00
89777800f9
Bug 1047267 - Move remaining OS_LIBS and EXTRA_LIBS to moz.build. r=gps
...
* * *
Bug 1047267 - To fold with "Move remaining OS_LIBS and EXTRA_LIBS to moz.build"
2014-08-07 14:21:03 +09:00
d9443ec932
Bug 1045783 - Move most OS_LIBS to moz.build and do some related cleanup. r=mshal
2014-08-06 07:25:33 +09:00
b0bd63525b
Bug 1047620 - Fix sandboxing for B2G --disable-jemalloc builds. r=kang
...
--HG--
extra : rebase_source : 1b2ec6491277a9dc451ab767d8563076cf522c27
2014-08-04 15:11:33 -07:00
9d31844f0c
Bug 1012951 - Add Linux sandboxing for GeckoMediaPlugin processes. r=kang r=ted
...
--HG--
extra : rebase_source : 1b890000d5b8d2a8954cdd1118a1023eba829c29
2014-08-04 15:11:18 -07:00
d2d145dc65
Bug 1046541 - Use stdio for non-Android Linux sandbox error messages. r=kang
...
--HG--
extra : rebase_source : e93a4a76f8188d715886e263a366d694c28b4525
2014-08-04 15:11:04 -07:00
9b70e225e5
Bug 1046525 - Allow get{e,}gid and sched_{g,s}etparam in sandboxed content processes. r=kang
...
Some of these were already in the desktop whitelist; those duplicates
are removed.
--HG--
extra : amend_source : 3ab4b50e3f1980b4d7b93cc17f34b926e2aa2396
2014-08-01 15:05:44 -07:00
dcbfd040d1
Backed out changeset d50d7e88f35e (bug 1012951) for LSan failures
2014-07-30 16:49:43 +01:00
8cff1bfff8
Bug 1012951 - Sandbox GMP plugins on Linux using seccomp-bpf. r=kang r=ted
2014-07-29 15:31:12 -07:00
301d254a40
Bug 1017393 - Record rejected syscall number in crash dump. r=kang
2014-07-24 11:36:00 +02:00
95063176fa
Bug 1036894 part 9 - Replace all EXTRA_DSO_LDOPTS, SHARED_LIBRARY_LIBS and LIBS with EXTRA_LIBS, OS_LIBS or OS_LDFLAGS, appropriately. r=gps
...
OS_LIBS for libraries that are not part of the gecko tree, EXTRA_LIBS for
libraries, such as NSPR, that are in the tree, but are not handled by
moz.build just yet. Those EXTRA_LIBS may also come from a system library.
However, in cases where the expanded variables are always empty for the
in-tree case, OS_LIBS is used (as for, e.g. MOZ_ZLIB_LIBS). OS_LDFLAGS is
used exclusively for non-library linker flags.
Always pass EXTRA_LIBS before OS_LIBS on linker command lines.
Forbid EXTRA_DSO_LDOPTS, SHARED_LIBRARY_LIBS and LIBS in Makefiles.
2014-07-23 13:31:02 +09:00
5fab42fcaf
Bug 1036894 part 8 - Move most in-tree library linkage information to moz.build, as USE_LIBS. r=gps
2014-07-23 13:30:52 +09:00
a50127383b
Bug 1041325 - Use intrin.h for _ReturnAddress in the chromium sandbox code; r=bbondy
...
--HG--
extra : rebase_source : 06bb642636a9f3df2e75eb950816a7d48da85faf
2014-07-20 19:05:44 -04:00
90ebf4e684
Bug 1037211 - Remove MOZ_CONTENT_SANDBOX_REPORTER by making it always true. r=kang r=ted
...
--HG--
extra : amend_source : 450d51dab077794e194bf407044de95627de0cde
2014-07-17 14:57:28 -07:00
c55ab9dd20
Bug 1038900 - Dynamically allocate signal number for sandbox startup. r=kang
2014-07-16 13:37:00 +02:00
1aaa7148c1
bug 985252. Build sandbox code regardless of whether --enable-content-sandbox/MOZ_CONTENT_SANDBOX is provided. Enable sandboxing of GMP plugins. Enable `SandboxBroker` to set different security policies for different process types. r=bbondy, r=cpearce, r=bent
2014-07-16 16:01:34 -07:00
d1da9cff99
Bug 1035275 - Remove unused base Chromium code. r=bbondy
2014-07-07 13:59:11 +01:00
2ff3fcad0d
Bug 1038490 - Fix misuse of MOZ_WIDGET_GONK in Linux content process sandbox policy. r=kang
...
--HG--
extra : amend_source : 0a7fe8ca751b59102cbc23316b18982268306423
2014-07-14 18:35:56 -07:00
79f8763545
Bug 1038486 - Fix Linux desktop seccomp sandbox build on 32-bit x86. r=kang
...
--HG--
extra : amend_source : 130d2cbd485734997739ea96ac5d83c01899d8b0
2014-07-09 16:52:56 -07:00
20443103f0
Bug 1035786 - Fix namespace bug in Linux sandbox LOG_ERROR macro. r=jld
2014-07-08 05:53:00 +01:00
51e7e12a6c
Bug 1035786 - Avoid warning-as-error sandbox build failure with an explicit cast. r=gdestuynder
...
getpid() is never negative, so this is safe.
2014-07-10 17:37:45 -07:00
d9210e4477
Bug 1035786 - Fix member variable initialisation order in LogMessage stub in Linux Sandbox.cpp. r=jld
2014-07-09 12:32:49 +01:00
70a5917917
Bug 1036864 - Remove EXPORT_LIBRARY. r=mshal
2014-07-11 19:06:55 +09:00
afdeb7bf07
Bug 956961 - Stop disabling sandboxing when DMD is enabled. r=kang
...
--HG--
extra : rebase_source : 4737cfd613c1ddee8e1a4340e819eddc151e73f7
extra : histedit_source : 2d2610a775a3ae986157f61ef3797f4e88baa922
2014-07-02 11:28:48 -07:00
03cdc19fec
Backed out 3 changesets (bug 956961) for non-unified build bustage
...
Backed out changeset f1be89cb58b9 (bug 956961)
Backed out changeset 272b01e4f856 (bug 956961)
Backed out changeset 56907af18c66 (bug 956961)
2014-07-02 15:03:29 -07:00
1ef012aafb
Bug 956961 - Stop disabling sandboxing when DMD is enabled. r=kang
...
--HG--
extra : amend_source : 66f2453794e6a8a581e1564e786cfc8cac1f6bbd
2014-07-02 11:28:48 -07:00
0fb3cb7f61
Bug 1014299 - Add times() to seccomp whitelist. r=kang
...
This system call seems to be used by some versions of the Qualcomm Adreno
graphics drivers when we run WebGL apps.
2014-06-02 14:52:00 +02:00
a597c57860
Bug 1009452 - inherit stdout and stderr into the content process to allow logging. r=aklotz
2014-05-14 16:09:31 +01:00
9f78dc2ea0
Bug 920372 - Fix socketcall whitelisting on i386. r=kang
2014-05-20 18:38:14 -07:00
f6ffcab30d
Bug 920372 - Allow tgkill only for threads of the calling process itself. r=kang
2014-05-20 18:38:06 -07:00
ebb89f61f4
Bug 920372 - Use Chromium seccomp-bpf compiler to dynamically build sandbox program. r=kang
2014-05-20 18:37:53 -07:00
9e94aea459
Bug 920372 - Import Chromium seccomp-bpf compiler, rev 4c08f442d2588a2c7cfaa117a55bd87d2ac32f9a. r=kang
...
Newly imported:
* sandbox/linux/seccomp-bpf/
* sandbox/linux/sandbox_export.h
* base/posix/eintr_wrapper.h
Updated:
* base/basictypes.h
* base/macros.h
At the time of this writing (see future patches for this bug) the only
things we're using from sandbox/linux/seccomp-bpf/ are codegen.cc and
basicblock.cc, and the header files they require. However, we may use
more of this code in the future, and it seems cleaner in general to
import the entire subtree.
2014-05-20 18:37:45 -07:00
3ab8eb01df
Bug 1004832 - Add tgkill to seccomp-bpf whitelist. r=kang
2014-05-02 16:57:00 +02:00
3fd7deadb7
Bug 997409 - Add set_thread_area to seccomp whitelist if available. r=kang
2014-04-17 16:23:23 -04:00
59ee14f2ce
Bug 981949 - Whitelist ftruncate for seccomp-bpf sandboxing. r=kang
2014-04-11 13:09:00 +02:00
e3cb82bf06
Bug 995047 followup. Fix a caller that I missed because it's only compiled on some platforms, so we can reopen the CLOSED TREE
2014-04-12 00:38:06 -04:00
7f0d9d7eb4
Bug 993145 - Skip attempting seccomp sandboxing if seccomp unavailable. r=kang
2014-04-09 15:23:00 +02:00
e5a5d4a701
Bug 928062 - Set Windows sandbox delayed integrity level to INTEGRITY_LEVEL_LOW. r=aklotz
2014-04-08 16:25:18 +01:00
628fb11481
Bug 989172 - Re-add sigaltstack to seccomp whitelist. r=kang
...
This reinstates the patch from bug 983518, which was unintentionally
dropped while merging with the reorganization in bug 985227.
2014-03-28 17:58:26 -07:00
2244b78e3a
Bug 987888 - --enable-content-sandbox breaks 64-bit builds. r=dkeeler,r=mshal
2014-03-28 13:59:16 +09:00
5a499cf36e
Bug 985227 - Part 3: Replace the seccomp filter arch ifdefs with syscall existence tests. r=kang
2014-03-20 10:19:42 -04:00
ebdd7da812
Bug 985227 - Part 2: Flatten out the #define maze in the seccomp filter. r=kang
2014-03-20 10:19:42 -04:00
5ddfd55b71
Bug 985227 - Part 1: Move the seccomp filter into its own translation unit. r=kang
...
--HG--
rename : security/sandbox/linux/seccomp_filter.h => security/sandbox/linux/SandboxFilter.cpp
2014-03-20 10:19:42 -04:00
3c61d46763
Bug 975273 - Add missing include to unbreak desktop seccomp build. r=kang
2014-03-20 09:27:28 -04:00
4f870b786b
Merge m-c to m-i
2014-03-15 12:32:04 -07:00
fe6c4e28d6
Bug 967364: Rename already_AddRefed::get to take. r=bsmedberg
2014-03-15 12:00:15 -07:00
6034a4eab4
Bug 983518: Fix running B2G-1.4 on KitKat by whitelisting sigalstack in the sandbox. r=kang r=jld
2014-03-14 18:54:20 -07:00
c7a5c70ed1
Bug 944625 - B2G Emulator-x86: fix undeclared __NR_sendto, __NR_recvfrom. r=jld,kang
2014-03-13 13:44:43 +09:00
154d9c5e2a
Bug 977859 - Drop uid 0 in all content processes immediately after fork. r=bent r=kang
...
Now all regular child processes, including preallocated, are deprivileged.
Only Nuwa needs uid 0, because each of its children has a different uid/gid.
2014-03-12 15:48:15 -07:00
0b447036a1
Bug 979686 - Fix the non-(ARM|x86|x86_64) desktop build. r=kang
2014-03-06 12:23:06 -08:00
f2c70589f0
Bug 941110 - Make the Windows sandbox code compile without the Win8 SDK. r=jimm
2014-03-06 12:53:24 -05:00
a76ee1d66c
Bug 946407 - Disable sandbox when DMDing. r=njn r=kang
...
See also bug 956961.
2014-03-04 18:27:14 -08:00
17f4a32d8b
Bug 976896 - Port STL_FLAGS to moz.build; r=mshal
2014-03-04 19:39:06 -05:00
Bob Owen
Chris Peterson
Jed Davis
André Reinald
Mike Hommey
Nicholas Nethercote
Ed Morley
Trevor Saunders
Carsten "Tomcat" Book
Tim Abraldes
David Major
Steven Michaud
Masatoshi Kimura
Ehsan Akhgari
jvoisin
Wes Kocher
Boris Zbarsky
Makoto Kato
Phil Ringnalda
Kyle Huey
Guillaume Destuynder
Vicamo Yang
Brian R. Bondy