gecko-dev/security/sandbox
Jed Davis 08546b4b69 Bug 1650751 - Add FMODE_NONOTIFY to ignored file flags in Linux sandbox. r=gcp
As of kernel 5.8 (commit [e9c15badb][]), Linux will set the internal
`FMODE_NONOTIFY` flag on files that don't exist in the filesystem,
including (unnamed) pipes and sockets.  Although this flag isn't
properly part of the userspace API, it will be returned by F_GETFL, so
userspace code that tries to change file flags will pass it to F_SETFL.

The implementation of `F_SETFL` has an allow list of flags userspace can
change (`SETFL_MASK`) and ignores all others, but our sandbox has a list
of flags *known* to be ignored, because currently unknown flags could
potentially be accepted by the kernel in the future.

This patch adds `FMODE_NONOTIFY` as an ignored flag.

[e9c15badb]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9c15badbb7b20ccdbadf5da14e0a68fbad51015

Differential Revision: https://phabricator.services.mozilla.com/D83205
2020-07-13 12:18:00 +00:00
..
chromium Bug 1639030 - Part 3: Roll-up patch to apply remaining mozilla changes to chromium sandbox. r=bobowen 2020-07-08 12:54:35 +00:00
chromium-shim Bug 1639030 - Part 2: Roll-up of chromium sandbox update and patches to get a running browser. r=bobowen 2020-07-08 12:54:33 +00:00
common Bug 1613985 - Use default for equivalent-to-default constructors/destructors in security. r=rrelyea 2020-03-16 10:56:56 +00:00
linux Bug 1650751 - Add FMODE_NONOTIFY to ignored file flags in Linux sandbox. r=gcp 2020-07-13 12:18:00 +00:00
mac Bug 1648838 - Remove OS-specific sandboxing code for unsupported macOS versions (up to 10.11 inclusive) r=spohl 2020-07-01 14:27:13 +00:00
test Bug 1649221: Update ChromeUtils.generateQI callers to pass strings. r=mccr8,remote-protocol-reviewers,marionette-reviewers,perftest-reviewers,webcompat-reviewers,geckoview-reviewers,preferences-reviewers,agi,whimboo,Bebe,twisniewski 2020-07-10 23:58:28 +00:00
win Bug 1639030 - Part 2: Roll-up of chromium sandbox update and patches to get a running browser. r=bobowen 2020-07-08 12:54:33 +00:00
moz.build Bug 1639030 - Part 2: Roll-up of chromium sandbox update and patches to get a running browser. r=bobowen 2020-07-08 12:54:33 +00:00