1388545 - PulseAudio regressions from filesystem read restrictions ($XDG_RUNTIME_DIR/pulse and $XAUTHORITY)

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

I'm going to split off the part of the bug about PulseAudio, because that has r+ and can be landed separately, and it will fix the getUserMedia problems.  (I probably should have done this sooner, but I wasn't expecting the DConf part to turn into such a huge thing.)

+++ This bug was initially created as a clone of Bug #1384986 +++

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: bug1388545-pulseaudio-fileread-hg0.diff

Carrying over r+.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: bug1388545-pulseaudio-fileread-hg1.diff

…and rebase.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/babbce26f79b
Fix PulseAudio breakage caused by read restrictions. r=gcp

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/babbce26f79b

Comment 6

[Cristina Badescu [:cbadescu], Experiments QA]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0; Version: 57.0a1; Build ID: 20170918220054

I have managed to reproduce this issue on latest Nightly build using Ubuntu 14.04 x64 and Arch Linux 4.12. It seems that the Microphone permission doorhanger is not displayed on specific websites that request using the microphone.
You can reproduce the issue following the next steps:

[Steps to reproduce]
1. Open the browser and navigate to https://www.onlinemictest.com/.
2. Observe the Microphone permission doorhanger.

[Expected results]
The Microphone permission doorhanger is displayed.

[Actual results]
The Microphone permission doorhanger is not displayed.

[Notes]
- I have also reproduced this issue using "Voice Fill" Firefox experiment from Test Pilot.

-I used the Mozregression tool to find out what might caused this issue. Here are the results:
Last good revision: 8e1e06adf80f82d3d5cf08eadaf569a107bd1ecf
First bad revision: b5fa08551d6e74d8300fa94f3161afdffd867764
Pushlog: https://goo.gl/R24TR7

Jed, can you please take a look on latest Nightly and see if you can reproduce it?

Comment 7

[Cristina Badescu [:cbadescu], Experiments QA]

I just tested this issue on Ubuntu 16.04 x 64 and it seems that is not reproducible.

Comment 8

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

I can reproduce comment #6, and adding /var/lib/dbus/machine-id to security.sandbox.content.read_path_whitelist seems to fix it, which means it's bug 1396542.