1046525 - Allow get{e,}gid and sched_{g,s}etparam in sandboxed content processes.

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

I've found some more syscalls that content processes use via media libraries and graphics drivers, on B2G prototype hardware.

get{e,}gid shouldn't be as harmless as get{e,}uid, already allowed for similar reasons.

sched_{g,s}etparam basically aren't anything we don't already allow with sched_{g,s}etscheduler.  (In particular, sched_setscheduler also sets the parameters, so sched_setparam is just a special case.)

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Attachment: bug1046525-more-syscalls-hg0.diff

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8465178 [details] [diff] [review]
bug1046525-more-syscalls-hg0.diff

Review of attachment 8465178 [details] [diff] [review]:
-----------------------------------------------------------------

Note: I'm generally just r+'ing these but I feel like this should be mentionned in the bugs:
any call added increase the kernel attack surface (generally I'm also more suspicious about setters than getters obviously)

That said, first we need everything working so yeah :)

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

(In reply to Guillaume Destuynder [:kang] (use NEEDINFO!) from comment #2)
> Note: I'm generally just r+'ing these but I feel like this should be
> mentionned in the bugs:
> any call added increase the kernel attack surface (generally I'm also more
> suspicious about setters than getters obviously)

Agreed; we should consider limiting those at some point; maybe restrict the scheduler policy id, if it could allow access to badly tested alternative scheduling code that we don't use, and restrict the set* calls to the calling thread (although on B2G the userid check should already take care of that).

With these calls, given that they're used by audio/video libraries, I'd be worried about performance regressions from denying access to that kind of scheduler control.  Once we the Flame KitKat port is done and being used for perf testing we should be in a better position to address that kind of thing.

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

https://hg.mozilla.org/integration/b2g-inbound/rev/9a9d70cf2224

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/9a9d70cf2224

Comment 6

[Wayne Chang [:wchang]]

As required.

Comment 7

[Kai-Zhen Li [:seinlin][:kli]]

Hi Jed, can you provide a patch for 2.0m? Thanks!

Comment 8

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Attachment: bug1046525-more-syscalls-20m-hg0.diff

Patch for uplift to 2.0M (the m-c patch doesn't apply cleanly).  Tested locally.  Carrying over r+.

Comment 9

[Kai-Zhen Li [:seinlin][:kli]]

http://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/aefb07eaa7fe