1077057 - Expose Linux sandboxing status in an about: page

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Linux has a number of sandboxing / security hardening features whose availability varies widely (and not always very predictably) among distributions and versions and sometimes local configuration.  It would be useful for a knowledgeable user or developer to be able to see the status of the features relevant to Firefox.

This could be similar to Chromium's about:sandbox page, which displays the information in a simple textual format.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Step 1: Expose Linux sandboxing information to JS via nsSystemInfo.

r?(kang) for the sandbox side; r?(bsmedberg) for the nsSystemInfo side after browsing the history looking for vaguely similar commits.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Step 2: Display Linux sandboxing information as about:sandbox.

I'm a little unclear on how this maps to the module/review system; please adjust flags if needed.

Comment 3

[Benjamin Smedberg]

Does this need to be a separate page rather than something we can include in about:support?

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #3)
> Does this need to be a separate page rather than something we can include in
> about:support?

That's a good point.  Probably not.

Comment 5

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8514673 [details] [diff] [review]
Step 1: Expose Linux sandboxing information to JS via nsSystemInfo.

Review of attachment 8514673 [details] [diff] [review]:
-----------------------------------------------------------------

Good idea!
only looked at the Sandbox.* files - looks good to me

Comment 6

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Step 2: Include Linux sandboxing information in about:support.

Now with the information in about:support#sandbox instead of a separate page.

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=9bedbe344b27

Comment 7

[Nathan Froyd [:froydnj]]

Comment on attachment 8514673 [details] [diff] [review]
Step 1: Expose Linux sandboxing information to JS via nsSystemInfo.

Review of attachment 8514673 [details] [diff] [review]:
-----------------------------------------------------------------

xpcshell tests for this would be great...is that hard to do on the build machines?

::: xpcom/base/nsSystemInfo.cpp
@@ +363,5 @@
> +
> +  SandboxAvailability sandboxContent = CanSandboxContentProcess();
> +  if (sandboxContent != kSandboxingDisabled) {
> +    SetPropertyAsBool(NS_LITERAL_STRING("canSandboxContent"),
> +                      sandboxContent);

Oooo, this is almost a little too clever with the enum values.  I think there should be some MOZ_ASSERT sprinkled around here so our cleverness is more explicit:

  MOZ_ASSERT(sandboxContent == kSandboxingWouldFail || sandboxContent == kSandboxingSupported);
  static_assert(kSandboxingWouldFail == 0, "...");
  static_assert(kSandboxingSupported == 1, "...");

@@ +369,5 @@
> +
> +  SandboxAvailability sandboxMedia = CanSandboxMediaPlugin();
> +  if (sandboxMedia != kSandboxingDisabled) {
> +    SetPropertyAsBool(NS_LITERAL_STRING("canSandboxMedia"),
> +                      sandboxMedia);

Likewise.

Comment 8

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Comment on attachment 8517105 [details] [diff] [review]
Step 2: Include Linux sandboxing information in about:support.

Review of attachment 8517105 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/locales/en-US/chrome/global/aboutSupport.properties
@@ +82,5 @@
>  
>  minLibVersions = Expected minimum version
>  loadedLibVersions = Version in use
> +
> +hasSeccompBPF = Seccomp-BPF

I had to lookup what this was (who names this stuff?!). Turns out Wikipedia (https://en.wikipedia.org/wiki/Seccomp#seccomp-bpf) mentions that Chrome uses this, but has no mention of Firefox - if you have context, perhaps you could add mention of Firefox (and B2G I believe?) supporting this too?

::: toolkit/modules/Troubleshoot.jsm
@@ +476,5 @@
> +
> +    let sysInfo = Cc["@mozilla.org/system-info;1"].
> +                  getService(Ci.nsIPropertyBag2);
> +    let data = {};
> +    keys.forEach(function(key) {

Nit: for-of loops are generally preferred these days, for more modern/readable code. 
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for...of

Comment 9

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Nathan Froyd (:froydnj) from comment #7)
> Oooo, this is almost a little too clever with the enum values.  I think
> there should be some MOZ_ASSERT sprinkled around here so our cleverness is
> more explicit:
> 
>   MOZ_ASSERT(sandboxContent == kSandboxingWouldFail || sandboxContent ==
> kSandboxingSupported);
>   static_assert(kSandboxingWouldFail == 0, "...");
>   static_assert(kSandboxingSupported == 1, "...");

The more I think about this, the less I want to inflict it on the world, as opposed to just using an enum normally and changing the call sites.  “Explicit is better than implicit”, “code is read much more often than it is written”, etc.

(In reply to Blair McBride [:Unfocused] from comment #8)
> > +hasSeccompBPF = Seccomp-BPF
> 
> I had to lookup what this was (who names this stuff?!). Turns out Wikipedia
> (https://en.wikipedia.org/wiki/Seccomp#seccomp-bpf) mentions that Chrome
> uses this, but has no mention of Firefox - if you have context, perhaps you
> could add mention of Firefox (and B2G I believe?) supporting this too?

Good idea.  Also, I think I'll change that label to "Seccomp-BPF (System Call Filtering)", which might at least make it less opaque to someone with enough Unix background to have encountered "system call".

> ::: toolkit/modules/Troubleshoot.jsm
> @@ +476,5 @@
> > +
> > +    let sysInfo = Cc["@mozilla.org/system-info;1"].
> > +                  getService(Ci.nsIPropertyBag2);
> > +    let data = {};
> > +    keys.forEach(function(key) {
> 
> Nit: for-of loops are generally preferred these days, for more
> modern/readable code. 
> https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/
> for...of

Thanks; that's a definite improvement.

Comment 10

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Step 2: Include Linux sandboxing information in about:support. [v2]

Carrying over r+.

Comment 11

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Step 1: Expose Linux sandboxing information to JS via nsSystemInfo. [v2]

Comment 12

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Try: https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=98f777a83e53 (assuming I've starred it correctly)

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/09cbdbb68a5c
https://hg.mozilla.org/integration/mozilla-inbound/rev/cca5872f47f4

Comment 14

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/09cbdbb68a5c
https://hg.mozilla.org/mozilla-central/rev/cca5872f47f4