1098467 - gecko: Add utilities for validating tasks for security|sanity for emulators/phone

Status: RESOLVED FIXED

(Taskcluster :: General, defect, P1)

Description

[James Lal [:lightsofapollo]]

For all phone (and potentially emulator) builds we should begin the task by pulling down the task definition (via TASK_ID / RUN_ID) and ensuring that the task is not doing various "bad" things. This only works when we correctly scope docker images and are using a private registry (otherwise you could just override the image).

Current list of "bad" things are:

  - uploading to public/
  - fetching unknown repositories (we should only fetch mozilla hosted repos for these builds)

Comment 1

[James Lal [:lightsofapollo]]

This should probably be some python script which just fetched from the queue via a hard coded url (we don't need the full client here) and performs domain specific validation.

Comment 2

[Jonas Finnemann Jensen (:jonasfj)]

I would do it in node and just strip dynamic properties, such as: taskId, taskGroupId, created, deadline, and possibly extra.location.
After stripping those, just do a deep equals with lodash, to check that all other properties are specified exactly as they should be.

Updating these self-validating tasks or self-protecting task, won't be trivial. But that'll keep people who shouldn't modify them from doing so :)

Comment 3

[James Lal [:lightsofapollo]]

lodash -> assert.deepEquals (as joans says updating these things is not that easy so we should limit what they do as much as possible)

Comment 4

[Wander Lairson Costa]

The patch for this is on top of Bug 1085631.

Comment 5

[Wander Lairson Costa]

Attachment: MozReview Request: bz://1098467/wcosta

Comment 6

[Wander Lairson Costa]

/r/1507 - Bug 1098467: Validate the task before build the phone image r=lightsofapollo.

Pull down this commit:

hg pull review -r 1520c6cd07da116dc1c7aac462d1807247cdc7f9

Comment 7

[Wander Lairson Costa]

/r/1507 - Bug 1098467: Validate the task before build the phone image r=lightsofapollo.

Pull down this commit:

hg pull review -r 1520c6cd07da116dc1c7aac462d1807247cdc7f9

Comment 8

[James Lal [:lightsofapollo]]

https://reviewboard.mozilla.org/r/1505/#review923

::: testing/docker/phone-builder/bin/validate_task.py
(Diff revision 1)
> +    if 'REPOSITORY' not in payload['env']:

Hrm this is going to be somewhat tricky can you validate both the base/head (see the newer task definitions) this is mostly a performance win by caching repos.

Comment 9

[James Lal [:lightsofapollo]]

Comment on attachment 8537397 [details]
MozReview Request: bz://1098467/wcosta

lgtm need to make some tweaks so we can run this on try but can do after landing.

Comment 10

[James Lal [:lightsofapollo]]

https://hg.mozilla.org/projects/alder/rev/1520c6cd07da

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ea5d67b9f456

Comment 13

[Wander Lairson Costa]

Attachment: MozReview Request: Bug 1098467: Validate the task before build the phone image r=lightsofapollo.

Comment 14

[Pete Moore [:pmoore][:pete]]

Resetting Version and Target Milestone that accidentally got changed...