1116500 - Sandbox GMP processes on Android

Status: RESOLVED WONTFIX

(Core :: Security: Process Sandboxing, defect)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

Android 4.3 and higher have selinux enabled in permissive mode. We should be able to turn it on for GMP processes in order to have some additional sandboxing enabled.

Comment 1

[James Willcox (:snorp) ([e-mail]) (he/him)]

Actually I think we may be able to just use seccomp to do what we need. Much easier.

Comment 2

[James Willcox (:snorp) ([e-mail]) (he/him)]

It looks like the Linux sandbox already uses seccomp, so we just need to use that on Android.

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Move process sandboxing bugs to the new Bugzilla component.

(Sorry for the bugspam; filter on 3c21328c-8cfb-4819-9d88-f6e965067350.)

Comment 4

[Jim Mathies [:jimm]]

Getting this "out of the way". we can create a new bug associated with this if it becomes a priority.

Comment 5

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Some relevant things that I thought were written down somewhere, but maybe not:

1. I was under the impression that Android CDMs would likely use TrustZone (or similar) and therefore trying to meaningfully restrict them was a lost cause, and we generally wouldn't use OpenH264 because we'd have hardware support, so there wouldn't really be any use for GMP sandboxing.

2. seccomp-bpf started to be introduced on Android in Lollipop, and I think it was several revisions after that before all the non-Google devices got it; B2G was using our own backports/crossports of the kernel patches.  So, there may still be a significant part of the Android userbase that doesn't have it (vs. desktop, where it's almost universal at this point).

3. If we ever do this, I'd suggest starting with the SELinux sandboxing and then adding seccomp-bpf as defense in depth, which is how seccomp-bpf was meant to be used.  Similarly, B2G used Android's app model for content processes and added seccomp-bpf on top of that.  Desktop Firefox using seccomp-bpf by itself is, in my opinion, not an example to follow if you can avoid it.