1121479 - Turn on DEP, SEHOP, HEAP_TERMINATE, DLL_SEARCH_ORDER process-level mitigations for the GMP sandbox.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Bob Owen (:bobowen) PTO until 13th Aug]

I'm going to turn these on in separate patches to aid with bisection.

Comment 1

[Bob Owen (:bobowen) PTO until 13th Aug]

Attachment: Part 1: Turn on DEP process-level mitigation for the GMP sandbox.

Comment 2

[Bob Owen (:bobowen) PTO until 13th Aug]

Attachment: Part 2: Turn on SEHOP process-level mitigation for the GMP sandbox.

Comment 3

[Bob Owen (:bobowen) PTO until 13th Aug]

Attachment: Part 3: Turn on HEAP_TERMINATE process-level mitigation for the GMP sandbox.

Comment 4

[Bob Owen (:bobowen) PTO until 13th Aug]

Attachment: Part 4: Turn on DLL_SEARCH_ORDER process-level mitigation for the GMP sandbox.

Comment 5

[Bob Owen (:bobowen) PTO until 13th Aug]

Chris - these don't appear to cause any problems with the tests or your clearkey plugin.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=63bed7b04657

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

TEST_DECODING works fine here with these too. Ship it!

Comment 7

[Bob Owen (:bobowen) PTO until 13th Aug]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/52463ef12e63
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/4ad3ab545a8b
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/bec06786b974
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/2a91d4a797df

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/52463ef12e63
https://hg.mozilla.org/mozilla-central/rev/4ad3ab545a8b
https://hg.mozilla.org/mozilla-central/rev/bec06786b974
https://hg.mozilla.org/mozilla-central/rev/2a91d4a797df

Comment 9

[Chris Peterson [:cpeterson]]

Bob: should all Windows GMP fixes be uplifted to 37? Adobe QA would like to start testing when 37 hits Beta.

Comment 10

[Bob Owen (:bobowen) PTO until 13th Aug]

Comment on attachment 8551357 [details] [diff] [review]
Part 1: Turn on DEP process-level mitigation for the GMP sandbox.

(In reply to Chris Peterson [:cpeterson] from comment #9)
> Bob: should all Windows GMP fixes be uplifted to 37? Adobe QA would like to
> start testing when 37 hits Beta.

Makes sense to me.

Approval Request Comment
[Feature/regressing bug #]: This is an improvement to the GMP process sandbox on Windows, which is already in Live.

[User impact if declined]: If a vulnerability is found in a GMP, the extra layers of protection these mitigations provide won't be enabled.

[Describe test coverage new/current, TreeHerder]: The mitigations are not tested directly, but there are GMP tests for webrtc and eme in tree, which helps ensure that these sandbox features don't cause a regression.
Also, as cpeterson points out, there will be more extensive testing from Adobe, once in Beta.

[Risks and why]: Low to medium: the changes themselves are small, but it is possible that they might cause regressions for GMPs, although I think it is unlikely.

[String/UUID change made/needed]: None

Comment 11

[Bob Owen (:bobowen) PTO until 13th Aug]

Comment on attachment 8551358 [details] [diff] [review]
Part 2: Turn on SEHOP process-level mitigation for the GMP sandbox.

See comment 10.

Comment 12

[Bob Owen (:bobowen) PTO until 13th Aug]

Comment on attachment 8551359 [details] [diff] [review]
Part 3: Turn on HEAP_TERMINATE process-level mitigation for the GMP sandbox.

See comment 10.

Comment 13

[Bob Owen (:bobowen) PTO until 13th Aug]

Comment on attachment 8551360 [details] [diff] [review]
Part 4: Turn on DLL_SEARCH_ORDER process-level mitigation for the GMP sandbox.

See comment 10.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/06da1141e817
https://hg.mozilla.org/releases/mozilla-aurora/rev/cf64f625cd03
https://hg.mozilla.org/releases/mozilla-aurora/rev/004776aa9aa5
https://hg.mozilla.org/releases/mozilla-aurora/rev/7b6674e5a437