1141906 - Soften assertion failures in Linux SandboxInfo (and maybe elsewhere in sandbox code)

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

The Linux sandboxing code has a few MOZ_CRASH()es that I think should be weakened to MOZ_DIAGNOSTIC_ASSERT().  This includes, but may not be limited to, the ones about how syscalls do/don't fail in SandboxInfo (see also bug 1137007 comment #10).

The general idea here is that — on release builds — the worst the sandboxing code should be able to do in response to deficiencies in the kernel is disable sandboxing support, and possibly dependent functionality along with it (e.g., GeckoMediaPlugin).

It probably won't always be as clear-cut as that, but if there's something reasonable that can be done instead of crashing (and isn't insecure), release builds probably should.

Debug builds should still have all the assertions; and as for non-debug Nightly and Aurora builds, the comment on MOZ_DIAGNOSTIC_ASSERT's definition about “potentially rare enough to require real user testing” seems to me to be applicable here.  Those of us who use those builds for our regular browsing have accepted a certain risk of needing to file bugs.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: bug1141906-sandinfo-less-assertive-hg0.diff

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5b803b09f94c

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a648afebfadf

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a648afebfadf

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/a648afebfadf