1177594 - Use a USER_RESTRICTED token level on GMP process when integrity levels are available.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Bob Owen (:bobowen)]

There is a possibility that the USER_LOCKDOWN token level could be causing loading problems on platforms other than Win10.

When we are already running at untrusted integrity level, dropping back to the USER_RESTRICTED token level then shouldn't affect the effectiveness of the sandbox and might help with certain problems.

Comment 1

[Bob Owen (:bobowen)]

Attachment: bug1177594.patchUse a USER_RESTRICTED token level on GMP process when integrity levels are available.

Sorry this took a while, I realised that I should really also take out the other part of this, when we're not using the lockdown token level but I'm having trouble testing it here.
Also, I should probably test it on different versions as well, so I'll pick that up in a follow-up.

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 8626386 [details] [diff] [review]
bug1177594.patchUse a USER_RESTRICTED token level on GMP process when integrity levels are available.

Review of attachment 8626386 [details] [diff] [review]:
-----------------------------------------------------------------

We should uplift this to 40; it may be hurting people using EME in the wild.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5fb9272062b9

Comment 4

[Bob Owen (:bobowen)]

Comment on attachment 8626386 [details] [diff] [review]
bug1177594.patchUse a USER_RESTRICTED token level on GMP process when integrity levels are available.

Approval Request Comment
[Feature/regressing bug #]:
USER_LOCKDOWN was originally set for bug 1094370.

[User impact if declined]:
If this is the cause of the issues, then the user will not be able to use the Adobe CDM to play media content.

[Describe test coverage new/current, TreeHerder]:
EME and openh264 have mochitest coverage.

[Risks and why]:
Low: simple patch and this reduces this particular sandbox setting and so shouldn't cause any issues.
In addition this was the original setting that GMP shipped with.

[String/UUID change made/needed]:
None

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5fb9272062b9

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 8626386 [details] [diff] [review]
bug1177594.patchUse a USER_RESTRICTED token level on GMP process when integrity levels are available.

Same request as per comment 4, but for beta 40

Comment 7

[Chris Pearce [:cpearce (Not reading bugmail)]]

[Tracking Requested - why for this release]: We need to get this uplifted so that we can rule it out as a cause of crashes in the EME plugin process.

Comment 8

[Chris Pearce [:cpearce (Not reading bugmail)]]

Beta try push:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=1860489254a1

Comment 9

[Chris Pearce [:cpearce (Not reading bugmail)]]

I must remember to uplift.

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Adding a tracking flag for FF40 and a qe-verify tracking flag so the fix is verified.

Comment 11

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8626386 [details] [diff] [review]
bug1177594.patchUse a USER_RESTRICTED token level on GMP process when integrity levels are available.

Approving for Beta. The try push was clean according to Chris.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Looks like Chris uplifted this.
https://hg.mozilla.org/releases/mozilla-beta/rev/c9af6025b8bc

Comment 13

[Camelia Badau [:cbadau], Desktop Test Engineering]

Is there any proper method to manually verify this? If yes, can you please provide me some steps to do it? Thanks!

Comment 14

[Bob Owen (:bobowen)]

To verify that the setting has taken effect properly, you could use something like sysinternal's process explorer.

* Navigate to http://people.mozilla.org/~cpearce/mse-clearkey/
* In process explorer check the properties (from right-click menu) of the GMP plugin-container.exe process (this will have geckomediaplugin at the end of the command line)
* The security tab should still have the SeChangeNotifyPrivilege enabled

To actually test whether this fixes any CDM loading problems, we'd need to be able to re-produce them, so we'll probably have to rely on monitoring crashes for that.

Comment 15

[Camelia Badau [:cbadau], Desktop Test Engineering]

(In reply to Bob Owen (:bobowen) from comment #14)
> To verify that the setting has taken effect properly, you could use
> something like sysinternal's process explorer.
> 
> * Navigate to http://people.mozilla.org/~cpearce/mse-clearkey/
> * In process explorer check the properties (from right-click menu) of the
> GMP plugin-container.exe process (this will have geckomediaplugin at the end
> of the command line)
> * The security tab should still have the SeChangeNotifyPrivilege enabled
> 
> To actually test whether this fixes any CDM loading problems, we'd need to
> be able to re-produce them, so we'll probably have to rely on monitoring
> crashes for that.

I've verified on Windows 7 64bit using Firefox 40 Beta 2 (buildID: 20150706172413) and Aurora 41.0a2 (buildID: 20150707004003) following your steps and everything is as expected: the security tab have the SeChangeNotifyPrivilege enabled. 

Removing the "qe-verify+" flag since no more manual testing is needed.