1199051 - Can we not whitelist all of NS_GRE_DIR in sandboxed content processes?

Status: NEW

(Core :: Security: Process Sandboxing, defect, P3)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

For bug 930258 I'm going to allow read access to all files under NS_GRE_DIR (/system/b2g on B2G) if nobody complains too loudly.  This is, of course, not ideal for keeping the whitelist minimal, but it can be reduced later.

Specific things known to be read from there currently:

* NSS libraries, dynamically loaded when content uses WebRTC or cryptography APIs.
* Web apps on B2G, sometimes (but bug 1119692 will change that).
* Data for reftests.
* Speech recognition models, which were added earlier this year.
* Any loaded ELF object, when profiling; see bug 1198515

But there's a larger question of policy: currently Gecko developers have been able to open arbitrary files in NS_GRE_DIR from content-process code, and it's hard to argue that it's inherently a security problem.  But if we change it to a specific whitelist, then Gecko developers adding new features — like the speech recognition example, above — will need to know to update that whitelist, or else get mysterious failures that don't make sense in terms of the OS's normal permission model.  (And for the time being this is only B2G — desktop platforms won't be in a position to impose this kind of restriction until 1196384 is resolved — so testing on desktop won't show any problems.)

So that's not really ideal — but is it worse than any other part of the filesystem that's not getting a blanket exemption (e.g., /proc/self)?  I'm not sure, but the immediate goal is to get bug 930258 landed and clean up the details later.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Jed Davis [:jld] from comment #0)
> * Web apps on B2G, sometimes (but bug 1119692 will change that).

s/will change/has changed/.  We shouldn't need to open /system/b2g/webapps in content processes anymore.

Comment 2

[Julian Hector [:tedd] [:jhector]]

Moving to sblc3 which concludes removing/restricting file system access.

Comment 3

[Jim Mathies [:jimm]]

https://dxr.mozilla.org/mozilla-central/rev/52285ea5e54c73d3ed824544cef2ee3f195f05e6/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp#186