1275781 - Seccomp sandbox violation: sys_accept called in content process of Firefox desktop

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Attachment: Try server raw log excerpt

Running tests on try with seccomp enabled [1] hit a seccomp violation by using sys_accept()

[1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=b74081e971fd&selectedJob=21341876

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_accept to seccomp whitelist

Comment 2

[Julian Hector [:tedd] [:jhector]]

For now, in order to get seccomp enabled on nightly, I think we should whitelist this and try to figure out later how we can reduce the system calls for the socket API.

Comment 3

[Julian Hector [:tedd] [:jhector]]

Try push for build: https://treeherder.mozilla.org/#/jobs?repo=try&revision=779186042f6f

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

It looks like this was caused by a test that runs httpd.js in a content process, but only because it needs a custom httpd to run *somewhere*, and it wasn't written with sandboxed e10s in mind.  (It also can't ever have worked on B2G.)  There should be a followup bug for that.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/25abbc9e6237
Add sys_accept to seccomp whitelist. r=jld

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/25abbc9e6237