1284452 - Seccomp sandbox violation: sys_getrandom called in content process of Firefox desktop

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Inbound test runs into a seccomp violation while calling sys_getrandom: https://treeherder.mozilla.org/logviewer.html#?job_id=31195021&repo=mozilla-inbound#L1878

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_getrandom to seccomp whitelist r=gcp

Try push for build:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=dbb90136a1a1

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8767944 [details] [diff] [review]
Add sys_getrandom to seccomp whitelist r=gcp

Review of attachment 8767944 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/sandbox/linux/SandboxFilter.cpp
@@ +641,1 @@
>  #endif // DESKTOP

I traced the call to Rusts' standard lib. Given that we will be using that on Android too at some point, I think it's better to put it outside the DESKTOP ifdef.

Comment 3

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_getrandom to seccomp whitelist r=gcp

makes sense :gcp, here is the updated patch. I cancelled the previous try run, here is the one with this patch: https://treeherder.mozilla.org/#/jobs?repo=try&revision=4dbf21fcc023

Comment 4

[Gian-Carlo Pascutto [:gcp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bd4db3e235a49de1eaf59e67620220fc7b0ae702
Bug 1284452 - Add sys_getrandom to seccomp whitelist. r=gcp

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/bd4db3e235a4