1284588 - OS X: Disable content process write access to user files in the home directory

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Haik Aftandilian [:haik]]

This bug is for the changes required to disable write access to user files in the home directory from the content process on macOS.

With this bug, the intent is not to remove all write access to the home directory, but everything outside of some specific directories within ~/Library. Within ~/Library, the content process uses write access to NS_APP_CONTENT_PROCESS_TEMP_DIR and some addons write to files within the Firefox profile directory. Access to those directories (which are within ~/Library) will be removed in follow-up work.

Comment 1

[Haik Aftandilian [:haik]]

Attachment: WIP patch that disable write access to the majority of the home directory, not ready for review

This disables content process write access to most of the home directory. I'm using it for testing. Until 1228022 is fixed, this will break printing to file.

Comment 3

[Haik Aftandilian [:haik]]

Attachment: Bug 1284588 - OS X: Disable content process write access to user files in the home directory;

Changes the semantics of the security.sandbox.content.level pref on OS X with
respect to file access to the user's home directory. With the fix, Nightly
defaults to 2 while other releases will default to 1. The level values now
have the following meaning.

*) security.sandbox.content.level=0 disables content process sandboxing.
No change here.

*) security.sandbox.content.level=1 blocks write access to the majority of the
home directory.

*) security.sandbox.content.level=2 includes the write access blocking in
level 1, but also blocks both read and write access to ~/Library and $PROFILE
excluding the extensions and weave subdirectories.

Prior to this fix, Nightly defaulted to a value of 1 while all other releases
used 0. The value of 1 meant that read/write access to ~/Library and the
$PROFILE dir (excluding $PROFILE/{extensions,weave}) was prevented.

The strength of a level=1 sandbox is reduced by this with fix,
but level=1 becomes the first ride-the-trains content sandbox candidate,
Nightly changes to level=2, and higher levels still indicate a more
restrictive sandbox.

Review commit: https://reviewboard.mozilla.org/r/80214/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/80214/

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8793534 [details]
Bug 1284588 - OS X: Disable content process write access to user files in the home directory;

https://reviewboard.mozilla.org/r/80214/#review79124

Comment 5

[Haik Aftandilian [:haik]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=52687050b0e9f289c1a0822ed1b127e1e08b0b69

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Looks like autoland couldn't rebase this patch for landing.

Comment 7

[Haik Aftandilian [:haik]]

Sorry about that. It applied cleanly in my repo. I'll update reviewboard and reflag this checkin-needed.

Comment 8

[Haik Aftandilian [:haik]]

Comment on attachment 8793534 [details]
Bug 1284588 - OS X: Disable content process write access to user files in the home directory;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/80214/diff/1-2/

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1e8a7c6dcea1
OS X: Disable content process write access to user files in the home directory; r=gcp

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for leaks in browser-chrome tests on OS X 10.10 debug:

https://hg.mozilla.org/integration/autoland/rev/b1ed83464642

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=1e8a7c6dcea1d73db0da4c61b2dfe4b4cbaec79f
More tests tun and failed for https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=735ae776c393e7c2f7c9d64a12a61b5f7689a583
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=3992627&repo=autoland

02:41:44  WARNING -  TEST-UNEXPECTED-FAIL | leakcheck | tab process: missing output line for total leaks!
02:41:44     INFO -  TEST-INFO | leakcheck | missing output line from log file /var/folders/f6/kjqp0l7n7cb307nv1hq0lrf400000w/T/tmpgFyenB.mozrunner/runtests_leaks_tab_pid1975.log

Comment 11

[Haik Aftandilian [:haik]]

Didn't mean to clear the needinfo. I'm trying to determine if this change is causing the "leakcheck | missing output line from log file ..." failure or if these are just instances of bug 1281306. This fix shouldn't affect JS object allocation/dealloc and shouldn't affect content processes ability to write to /var.

Comment 12

[Haik Aftandilian [:haik]]

Comment on attachment 8793534 [details]
Bug 1284588 - OS X: Disable content process write access to user files in the home directory;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/80214/diff/2-3/

Comment 13

[Haik Aftandilian [:haik]]

The leakcheck "missing output line for total leaks" failures were caused by my fix for this bug.

I couldn't reproduce the failures locally by running individual tests, but I could reproduce them reliably with "./mach test toolkit/content/tests/browser/" in debug.

The issue is that my changes blocked all write access to the filesystem from the content process (apart from the content temp dir and a few /var subdirectories), this breaks the leakcheck because it writes to a file in /var from the content process. This is in the OS X $TMPDIR and here's an example of the path which is per-OSX-user.

  /var/folders/46/188abcdeadfadfadfadfrgsnx2m0000gn/T/tmp1Txao8.mozrunner/runtests_leaks_tab_pid<PID>.log

I'll update the fix to not limit write-blocking to the home directory and file a bug on our tests writing to the filesystem from the content process. Writing to $TMPDIR is a reasonable place to write to, but our long term goal is to eventually prevent all filesystem I/O by the content process.

Comment 14

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8793534 [details]
Bug 1284588 - OS X: Disable content process write access to user files in the home directory;

https://reviewboard.mozilla.org/r/80214/#review80314

As discussed on IRC, we can follow up with another bug/patch to disable write except in the OS TMPDIR.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cde8b9afb577
OS X: Disable content process write access to user files in the home directory; r=gcp

Comment 16

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cde8b9afb577