1285769 - Seccomp sandbox violation: sys_get_mempolicy called in content process of Firefox desktop

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Crash reports show that sys_get_mempolicy is called from the content process:

https://crash-stats.mozilla.com/search/?product=Firefox&reason=~SIGSYS&address=0xef&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

Comment 1

[Gian-Carlo Pascutto [:gcp]]

This is used by ffmpeg / libavcodec to decide the thread pool strategy for H264/H265 decoding.

It's harmless but on the other hand it's also pointless attack surface.

Comment 2

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_get_mempolicy to seccomp whitelist. r=gcp

Try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=c6f75781c4fc

Comment 3

[Julian Hector [:tedd] [:jhector]]

Try in Comment 2.

Please check-in after Bug 1285770 (to avoid merge conflicts)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c941e8a13954
Add sys_get_mempolicy to seccomp whitelist. r=gcp

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c941e8a13954