1285827 - Seccomp sandbox violation: sys_link called in content process of Firefox desktop

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Crash reports show that sys_link is called in the content process:

https://crash-stats.mozilla.com/search/?product=Firefox&reason=~SIGSYS&address=0x56&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

Comment 1

[Julian Hector [:tedd] [:jhector]]

I think we can whitelist this, we already have a bunch of other file system access calls whitelisted. This will probably also be a case that should be handled by the file broker.

:gcp what do you think?

Comment 2

[Gian-Carlo Pascutto [:gcp]]

link() can be treated similarly to open()+write(), I guess.

Comment 3

[Julian Hector [:tedd] [:jhector]]

Attachment: Add sys_link to seccomp whitelist r=gcp

Try push for build: https://treeherder.mozilla.org/#/jobs?repo=try&revision=ee0803ce5d99

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8769781 [details] [diff] [review]
Add sys_link to seccomp whitelist r=gcp

Review of attachment 8769781 [details] [diff] [review]:
-----------------------------------------------------------------

Are we able to send these to the file broker at some point?

Comment 5

[Julian Hector [:tedd] [:jhector]]

Should be possible, all wee need to do is pass two file paths to the parent and somehow that it should create a link. Whitelisting what can be linked where shouldn't be too hard either.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fc03ac81fa1
Add sys_link to seccomp whitelist. r=gcp

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/7fc03ac81fa1

Comment 8

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

The two crash reports currently on file for this both mention libuim-mozc.so, which is a Japanese text input plugin.  If that's the only thing that's trying to link(), and assuming that only the parent process actually needs working text input, we might be able to get away with just denying the link() call instead of brokering it.