1290618 - Allow PR_SET_PTRACER in Linux sandbox policies to avoid recursive crash

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-6⟩ ⟦he/him⟧]

Bug 1090598 added a call to prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY) in the crash signal handlers used when the crash reporter is disabled (e.g., desktop debug builds) so that gdb can attach even if the Yama LSM would otherwise prevent that.  Content processes allow all prctl()s for now (although we'd like to restrict that eventually), but GMP processes have a small allowed list and PR_SET_PTRACER isn't on it.

The result is that if a GMP process segfaults (or similar) on Linux with the crash reporter disabled, it will take SIGSYS in the crash handler and the SIGSYS handler will complain and immediately terminate the process, which prevents debugging it.

Adding PR_SET_PTRACER to the policy is simple (and reasonably safe — prctl affects only the calling thread, and we already allow PR_SET_DUMPABLE, which is similar, for the crash reporter).

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-6⟩ ⟦he/him⟧]

…except that even with PR_SET_PTRACER allowed, the process gets immediately killed anyway, because the IPC channel observes an error and is destroyed, for reasons that aren't immediately clear.  But I already have a patch for this problem, so I might as well.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-6⟩ ⟦he/him⟧]

Attachment: bug1290618-allow-ptracer-hg0.diff

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=8c40dd581e79

Comment 3

[Julian Hector [:tedd] [:jhector]]

Comment on attachment 8776732 [details] [diff] [review]
bug1290618-allow-ptracer-hg0.diff

Review of attachment 8776732 [details] [diff] [review]:
-----------------------------------------------------------------

lgtm

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-6⟩ ⟦he/him⟧]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=8c40dd581e79

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0143eed90884
Allow PR_SET_PTRACER in Linux sandbox policies to avoid recursive crash. r=tedd

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0143eed90884

Comment 7

[Chris Pearce [:cpearce (GMT+13)]]

Comment on attachment 8776732 [details] [diff] [review]
bug1290618-allow-ptracer-hg0.diff

Approval Request Comment
[Feature/regressing bug #]: Widevine EME on Linux
[User impact if declined]: Without this patch, debugging the sandbox issues fixed in other uplifts I've just requested is very hard.
[Describe test coverage new/current, TreeHerder]: We have plenty of EME mochitests, which run on Linux inside the sandbox.
[Risks and why]: Low; this is tweaking how the sandbox interacts with debuggers
[String/UUID change made/needed]: None

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8776732 [details] [diff] [review]
bug1290618-allow-ptracer-hg0.diff

Widevine EME on Linux, Aurora50+

Comment 9

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8776732 [details] [diff] [review]
bug1290618-allow-ptracer-hg0.diff

Uplifting Linux Widevine support to beta; this should avoid a crash.

Comment 10

[Chris Pearce [:cpearce (GMT+13)]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5ceb958e95c7

Comment 11

[Chris Pearce [:cpearce (GMT+13)]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5ceb958e95c7

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/c2bf357a1c14e4474ba711d0e1717498381e4bbd