1296309 - Remove unused syscalls from the seccomp whitelist

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

During triage of the syscall list, we found a few syscalls that are currently whitelisted (presumably B2G heritage) but where it's not clear why the content process would need those. Some preliminary testing shows Firefox is functional when they're blocked. We should try removing them and seeing if this causes breakage in the field (at which point we'll know what uses them).

Comment 1

[Gian-Carlo Pascutto [:gcp]]

The syscalls in question are: utimes umask wait4

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Attachment: Bug 1296309 - Remove unused syscalls from the seccomp whitelist.

Review commit: https://reviewboard.mozilla.org/r/72638/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/72638/

Comment 3

[Julian Hector [:tedd] [:jhector]]

Comment on attachment 8782472 [details]
Bug 1296309 - Remove unused syscalls from the seccomp whitelist.

https://reviewboard.mozilla.org/r/72638/#review70450

Ok let's see if this breaks anything. lgtm

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7239d050d65f
Remove unused syscalls from the seccomp whitelist. r=tedd

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7239d050d65f

Comment 6

[Julian Hector [:tedd] [:jhector]]

I think we need to back this patch out, there have been crash reports coming in due to missing these system calls in the whitelist.

PulseAudio is the main issue regarding sys_umask, apparently umask is called before mkdir, seen here [1]

Regarding the other system calls, the crash reports stack trace doesn't look too promising.

[1] https://github.com/pulseaudio/pulseaudio/blob/master/src/pulsecore/core-util.c#L275

Comment 7

[Gian-Carlo Pascutto [:gcp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1a6361b000fcb97f941e4091001e88be0e46927f
Bug 1296309 - Return umask (PulseAudio) and wait4 (threads) to the whitelist. r=tedd

Comment 8

[Gian-Carlo Pascutto [:gcp]]

r+ over IRC. 

utimes() only occured in a GMP, not content process, crash, so it can stay.

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1a6361b000fc