1308851 - WebGL on NVIDIA's proprietary driver is blocked by seccomp-bpf policy

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

https://bugzilla.mozilla.org/show_bug.cgi?id=1289718#c63
https://bugzilla.mozilla.org/show_bug.cgi?id=1296345#c2

Driver Version	4.5.0 NVIDIA 370.28 on OS: Linux 4.7.7-1-MANJARO

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Could it be the reason why some WebGL demos are failing in recent Nightlies? This is in particular affecting some WebAssembly demos like http://webassembly.github.io/demo, which we would like to keep up and running for all the Firefox Nightly users (webassembly is enabled only on nightly, which is the most popular demo we're all advertising).

If I understand correctly comments linked in comment 0, this is linux only, at least?

Comment 2

[Gian-Carlo Pascutto [:gcp]]

This is Linux only, and depends on the specific driver.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Thanks. Is there a way to disable it dynamically, for testing purposes?

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Also, when you say "this specific driver", do you mean all the binary drivers provided by nvidia? I'm using 4.5.0 NVIDIA 352.63 (linux too), fwiw.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

(In reply to Benjamin Bouvier [:bbouvier] from comment #3)
> Thanks. Is there a way to disable it dynamically, for testing purposes?

Read the announcement posted a few days ago in moz.dev.platform, "Linux content sandbox tightened".

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Sandbox: SandboxBroker: denied op=0 rflags=0 perms=0 path=/etc/nvidia/nvidia-application-profiles-rc.d/ for pid=31884 error="No such file or directory"
Sandbox: SandboxBroker: denied op=0 rflags=0 perms=0 path=/etc/nvidia/nvidia-application-profiles-rc.d/ for pid=31884 error="No such file or directory"
Sandbox: SandboxBroker: denied op=0 rflags=2 perms=3 path=/dev/nvidiactl for pid=31884 error="No such file or directory"

The /etc access should be harmless, I don't actually have this file.

It's trying to write directly to that /dev/nvidiactl device from the content process. I guess we'll have to whitelist this until the gfx people get more stuff into a separate process.

Comment 7

[Gian-Carlo Pascutto [:gcp]]

There's more:

Sandbox: SandboxBroker: denied op=0 rflags=2000002 perms=3 path=/dev/nvidia-modeset for pid=6540 error="No such file or directory"
Sandbox: SandboxBroker: denied op=0 rflags=2 perms=3 path=/dev/nvidia-modeset for pid=6540 error="No such file or directory"
Sandbox: SandboxBroker: denied op=0 rflags=2 perms=3 path=/dev/nvidia0 for pid=6540 error="No such file or directory"

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Sandbox: SandboxBroker: denied op=6 rflags=777 perms=3 path=/tmp for pid=13407 error="No such file or directory"
Sandbox: SandboxBroker: denied op=6 rflags=777 perms=3 path=/home for pid=13407 error="No such file or directory"
Sandbox: SandboxBroker: denied op=2 rflags=0 perms=0 path=/home/morbo/.nv/ for pid=13407 error="No such file or directory"
Sandbox: SandboxBroker: denied op=6 rflags=700 perms=0 path=/home/morbo/.nv/ for pid=13407 error="No such file or directory"

These don't seem to be required to get WebGL to work. Two questions though:

a) Why it's trying to create /tmp even though it already exists - it shouldn't be doing that in the first place. This might confuse the driver.
b) What it's trying to store in ~/.nv. We might be breaking shader caches or something like that, IIRC we have similar problems on Windows.

Comment 9

[Gian-Carlo Pascutto [:gcp]]

Attachment: Bug 1308851 - Open up devices for NVIDIA proprietary driver in the sandbox.

Review commit: https://reviewboard.mozilla.org/r/84636/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84636/

Comment 10

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8799466 [details]
Bug 1308851 - Open up devices for NVIDIA proprietary driver in the sandbox.

https://reviewboard.mozilla.org/r/84636/#review83238

::: security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp:143
(Diff revision 1)
>    }
> +
> +  // Bug 1308851: NVIDIA proprietary driver when using WebGL
> +  policy->AddPath(rdwr, "/dev/nvidiactl");
> +  policy->AddPath(rdwr, "/dev/nvidia-modeset");
> +  policy->AddPath(rdwr, "/dev/nvidia0");

Would this (`nvidia0`) work as intended on multi-GPU systems?  (Is that even a thing that people would run Firefox on?  I don't actually know.)  AddPrefix might help.

Comment 11

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8799466 [details]
Bug 1308851 - Open up devices for NVIDIA proprietary driver in the sandbox.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/84636/diff/1-2/

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/510cf5f0ecca
Open up devices for NVIDIA proprietary driver in the sandbox. r=jld

Comment 13

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/510cf5f0ecca