1312678 - WebGL falls back to software-rendering on linux/radeonsi (and any other driver that uses DRI)

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Clemens Eisserer]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161020152750

Steps to reproduce:

WebGL falls back to extremly slow software rendering with nightly on linux for radeon GPUs running the "radeonsi" open-source driver.

On the console, the following lines are logged:
    libGL error: failed to open drm device: Permission denied
    libGL error: failed to load driver: radeonsi

On the same machine, the Firefox 49 works flawless.

Comment 1

[Adrian Florinescu [:aflorinescu]]

Clemens would you try to find a regression range maybe using Mozregression? (http://mozilla.github.io/mozregression/)

Comment 2

[Clemens Eisserer]

According to mozregression this was introduced by: 
https://bugzilla.mozilla.org/show_bug.cgi?id=1289718

Makes perfect sense, that security stuff intercepts files the radeon driver needs to access.
The whole idea of intercepting file access sounds a bit like a maintenance nightmare.

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

This looks like the same problem as bug 1312894.  Running with MOZ_SANDBOX_VERBOSE set in the environment would show the filename it's trying to open.

Comment 4

[6lobe]

Attachment: Sandbox log

Attached a log from MOZ_SANDBOX_VERBOSE.

Comment 5

[Clemens Eisserer]

Bug 1312894 actually seems to deal with two different issues:
- failure to initialize an accalerated GL context, leading to ...
- a crash in je_free, caused by LLVM issues

Comment 6

[Adrian Florinescu [:aflorinescu]]

This seems the same error as the one from https://bugzilla.mozilla.org/show_bug.cgi?id=1312894#c9 :

Sandbox: SandboxBroker: denied op=0 rflags=2000002 perms=3 path=/dev/dri/card0 for pid=7505 error="No such file or directory"
Sandbox: Rejected errno -13 op 0 flags 02000002 path /dev/dri/card0

Jed, do you think that we should dupe over 1312894? I don't see two issues in 1312894 as Clemens suggested in Comment5.

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Attachment: Bug 1312678 - Whitelist DRI drivers in the content sandbox, for WebGL.

Review commit: https://reviewboard.mozilla.org/r/90142/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/90142/

Comment 9

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8806846 [details]
Bug 1312678 - Whitelist DRI drivers in the content sandbox, for WebGL.

https://reviewboard.mozilla.org/r/90142/#review89862

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f9e1ac583906
Whitelist DRI drivers in the content sandbox, for WebGL. r=jld

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f9e1ac583906