1323188 - Running Firefox from some network drives fails with an initial restricted access token

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Bob Owen (:bobowen)]

+++ This bug was initially created as a clone of Bug #1321256 +++

If people are going to be able to continue to run Firefox from a network drive as we make the policy stronger, then we need a fix for bug 1321256 for restricted tokens as well.
Either that or we could possibly just use deny only SIDs and not retricted SIDs.

Comment 1

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9fc785fe2aec29ddfb587b5fe3f205f0a9a36481

Comment 2

[Bob Owen (:bobowen)]

Attachment: Don't use restricting SIDs in the sandbox access tokens when running from a network drive

Comment 3

[Jim Mathies [:jimm]]

Comment on attachment 8875429 [details] [diff] [review]
Don't use restricting SIDs in the sandbox access tokens when running from a network drive

Review of attachment 8875429 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/sandbox/chromium/sandbox/win/src/restricted_token.cc
@@ +42,5 @@
>  }  // namespace
>  
>  namespace sandbox {
>  
> +bool gUseRestricting = true;

comment me plz

::: security/sandbox/win/SandboxInitialization.cpp
@@ +82,5 @@
> +void
> +NetworkDriveCheck()
> +{
> +  wchar_t exePath[MAX_PATH];
> +  GetModuleFileNameW(nullptr, exePath, MAX_PATH);

Lets check the return result here before we drop exePath into GetVolumePathNameW. Alternatively init the buffer maybe, but I'd bet that would be slower.

Comment 4

[Bob Owen (:bobowen)]

(In reply to Jim Mathies [:jimm] from comment #3)
> Comment on attachment 8875429 [details] [diff] [review]
> Don't use restricting SIDs in the sandbox access tokens when running from a
> network drive
...
> > +  wchar_t exePath[MAX_PATH];
> > +  GetModuleFileNameW(nullptr, exePath, MAX_PATH);
> 
> Lets check the return result here before we drop exePath into
> GetVolumePathNameW. Alternatively init the buffer maybe, but I'd bet that
> would be slower.

Yeah, don't know how I missed that, thanks.
Check added locally

Comment 5

[Bob Owen (:bobowen)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d17ac655cc513f8d22c5b0f41fce966756b08bfd
Bug 1323188: Don't use restricting SIDs in the sandbox access tokens when running from a network drive. r=jimm

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d17ac655cc51