1339729 - Removing wow_helper from Windows process sandboxing.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Bob Owen (:bobowen)]

wow_helper was only required on WinXP 64-bit and Vista 64-bit, which we no longer support.

Comment 1

[Bob Owen (:bobowen)]

Attachment: Remove wow_helper from Windows process sandboxing

MozReview-Commit-ID: Bx0mPTEKz3l

Comment 2

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0e1c127c3b8be21f896d5ecdf87d81e7ecc48171

Comment 3

[Mike Hommey [:glandium]]

Comment on attachment 8837477 [details] [diff] [review]
Remove wow_helper from Windows process sandboxing

Review of attachment 8837477 [details] [diff] [review]:
-----------------------------------------------------------------

I guess the chromium sandbox code update removes all the Wow64 stuff under security/sandbox/chromium/sandbox/win (that invokes wow_helper). Either way, that code is essentially dead because it's all behind a runtime windows version check for <= vista.

Comment 4

[Bob Owen (:bobowen)]

(In reply to Mike Hommey [:glandium] from comment #3)
> Comment on attachment 8837477 [details] [diff] [review]
> Remove wow_helper from Windows process sandboxing
> 
> Review of attachment 8837477 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> I guess the chromium sandbox code update removes all the Wow64 stuff under
> security/sandbox/chromium/sandbox/win (that invokes wow_helper). Either way,
> that code is essentially dead because it's all behind a runtime windows
> version check for <= vista.

Yes that patch will remove it, thanks.
I'll land this when I get back.

Comment 5

[Bob Owen (:bobowen)]

I was just about to land this, when I remembered that I think we had to get wow_helper.exe signed and I'm not sure if whatever does that is going to break when I remove this.

glandium - do you know about that or if not know who does?

Comment 6

[Mike Hommey [:glandium]]

I don't know, maybe catlee?

Comment 7

[Chris AtLee [:catlee]]

AFAIK we don't treat this specially. It's signed along with all the other exes and dlls that are generated as part of the build. If it's not produced, it won't be signed, and won't be missed.

Comment 8

[Bob Owen (:bobowen)]

(In reply to Chris AtLee [:catlee] from comment #7)
> AFAIK we don't treat this specially. It's signed along with all the other
> exes and dlls that are generated as part of the build. If it's not produced,
> it won't be signed, and won't be missed.

Thanks.
I think I remember the history now.
This didn't get signed at first because it was a 64-bit binary in the 32-bit build and the signing tool couldn't cope with it.
We thought we would have to special case it, but in the end we switched to using the 64-bit signing tool for all the binaries.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f73f900fab1c
Remove wow_helper from Windows process sandboxing. r=glandium

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f73f900fab1c