1382442 - GConf / ORBit calls bind() in content processes

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P3)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

I'm seeing some Nightly crash reports where GConf/ORBit is trying to call bind().  I don't understand why it would be acting as a server when it's just trying to read a preference value (this seems to be, once again, nsProtocolProxyService), but maybe that's just how ORBit works.

Maybe it's time to just deal with nsProtocolProxyService and then make nsGConfService fail to start in content processes.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Bug 1382442 - Don't try to use GConf in content processes.

GConf uses ORBit, which tries to create server sockets, which has been
disallowed by the content sandbox seccomp-bpf policy since 55 (bug
1358647).  GConf is considered obsolete and hasn't been updated since
2013.  This patch disables the use of GConf in content processes, on the
assumption that anything that this would break is already broken by
rejecting the system call.

The one use case that's believed to be broken is using WebRTC behind a
mandatory proxy and using system preferences (rather than Firefox's) for
the proxy config.  WebRTC uses nsIProtocolProxyService in the content
process, so if this combination of things is done on a system with GConf,
it will not be able to read the system prefs.

The larger use case of WebRTC + GConf (with or without a proxy) will
crash on Nightly without this patch, because rejected syscalls produce
crashes in order to gather more diagnostic information.

Review commit: https://reviewboard.mozilla.org/r/172404/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/172404/

Comment 3

[Nils Ohlmeier [:drno]]

Comment on attachment 8900952 [details]
Bug 1382442 - Don't try to use GConf in content processes.

https://reviewboard.mozilla.org/r/172404/#review177776

As the WebRTC proxy support is probably mostly used in corporate environments I would be surprised if disabling this feature will result in problems (I'm assuming that not many corporate users are using Linux).

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8900952 [details]
Bug 1382442 - Don't try to use GConf in content processes.

https://reviewboard.mozilla.org/r/172404/#review179530

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7cec07add03a
Don't try to use GConf in content processes. r=drno,gcp

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7cec07add03a