1385715 - WebGL doesn't initialize with proprietary Nvidia 375.66 (Linux) on GTX 670M

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Rémi Verschelde]

Attachment: about:support for my system from Nightly 20170730

+++ This bug was initially created as a clone of Bug #1384718 +++

Visiting the following site while using the proprietary Nvidia 375.66 driver on Linux (Mageia 6 x86_64) shows that WebGL 1 and 2 are unavailable in current Nightly.

http://webglreport.com/?v=1

The console says:
Error: WebGL warning: Failed to create WebGL context: WebGL creation failed: * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Error during native OpenGL init. * Exhausted GL driver caps. * Exhausted GL driver options.

It works fine with current ESR and Developer releases.

----

System:
Mageia 6 x86_64
Firefox Nightly 20170730 (should include fix for bug 1384718)
Nvidia GTX 670M with nonfree Nvidia 375.66

Comment 1

[Rémi Verschelde]

(In reply to Rémi Verschelde from comment #0)
> Firefox Nightly 20170730 (should include fix for bug 1384718)

To be precise, I run 20170730100307 which is mentioned as the first release with https://hg.mozilla.org/mozilla-central/rev/00167e9fe0c0 which fixed bug 1384718.

I assume that a similar sandboxing fix is needed for Nvidia drivers.

I am not familiar with debugging Nightly, so please advise necessary debugging steps to perform to provide useful data.

Comment 2

[Gian-Carlo Pascutto [:gcp]]

I'm really surprised by this, as that's the configuration of my main development system and it's worksforme.

Run with export MOZ_SANDBOX_LOGGING=1 and attach the log here please.

Comment 3

[Rémi Verschelde]

Attachment: Nightly/clean profile with MOZ_SANDBOX_LOGGING=1 visiting webglreport.com

Here it is. I ran today's Nightly with a clean user profile, browsed http://webglreport.com/ (first v1 tab, then v2) and closed the browser.

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Is this a system that switches between an iGPU (in the CPU) and the (separate) dGPU? Do you know what software controls the switch?

I see the driver trying to read application profiles and failing. It's not doing that for me, but I suspect that failure isn't fatal. But it's also trying to enumerate the exact hardware in the system, which isn't going to be allowed.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

FYI, you can use the settings in https://wiki.mozilla.org/Security/Sandbox#Customization_Settings to work around this problem. If you find the minimal set that makes WebGL work again, I'd be interested to know, although I'll likely will have to try to replicate your configuration.

The driver trying to enumerate /sys/bus/pci/devices and /proc/modules is a major pain. We will probably need to find out what it's actually looking for.

Comment 6

[Rémi Verschelde]

Attachment: /etc/X11/xorg.conf as configured by mageia-prime-install

Yes, that's an Optimus laptop with an Intel HD 4000 iGPU and a Nvidia GTX 670M dGPU.

It's running fully on the dGPU using Reverse PRIME GPU offloading [0] configured thanks to the mageia-prime (experimental) tool [1] (kinda similar to Ubuntu's nvidia-prime, it tries to automate the configuration of X11 allowing to use Reverse PRIME).

Attached is the corresponding /etc/X11/xorg.conf. nouveau is also disabled via `nouveau.modeset=0` in the grub2 boot command.

[0] http://us.download.nvidia.com/XFree86/Linux-x86/375.66/README/randr14.html
[1] https://github.com/ghibo/mageia-prime

Comment 7

[Rémi Verschelde]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #5)
> FYI, you can use the settings in
> https://wiki.mozilla.org/Security/Sandbox#Customization_Settings to work
> around this problem. If you find the minimal set that makes WebGL work
> again, I'd be interested to know, although I'll likely will have to try to
> replicate your configuration.

Setting security.sandbox.content.level=1 makes WebGL work again. With 2 or 3, it doesn't work.
I did not find the security.sandbox.gpu.level mentioned in the wiki page in my about:config, so couldn't experiment with it.

Comment 8

[Rémi Verschelde]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #5)
> FYI, you can use the settings in
> https://wiki.mozilla.org/Security/Sandbox#Customization_Settings to work
> around this problem. If you find the minimal set that makes WebGL work
> again, I'd be interested to know, although I'll likely will have to try to
> replicate your configuration.

Ah, just saw you pointed me to the whitelisting settings. I'll try to experiment with that.

Comment 9

[Gian-Carlo Pascutto [:gcp]]

(In reply to Rémi Verschelde from comment #7)
> (In reply to Gian-Carlo Pascutto [:gcp] from comment #5)
> > FYI, you can use the settings in
> > https://wiki.mozilla.org/Security/Sandbox#Customization_Settings to work
> > around this problem. If you find the minimal set that makes WebGL work
> > again, I'd be interested to know, although I'll likely will have to try to
> > replicate your configuration.
> 
> Setting security.sandbox.content.level=1 makes WebGL work again. With 2 or
> 3, it doesn't work.

I was referring to the security.sandbox.content.read_path_whitelist setting. 

If you look at the log you provided, there's error messages that the driver can't access things like "/proc/modules", "/home/akien/.nv/nvidia-application-profile-globals-rc" etc.

I suspect adding either /sys/bus/pci/devices and/or /proc/modules to that pref will make it work again (it's a comma separated list). Obviously lowering the sandbox level works too, but that's not what we want :-)

> I did not find the security.sandbox.gpu.level mentioned in the wiki page in
> my about:config, so couldn't experiment with it.

This isn't implemented yet on Linux AFAIK.

Thanks for confirming the configuration, I will probably set up something similar to investigate.

Comment 10

[Rémi Verschelde]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #9)
> I was referring to the security.sandbox.content.read_path_whitelist setting.
> 
> I suspect adding either /sys/bus/pci/devices and/or /proc/modules to that
> pref will make it work again (it's a comma separated list). Obviously
> lowering the sandbox level works too, but that's not what we want :-)

Setting `security.sandbox.content.read_path_whitelist=/proc/modules` is sufficient to make WebGL work again.

Comment 11

[Gian-Carlo Pascutto [:gcp]]

(In reply to Rémi Verschelde from comment #10)
> Setting `security.sandbox.content.read_path_whitelist=/proc/modules` is
> sufficient to make WebGL work again.

Can you attach the contents here?

If that's the only thing it needs, we have some good options. Either just whitelist it for now, or intercept and return only the module(s) it's looking for, if present.

I don't entirely like blanket whitelisting, because /proc/modules gives you the list of drivers that are known to be present in the kernel. That seems like rather useful information for an attacker to have: the kernel is a key path to get out of the sandbox, and buggy drivers are certainly one of the more promising ways to find a hole in it.

Comment 12

[Rémi Verschelde]

Attachment: Contents of /proc/modules

Comment 13

[Gian-Carlo Pascutto [:gcp]]

Attachment: Bug 1385715 - Add support for WebGL on NVIDIA PRIME.

Review commit: https://reviewboard.mozilla.org/r/163812/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/163812/

Comment 14

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8892822 [details]
Bug 1385715 - Add support for WebGL on NVIDIA PRIME.

https://reviewboard.mozilla.org/r/163812/#review169492

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9724d06abb63
Add support for WebGL on NVIDIA PRIME. r=jld

Comment 16

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/9724d06abb63