1403230 - Block WRusr.dll in child processes that use alternate desktop.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Bob Owen (:bobowen)]

This is part of an initial fix to the issues found in bug 1400637.

Those problems arise because of some interaction between using alternate desktop and some anti-virus.

This bug is going to use the chromium sandbox DLL blocking mechanism to block WRusr.dll (from Webroot SecureAnywhere) in children using alternate desktop.

We may have to add other DLLs, in which case we'll probably make the code more sophisticated.

Comment 1

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5dbea1030fec70862df5036bbe9abbd183222f70

Comment 2

[Bob Owen (:bobowen)]

Attachment: Block WRusr.dll in child processes when using Alternate Desktop

Comment 3

[Jim Mathies [:jimm]]

Comment on attachment 8912300 [details] [diff] [review]
Block WRusr.dll in child processes when using Alternate Desktop

Review of attachment 8912300 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ +27,5 @@
>  #include "sandbox/win/src/sandbox.h"
>  #include "sandbox/win/src/security_level.h"
>  #include "WinUtils.h"
>  
> +#define WEBROOT_DLL L"WRusr.dll"

lets add a comment here explaining this, and a note we plan to improve this as we add files to the list.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fa27d9bd71e6
Block WRusr.dll in child processes when using Alternate Desktop. r=jimm

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fa27d9bd71e6