1405891 - Block tty ioctls like TIOCSTI in Linux content processes

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

I'd like to eventually restrict ioctl() in Linux content processes with a default-deny policy, but that may need some iteration to deal with breakage in unusual considerations.

However, one thing we can do now is to block tty ioctls, including and especially TIOCSTI, as mentioned in bug 1302711 and CVE-2016-9016.  It's not the worst sandbox escape we have at the time of this writing, but it has a very simple fix with relatively little scope for collateral damage.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Attachment: Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes.

Review commit: https://reviewboard.mozilla.org/r/186664/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/186664/

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8915464 [details]
Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes.

https://reviewboard.mozilla.org/r/186664/#review191930

::: security/sandbox/linux/SandboxFilter.cpp:717
(Diff revision 1)
>      case __NR_readahead:
>  #endif
>        return Allow();
>  
> -    case __NR_ioctl:
> -      // ioctl() is for GL. Remove when GL proxy is implemented.
> +    case __NR_ioctl: {
> +      static const unsigned long kTypeMask = 0xff00;

I'd like a reference here where these magic numbers come from.

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Comment on attachment 8915464 [details]
Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/186664/diff/1-2/

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Comment on attachment 8915464 [details]
Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes.

I changed how the constants are computed, and improved the comment.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8915464 [details]
Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes.

https://reviewboard.mozilla.org/r/186664/#review192350

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb637352a959
Block tty-related ioctl()s in sandboxed content processes. r=gcp

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/fb637352a959