1408438 - Remove O_ASYNC from Linux sandbox file broker allowed flags

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P3)

Description

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

We intend for the sandbox to prevent the use of the file flag O_ASYNC, which sends signals when I/O is possible, but it's an allowed flag for opening files via the broker.  This oversight should be corrected; we've already blocked FIOASYNC in bug 1405891 and plan to block O_ASYNC in bug 1328896.

The open(2) man page's BUGS section notes that O_ASYNC doesn't work unless it's set via fcntl(2), and a look at the kernel source seems to confirm this, but it's considered a bug and therefore may eventually be fixed. 

Also, this probably isn't weaponizable once bug 1328896 blocks F_SETOWN — the documentation isn't optimally clear, but the default is no owner and setting O_ASYNC doesn't appear to change that.

So this is a minor issue, but it's also a one-line fix.

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

Attachment: Bug 1408438 - Remove O_ASYNC from Linux sandbox file broker allowed flags.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2c7ad3e171d6
Remove O_ASYNC from Linux sandbox file broker allowed flags. r=gcp

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/2c7ad3e171d6