Closed Bug 1411379 Opened 2 years ago Closed 2 years ago

Flash needs access to certain registry entries for update notifications

Categories

(Core :: Security: Process Sandboxing, enhancement, P2)

x86_64
Windows
enhancement

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox58 --- affected

People

(Reporter: jimm, Assigned: handyman)

Details

(Whiteboard: sb+)

Attachments

(1 file)

Report from adobe that these locations are inaccessible and this interferes with a software update notification feature built into flash.

HKEY_CURRENT_USER\Software\Macromedia\FlashPlayerUpdate
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
David, can we whitelist this? Also, is registry access generally blocked by the 64-bit sandbox?
Flags: needinfo?(davidp99)
Priority: -- → P2
Do they need read and write, or just read?
Jimm confirmed off-line that they want read-write access.
Assignee: nobody → davidp99
Flags: needinfo?(davidp99)
Attachment #8921623 - Flags: review?(bobowencode)
Comment on attachment 8921623 [details] [diff] [review]
Give Flash access to needed reg keys

Review of attachment 8921623 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ +834,5 @@
> +                         "With these static arguments AddRule should never fail, what happened?");
> +
> +  result = mPolicy->AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
> +                            sandbox::TargetPolicy::REG_ALLOW_ANY,
> +                            L"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce");

I have to say I'm a very nervous about giving read/write access to this, presumably this means a compromised process could run anything that is already on the disk at next startup (IIRC).
On linux on my laptop at the moment. Not sure how easy it is to pass parameters and manipulate this, I think we need to look into that before we grant this.
Comment on attachment 8921623 [details] [diff] [review]
Give Flash access to needed reg keys

I didn't catch that -- the key is dangerous.  I'd prefer to add an NPN API for Adobe to call or something like that.  Needs additional thought.
Attachment #8921623 - Flags: review?(bobowencode)
Let me ask them. Should hear back later in the day.
Whiteboard: sb+
Whiteboard: sb+ → sb?
Whiteboard: sb? → sb+
We decided we would not support this.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.