1426733 - Enable restricting SIDs in NPAPI process

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[David Parks [:handyman]]

This can land when bug 1382251 does.

Comment 1

[David Parks [:handyman]]

Attachment: Enable SIDs in NPAPI proc

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cafa6e286cc5
Use restricting SIDs in Windows NPAPI process r=bobowen

Comment 3

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/cafa6e286cc5

Comment 4

[Jim Mathies [:jimm]]

[Tracking Requested - why for this release]:
Adobe is currently testing their fix in thier beta with plans to ship it in September. We will ship our part of the fix in 64 and will likely uplift to 63. We will not ship in 62.  

Note, we shouln't count on the September release by Adobe, sometimes they pull things from release if they find issues in beta.

Comment 5

[Julien Cristau [:jcristau]]

Not sure whether we should be reopening this or tracking re-enabling in a new bug... reopening for now (bug 1450773 made this change nightly-only).

Comment 6

[Jim Mathies [:jimm]]

(In reply to Jim Mathies [:jimm] from comment #4)
> [Tracking Requested - why for this release]:
> Adobe is currently testing their fix in thier beta with plans to ship it in
> September. We will ship our part of the fix in 64 and will likely uplift to
> 63. We will not ship in 62.  
> 
> Note, we shouln't count on the September release by Adobe, sometimes they
> pull things from release if they find issues in beta.

Update on this, Adobe shipped later, so we're now targeting uplift to 63 beta with first landing in 64.

Comment 7

[Julien Cristau [:jcristau]]

ni?self as a reminder to set 64 tracking flag when it's available.

Comment 8

[David Parks [:handyman]]

Attachment: Bug 1426733: Use restricting SIDs in Windows NPAPI process sandbox (r?bobowen)

Allow NPAPI sandbox to use restricting SIDs.  This hardens the plugin sandbox.

Comment 9

[David Parks [:handyman]]

Bob, I just need you to carry over the ancient r+ from Splinter.

Comment 10

[David Parks [:handyman]]

Ooh, just noticed phabricator did that automatically.  Joy.

Comment 11

[David Parks [:handyman]]

Got sidetracked by bug 1498831.  Thanks to Bob for ignoring my last comment and r+ing.  Since 1498831 looks good (no failures in the last 24 hours), I think it is (finally!) time to land this.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9b976167b45a
Use restricting SIDs in Windows NPAPI process sandbox (r=bobowen)

Comment 13

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/9b976167b45a