1428175 - Disable SAB in Fennec

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, enhancement)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

Similar to bug 1423225, we need to disable SharedArrayBuffer in Fennec to mitigate fallout from the Meltdown and Spectre exploits.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: patch

Let me know if I should also get review from anyone else.

Comment 2

[Daniel Veditz [:dveditz]]

Does this need to be a hidden bug? We've had a blog post and a security advisory and shipped 57.0.4 with this same fix. IIUI this hotfix would only be needed by folks who hadn't yet updated Fennec itself (app updates are often only enabled when connected via wifi).

Comment 3

[Selena Deckelmann :selenamarie :selena]

We're ready to ship this to Fennec 55 & 56 users. Could either :gchang or :sylvestre get the hotfix process going for this when ready?

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

https://hg.mozilla.org/releases/firefox-hotfixes/rev/0ceaf63e654b562b15f77961cc7f46811bc185b1

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: hotfix-v20180104.01.xpi

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Ioana, could you please help with that? Thanks!

Comment 7

[Ioana Chiorean]

I tried the hotfix on:

- Fennec Nightly 59 
-- changed in about:config the pref xpinstall.signatures.required to false 
-- allow and download the addon 
-- check in about:config the pref javascript.options.shared_memory is changed

- For Fennec 58 and 56 (and all bellow too) (as per Selena's request/commnent) 
-- you get an error message and you are not able to open the addon (with or without pref xpinstall changes)
-- after discussing with Keeler he mentioned we need a signed version for it.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Oh, I didn't realize that it was signed...

Robert, could you please sign it? Thanks (not sure if you are the right person)

Comment 9

[Robert Helmer [:rhelmer]]

(In reply to Sylvestre Ledru [:sylvestre] from comment #8)
> Oh, I didn't realize that it was signed...
> 
> Robert, could you please sign it? Thanks (not sure if you are the right
> person)

I don't have access to sign these, but more importantly Fennec does not support system add-on updates as far as I am aware (bug 1260213)

It may still support the old Hotfix Add-on https://wiki.mozilla.org/Add-ons/Hotfix

Comment 10

[Selena Deckelmann :selenamarie :selena]

(In reply to Robert Helmer [:rhelmer] from comment #9)
> (In reply to Sylvestre Ledru [:sylvestre] from comment #8)
> > Oh, I didn't realize that it was signed...
> > 
> > Robert, could you please sign it? Thanks (not sure if you are the right
> > person)
> 
> I don't have access to sign these, but more importantly Fennec does not
> support system add-on updates as far as I am aware (bug 1260213)
> 
> It may still support the old Hotfix Add-on
> https://wiki.mozilla.org/Add-ons/Hotfix

This is a Hotfix, and is supported by Fennec. The wiki page doesn't mention who can sign these. Do we need someone from the Add-ons team?

Comment 11

[Selena Deckelmann :selenamarie :selena]

Ah, I found https://wiki.mozilla.org/Add-ons/Hotfix#Deployment. Working through it.

Comment 12

[Jorge Villalobos [:jorgev] (he/him)]

I'm trying to stage the hotfix on AMO, but there's a problem: legacy add-ons don't work on 57 and above unless they're signed with the cert that we use for system add-ons. I don't think we created an equivalent exception for the hotfix, so a far as I understand it, the hotfix won't install on 57.

I can force the signing in case it's worth giving it a shot.

Comment 13

[Selena Deckelmann :selenamarie :selena]

(In reply to Jorge Villalobos [:jorgev] from comment #12)
> I'm trying to stage the hotfix on AMO, but there's a problem: legacy add-ons
> don't work on 57 and above unless they're signed with the cert that we use
> for system add-ons. I don't think we created an equivalent exception for the
> hotfix, so a far as I understand it, the hotfix won't install on 57.
> 
> I can force the signing in case it's worth giving it a shot.

That's ok. We only want/need this for 55/56. 57 has the change already shipped.

Comment 14

[Selena Deckelmann :selenamarie :selena]

Hi Keeler,

Turns out that we need maxVersion should be 56.*. Can you make that change? 

Thanks!

Comment 15

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Updated: https://hg.mozilla.org/releases/firefox-hotfixes/rev/b858ef576c7545e333d4b9de7cd707f72304365b

I'll attach the updated xpi shortly.

Comment 16

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: hotfix-v20180104.01.xpi

Comment 17

[Jorge Villalobos [:jorgev] (he/him)]

The new version is now staged on https://addons-dev.allizom.org/android/addon/firefox-hotfix/

Comment 18

[Selena Deckelmann :selenamarie :selena]

Ioana -- Could you please retest? We're only interested in Fennec 55/56 behavior, and that it doesn't work on 57.

Comment 19

[Ioana Chiorean]

Tried with Fennec 55, 55.0.2, 56
- changed in about:config the pref xpinstall.signatures.required to false 
- allow and download the addon
- addon is installed 
- check in about:config the pref javascript.options.shared_memory is changed 

All good here!

Comment 20

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Relman team has review this and it's something we need to do. Once QA sign offs are green, we should be good to go.

Comment 21

[Jorge Villalobos [:jorgev] (he/him)]

Is anything else needed beyond comment #9? I can publish the hotfix as soon as we're good.

Comment 22

[Selena Deckelmann :selenamarie :selena]

(In reply to Jorge Villalobos [:jorgev] from comment #21)
> Is anything else needed beyond comment #9? I can publish the hotfix as soon
> as we're good.

Did you mean a comment 20?

Comment 23

[Jorge Villalobos [:jorgev] (he/him)]

I meant comment #19, since that appeared to cover QA for the staged block.

Comment 24

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

(In reply to Jorge Villalobos [:jorgev] from comment #21)
> Is anything else needed beyond comment #9? I can publish the hotfix as soon
> as we're good.

IF the QA sign offs are good, please go ahead and push this hotfix out. Thanks!

Comment 25

[Jorge Villalobos [:jorgev] (he/him)]

One last thing: the file attached on this bug hasn't been signed. Per https://wiki.mozilla.org/Add-ons/Hotfix#Signatures, the hotfix needs a special signature in order to be automatically updated in Firefox. I don't know if this is also the case for Android.

David, do you know if Firefox for Android also checks for that signature? Wei, can you look into signing the file in comment #16?

Comment 26

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I'm fairly sure Firefox for Android requires hotfixes to be signed (particularly going by comment 19).

Comment 27

[Jason Thomas [:jason]]

Attachment: hotfix-v20180104.01.xpi signed

Please see attached.

Comment 28

[Jorge Villalobos [:jorgev] (he/him)]

The new version of the hotfix is now live.

Comment 29

[James Willcox (:snorp) ([e-mail]) (he/him)]

Whoops, meant to actually comment -- I think we can unhide this bug now since the fix is live and the vulns have been disclosed, etc.