1432319 - MinGW does not know about Process Mitigation options

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Tom Ritter [:tjr]]

MinGW patch needed; I'll see if I can figure this one out without annoying Jacek though.



 0:03.07 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc: In function ‘bool sandbox::ApplyProcessMitigationsToCurrentProcess(sandbox::MitigationFlags)’:
 0:03.07 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:163:5: error: ‘PROCESS_MITIGATION_DYNAMIC_CODE_POLICY’ was not declared in this scope
 0:03.07      PROCESS_MITIGATION_DYNAMIC_CODE_POLICY policy = {};
 0:03.08      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:164:5: error: ‘policy’ was not declared in this scope
 0:03.08      policy.ProhibitDynamicCode = true;
 0:03.08      ^~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:172:40: error: ‘ProcessDynamicCodePolicy’ was not declared in this scope
 0:03.08      if (!set_process_mitigation_policy(ProcessDynamicCodePolicy, &policy,
 0:03.08                                         ^~~~~~~~~~~~~~~~~~~~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:184:5: error: ‘PROCESS_MITIGATION_FONT_DISABLE_POLICY’ was not declared in this scope
 0:03.08      PROCESS_MITIGATION_FONT_DISABLE_POLICY policy = {};
 0:03.08      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:185:5: error: ‘policy’ was not declared in this scope
 0:03.08      policy.DisableNonSystemFonts = true;
 0:03.08      ^~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:187:40: error: ‘ProcessFontDisablePolicy’ was not declared in this scope
 0:03.08      if (!set_process_mitigation_policy(ProcessFontDisablePolicy, &policy,
 0:03.08                                         ^~~~~~~~~~~~~~~~~~~~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:199:5: error: ‘PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY’ was not declared in this scope
 0:03.08      PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY policy = {};
 0:03.08      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 0:03.08 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:201:5: error: ‘policy’ was not declared in this scope
 0:03.08      policy.MicrosoftSignedOnly = true;
 0:03.08      ^~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:206:40: error: ‘ProcessSignaturePolicy’ was not declared in this scope
 0:03.09      if (!set_process_mitigation_policy(ProcessSignaturePolicy, &policy,
 0:03.09                                         ^~~~~~~~~~~~~~~~~~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:217:5: error: ‘PROCESS_MITIGATION_IMAGE_LOAD_POLICY’ was not declared in this scope
 0:03.09      PROCESS_MITIGATION_IMAGE_LOAD_POLICY policy = {};
 0:03.09      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:219:7: error: ‘policy’ was not declared in this scope
 0:03.09        policy.NoRemoteImages = true;
 0:03.09        ^~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:221:7: error: ‘policy’ was not declared in this scope
 0:03.09        policy.NoLowMandatoryLabelImages = true;
 0:03.09        ^~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:225:7: error: ‘policy’ was not declared in this scope
 0:03.09        policy.PreferSystem32Images = true;
 0:03.09        ^~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:228:40: error: ‘ProcessImageLoadPolicy’ was not declared in this scope
 0:03.09      if (!set_process_mitigation_policy(ProcessImageLoadPolicy, &policy,
 0:03.09                                         ^~~~~~~~~~~~~~~~~~~~~~
 0:03.09 /home/tom/Documents/moz/mingw-work/sandbox/security/sandbox/chromium/sandbox/win/src/process_mitigations.cc:228:65: error: ‘policy’ was not declared in this scope
 0:03.11      if (!set_process_mitigation_policy(ProcessImageLoadPolicy, &policy,

Comment 1

[Tom Ritter [:tjr]]

Sent something upstream

Comment 2

[Tom Ritter [:tjr]]

Attachment: Bug 1432319 Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox

Review commit: https://reviewboard.mozilla.org/r/215310/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/215310/

Comment 3

[Tom Ritter [:tjr]]

Comment on attachment 8945083 [details]
Bug 1432319 Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/215310/diff/1-2/

Comment 4

[Nathan Froyd [:froydnj]]

Comment on attachment 8945083 [details]
Bug 1432319 Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox

https://reviewboard.mozilla.org/r/215310/#review221464

Comment 5

[Mozilla Autoland]

We're sorry, Autoland could not rebase your commits for you automatically. Please manually rebase your commits and try again.

hg error in cmd: hg rebase -s 09beab1df0d1600dff51980565b08bfc4e293e15 -d 89f1698c5ca5: rebasing 444232:09beab1df0d1 "Bug 1432319 Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox r=froydnj" (tip)
merging taskcluster/scripts/misc/build-gcc-mingw32.sh
warning: conflicts while merging taskcluster/scripts/misc/build-gcc-mingw32.sh! (edit, then use 'hg resolve --mark')
unresolved conflicts (see hg resolve, then hg rebase --continue)

Comment 6

[Tom Ritter [:tjr]]

Comment on attachment 8945083 [details]
Bug 1432319 Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/215310/diff/2-3/

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b0c53432cc82
Bump MinGW version to incorporate Process Mitigation structs needed by the sandbox r=froydnj

Comment 8

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/b0c53432cc82