1433288 - Coverity is concerned about what we're doing between chroot() and chdir("/")

Status: NEW

(Core :: Security: Process Sandboxing, enhancement, P2)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Coverity has an analysis that checks for function calls that occur after a chroot() and not after a subsequent chdir("/"), at which times the current working directory is probably outside the root directory and it's possible to use relative paths to access files that can't be accessed with absolute paths and presumably aren't meant to be accessible.

This analysis has raised some issues about the chroot code added in bug 1401062.  One of these is a false positive — the first assertion's call to MOZ_ReportAssertionFailure is conditional on the chroot() failing — but there are other calls that do happen during this window.

None of this is harmful (we're not handling untrusted input, and none of this should use filesystem paths anyway), but it would be possible to rearrange things into the form Coverity expects.