1525086 - [Mac] Start the RDD sandbox earlier

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Haik Aftandilian [:haik]]

+++ This bug was initially created as a clone of Bug #1498742 +++

Like with bug 1431441 which applied to the Mac sandbox for content processes, we should start the RDD sandbox early during process startup and unify the code with the content sandbox as much as possible.

Comment 1

[Haik Aftandilian [:haik]]

In testing so far, starting the RDD sandbox earlier allows us to drop the connection to the windowserver and coreservices, but it breaks setting the process name resulting in Activity Monitor showing the process as "plugin-container". I've filed bug 1529390 to rename Mac content processes. For now, I'm working on code changes to start the sandbox earlier while still allowing access to the services needed to set the process name.

Comment 2

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 1 - Split up sandbox policies, create utility policy for the RDD process r?Alex_Gaynor

Move sandbox policies for different process types into their own files.

Create a new "utility" policy cloned from the GMP policy to be used for basic utility-type processes.

Use the utility policy for the RDD process.

Comment 3

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 2 - Remove unneeded params and permissions from the utility sandbox r?Alex_Gaynor

Remove the unused plugin binary path and app binary path parameters and cleanup file path permissions.

Explicitly allow access to launchservicesd to allow SetProcessName() to work when the sandbox is started during startup.

Depends on D22405

Comment 4

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 3a - Move sandbox param logic to GeckoChildProcessHost and MacSandboxInfo to be more reusable r?Alex_Gaynor

Start the RDD process earlier by changing RDDProcessHost to pass the necessary command line arguments for enabling the sandbox.

Per lsmp output on 10.14.3, starting the RDD process sandbox removes access to WindowServer, coreservicesd, lsd and distnoted.

Add a pref (defaulting to on) to control enabling starting the RDD process earlier.

Move sandbox CLI param logic into MacSandboxInfo.

Depends on D22408

Comment 5

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 4 - Cache the result of nsMacUtilsImpl::GetAppPath r?Alex_Gaynor

Cache the result of nsMacUtilsImpl::GetAppPath() to avoid doing I/O on repeated calls.

Depends on D22409

Comment 6

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 5 - Update ContentParent to use new MacSandboxInfo param methods r?Alex_Gaynor

Use the new MacSandboxInfo CLI param methods to setup the content process command line arguments.

Depends on D22410

Comment 7

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 6 - Use AssertMacSandboxEnabled() for the RDD process, change the assert to use sandbox_check() r?Alex_Gaynor

When the RDD process sandbox is started at launch, assert the sandbox has been enabled in the Init message.

Change AssertMacSandboxEnabled() to use the undocumented sandbox_check() function instead of sandbox_init().

Depends on D22411

Comment 8

[Haik Aftandilian [:haik]]

Attachment: Bug 1525086 - Part 3b - Start the RDD sandbox earlier r?Alex_Gaynor

Start the RDD process earlier by changing RDDProcessHost to pass the necessary command line arguments for enabling the sandbox.

Per lsmp output on 10.14.3, starting the RDD process sandbox removes access to WindowServer, coreservicesd, lsd and distnoted.

Add a pref (defaulting to on) to control enabling starting the RDD process earlier.

Depends on D22409

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c6dfbf1662d
Part 1 - Split up sandbox policies, create utility policy for the RDD process r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/4fc01165236c
Part 2 - Remove unneeded params and permissions from the utility sandbox r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/49a9f3abb9a9
Part 3a - Move sandbox param logic to GeckoChildProcessHost and MacSandboxInfo to be more reusable r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/08e70a4f1768
Part 3b - Start the RDD sandbox earlier r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/0e5f0e49adac
Part 4 - Cache the result of nsMacUtilsImpl::GetAppPath r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/beca0789c9df
Part 5 - Update ContentParent to use new MacSandboxInfo param methods r=Alex_Gaynor
https://hg.mozilla.org/integration/autoland/rev/c83b5d6e0777
Part 6 - Use AssertMacSandboxEnabled() for the RDD process, change the assert to use sandbox_check() r=Alex_Gaynor

Comment 10

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/4c6dfbf1662d
https://hg.mozilla.org/mozilla-central/rev/4fc01165236c
https://hg.mozilla.org/mozilla-central/rev/49a9f3abb9a9
https://hg.mozilla.org/mozilla-central/rev/08e70a4f1768
https://hg.mozilla.org/mozilla-central/rev/0e5f0e49adac
https://hg.mozilla.org/mozilla-central/rev/beca0789c9df
https://hg.mozilla.org/mozilla-central/rev/c83b5d6e0777