1579323 - sandboxing can no longer be enabled on OpenBSD

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P5)

Description

[jcs]

Attachment: old-configure.in patch

old-configure.in previously allowed MOZ_SANDBOX to be set to 1 on OpenBSD when --enable-sandbox was supplied.

This was broken by #1375863 which changed the logic for old-configure.in to explicitly disable MOZ_SANDBOX on non-Linux/Win/Darwin platforms even if --enable-sandbox was supplied.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Landry Breuil (:gaston)]

Attachment: Reenable sandboxing by default on OpenBSD

mike, can you please r+ that ? I need it backported up to esr68.. and it seems we cant set r? anymore.

Comment 3

[jcs]

You lowercased the 'd':

"WINNT|Darwin|OpenBSd)"

Comment 4

[Landry Breuil (:gaston)]

Attachment: Reenable sandboxing by default on OpenBSD

Dammit. Thanks for spotting it..

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 9091233 [details] [diff] [review]
Reenable sandboxing by default on OpenBSD

Review of attachment 9091233 [details] [diff] [review]:
-----------------------------------------------------------------

r+ on behalf of froydnj

Comment 6

[Landry Breuil (:gaston)]

< froydnj > gaston: r+ from me

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f5846b25585f
Reenable sandbox by default on OpenBSD r=froydnj

Comment 8

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/f5846b25585f

Comment 9

[Landry Breuil (:gaston)]

Comment on attachment 9091233 [details] [diff] [review]
Reenable sandboxing by default on OpenBSD

Beta/Release Uplift Approval Request

• User impact if declined: Failure to enable sandboxing when building on OpenBSD
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): NPOTB/tier3
• String changes made/needed:

Comment 10

[Landry Breuil (:gaston)]

Comment on attachment 9091233 [details] [diff] [review]
Reenable sandboxing by default on OpenBSD

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Friendlier for downstream distributors on tier3
• User impact if declined: Failure to enable sandboxing when building on OpenBSD
• Fix Landed on Version: 71
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): NPOTB/tier3
• String or UUID changes made by this patch:

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9091233 [details] [diff] [review]
Reenable sandboxing by default on OpenBSD

OpenBSD fix, NPOTB for Tier 1 platforms. Approved for 70.0b10 and 68.2esr.

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/86981b66c0ce

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/e0b6137d8d2e