1610570 - Support a 'passback' attribute for individual IPC arguments to avoid requiring no-op validations

Status: RESOLVED FIXED

(Core :: IPC, enhancement, P3)

Description

[Tom Ritter [:tjr]]

In certain circumstances, the unprivileged process will provide a numeric identifier to the privileged process that serves as an internal bookkeeping record. The parent doesn't do anything with this parameter except return it to the child.

For example here, aPromiseID is just returned to the child.

It would be nicer if we could indicate this so there is no need to call MOZ_VALIDATE_AND_GET(foo, true) and indicate a justification somewhere.

We could put it on the argument where it comes from the unprivileged process, so it arrives in the privileged process without a Tainted<> indicator.

Or, we could put it on the argument where it is sent by the privileged process, so the caller is able to pass a Tainted<> directly instead of needing to perform a no-check validation.

I am more inclined to do the latter because (a) it means that validation would have to be performed if someone did want to use it for something and (b) it implicitly means that trying to pass a value that either didn't come from the child or was somehow computed (because it's a foo instead of Tainted<foo>) breaks.

As we look at more IPC methods we want to cut over, we can look for instances where that might break something legitimately.

Bikeshedding on the keyword welcome. Right now I'm imagining 'passthrough' or 'passback'.

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 1610570: Support the NoTaint attribute on method parameters with the passback value r?nika

Depends on D108233

Comment 2

[Tom Ritter [:tjr]]

Attachment: Bug 1610570: Pass attributes through so lower.py can change code emission, and handle NoTaint r?nika

Depends on D108245

Comment 3

[Tom Ritter [:tjr]]

Attachment: Bug 1610570: Apply the passback attribute to gamepad

Depends on D108246

Comment 4

[Tom Ritter [:tjr]]

Attachment: Bug 1610570: Add a 'NoTaint=allvalid' attribute as well, and cut Gamepad over to it

Depends on D108247

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8d78b75b87fc
Support the NoTaint attribute on method parameters with the passback value r=mccr8
https://hg.mozilla.org/integration/autoland/rev/6594ce800a6b
Pass attributes through so lower.py can change code emission, and handle NoTaint r=mccr8
https://hg.mozilla.org/integration/autoland/rev/e2ef5d146d6a
Apply the passback attribute to gamepad r=cmartin
https://hg.mozilla.org/integration/autoland/rev/047120786a91
Add a 'NoTaint=allvalid' attribute as well, and cut Gamepad over to it r=cmartin

Comment 6

[Cosmin Sabou [:CosminS]]

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=047120786a91371819cbdafd817d58c3a3a1c250&selectedTaskRun=e-LeOs0NSu2MPi11xcpIKg.0

Failure logs: https://treeherder.mozilla.org/logviewer?job_id=334025497&repo=autoland
https://treeherder.mozilla.org/logviewer?job_id=334025513&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/d19ecd7a3f2cfa52e7fe8f639473385b4fb13e81

Comment 7

[Tom Ritter [:tjr]]

Attachment: Bug 1610570: Fix linting errors

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c7f732f443b1
Support the NoTaint attribute on method parameters with the passback value r=mccr8
https://hg.mozilla.org/integration/autoland/rev/83b086da2960
Pass attributes through so lower.py can change code emission, and handle NoTaint r=mccr8
https://hg.mozilla.org/integration/autoland/rev/ccc49e1fd15c
Apply the passback attribute to gamepad r=cmartin
https://hg.mozilla.org/integration/autoland/rev/faf6f57c64eb
Add a 'NoTaint=allvalid' attribute as well, and cut Gamepad over to it r=cmartin

Comment 9

[Noemi Erli[:noemi_erli]]

Backed out 4 changesets (Bug 1610570) for causing lint failure in lower.py CLOSED TREE

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&collapsedPushes=842382&selectedTaskRun=YKcRZJ7YRKu7weg5astOIQ.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=faf6f57c64eb4df12039eab6e10e2c5914d1b907

Failure log: https://treeherder.mozilla.org/logviewer?job_id=334168642&repo=autoland&lineNumber=537

Backout: https://hg.mozilla.org/integration/autoland/rev/ea38e210ba4d6d14f40cd17fc38515ce7e965e60

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0ac29016e4ac
Support the NoTaint attribute on method parameters with the passback value r=mccr8
https://hg.mozilla.org/integration/autoland/rev/9f428052118e
Pass attributes through so lower.py can change code emission, and handle NoTaint r=mccr8
https://hg.mozilla.org/integration/autoland/rev/6545e385355e
Apply the passback attribute to gamepad r=cmartin
https://hg.mozilla.org/integration/autoland/rev/1fd580d39fcf
Add a 'NoTaint=allvalid' attribute as well, and cut Gamepad over to it r=cmartin

Comment 11

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/0ac29016e4ac
https://hg.mozilla.org/mozilla-central/rev/9f428052118e
https://hg.mozilla.org/mozilla-central/rev/6545e385355e
https://hg.mozilla.org/mozilla-central/rev/1fd580d39fcf