1672013 - Enable headless content process mode on Linux by default (security.sandbox.content.headless)

Status: RESOLVED DUPLICATE of bug 1129492

(Core :: Security: Process Sandboxing, task, P5)

Description

[Chris Peterson [:cpeterson]]

The security.sandbox.content.headless pref was added in bug 1640345. We will want to enable headless mode by default on Linux to prevent any X11 or Gtk connections from Fission content processes (bug 1129492).

We can't enable headless mode until we move all Gtk and X11 use out of the content process, including:

• WebGL remoting (bug 1638466)
• widget.remote-look-and-feel (bug 1503054 and bug 1470983)
• Linux non-native theming (bug 1411425)

Jed says:

Empirically, setting headless mode on content processes (security.sandbox.content.headless) prevents all attempts to use GTK or X11. I've been dogfooding it and haven't noticed any issues other than what gcp mentioned (non-native widgets, WebGL remoting, nsLookAndFeel remoting), but obviously I haven't tried everything that our users will.

Comment 1

[Chris Peterson [:cpeterson]]

A Nouveau driver crash (bug 1671054) currently prevents WebGL remoting being enabled for Nouveau users (about 5% of Linux users). Thus, we will presumably need to continue allowing X11 in the Fission content processes for Nouveau users.

Can we detect Nouveau at runtime and enable headless mode for non-Nouveau users? It would still be good to block X11 in Fission content processes for the 95% of Linux users not using Nouveau drivers. Once we've moved X11 out of the content process, we'd like to prevent any regressions where people unintentionally add new X11 calls.

Comment 2

[Chris Peterson [:cpeterson]]

Nika doesn't think removing 100% of X11 from the content process needs to block Fission MVP. Non-native theming will remove the biggest use of X11 in content processes and that's probably good enough for Fission MVP.

Comment 3

[Neha Kochar [:neha]]

How is this different from bug 1129492 ? Should this just be duplicated?

Comment 4

[Chris Peterson [:cpeterson]]

(In reply to Neha Kochar [:neha] from comment #3)

How is this different from bug 1129492 ? Should this just be duplicated?

I don't think these bugs should be duplicated. Meta bug 1129492 is about removing the uses of X11. This bug is specifically about flipping the pref that will block all X11 use. I reversed these bugs' dependencies because we can't enable the headless pref until after we've removed X11 (in bug 1129492).

Comment 5

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Notwithstanding the last comment, I'm going to duplicate this onto bug 1129492. All that needs to happen now is flipping some prefs (and adding a test case), which isn't complicated enough to need a separate bug, and bug 1129492 was never a meta-bug.