1689398 - Add ability and prefs to enable CET Strict Mode in sandboxed child processes.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, task, P1)

Description

[Bob Owen (:bobowen) (PTO until 5th Oct)]

The is to add the functionality to the chromium sandbox and add prefs to add the setting to the various policies.

Comment 1

[Bob Owen (:bobowen) (PTO until 5th Oct)]

Attachment: Bug 1689398 p1: Add MITIGATION_CET_STRICT_MODE to chromium sandbox code. r=handyman!

The patch for the chromium changes doesn't include the updates to
windows_version, because these are already in the release version of chromium
and so will be picked up when we next update.

Comment 2

[Bob Owen (:bobowen) (PTO until 5th Oct)]

Attachment: Bug 1689398 p2: Add prefs to allow CET Strict Mode to be turned on for each sandboxed child process. r=handyman!

Depends on D103473

Comment 3

[Bob Owen (:bobowen) (PTO until 5th Oct)]

https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=22901e5f7b54b88039180e0ba9b7588adf396306

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4de55ba6456a
p1: Add MITIGATION_CET_STRICT_MODE to chromium sandbox code. r=handyman
https://hg.mozilla.org/integration/autoland/rev/90ac8d6d776e
p2: Add prefs to allow CET Strict Mode to be turned on for each sandboxed child process. r=handyman

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/4de55ba6456a
https://hg.mozilla.org/mozilla-central/rev/90ac8d6d776e