1710625 - Support Socket Process in SandboxTest

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Alexandre LISSY :gerard-majax]

https://searchfox.org/mozilla-central/source/security/sandbox/common/test/SandboxTest.cpp#61-91

Comment 1

[Alexandre LISSY :gerard-majax]

We should add coverage for:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1710603
• https://bugzilla.mozilla.org/show_bug.cgi?id=1710614

Comment 2

[Alexandre LISSY :gerard-majax]

Attachment: Bug 1710625 - SandboxTest with SocketProcess r?handyman!,jld!,#necko-reviewers!

Comment 3

[Alexandre LISSY :gerard-majax]

(In reply to Alexandre LISSY :gerard-majax from comment #1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1710614

Testing this will require to change InvalidSyscall() from PrctlPolicy() to Error(ENOSYS) for example.

Comment 4

[Alexandre LISSY :gerard-majax]

(In reply to Alexandre LISSY :gerard-majax from comment #3)

(In reply to Alexandre LISSY :gerard-majax from comment #1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1710614

Testing this will require to change InvalidSyscall() from PrctlPolicy() to Error(ENOSYS) for example.

diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp
index 3013c3e1155e..ee385eacd39f 100644
--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -1778,8 +1778,17 @@ class SocketProcessSandboxPolicy final : public SandboxPolicyCommon {
   }

   ResultExpr PrctlPolicy() const override {
-    // FIXME: bug 1619661
-    return Allow();
+    Arg<int> op(0);
+    return Switch(op)
+        .CASES((PR_SET_NAME,      // Thread creation
+                PR_SET_DUMPABLE,  // Crash reporting
+                PR_SET_PTRACER),  // Debug-mode crash handling
+               Allow())
+#if defined(MOZ_SANDBOX) && defined(MOZ_DEBUG) && defined(ENABLE_TESTS)
+        .Default(Error(ENOSYS));
+#else
+        .Default(InvalidSyscall());
+#endif
   }

   ResultExpr EvaluateSyscall(int sysno) const override {

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/735298219a02
SandboxTest with SocketProcess r=necko-reviewers,handyman,jld,kershaw

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/735298219a02