1716024 - Change CET support to compatible modules only

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Bob Owen (:bobowen)]

Bug 1689398 added support for CET User Shadow Stack strict mode, but we have decided that a safer initial approach is to use compatible modules only mode.
This guards against any non-Mozilla DLLs (either loaded by us or injected into the process) causing CET crashes.

Comment 1

[Bob Owen (:bobowen)]

Attachment: Bug 1716024 p1: Change CET support to compatible modules only. r=handyman!

Comment 2

[Bob Owen (:bobowen)]

Attachment: Bug 1716024 p2: Flag all binaries apart from firefox, xpcshell and plugin-container as CET compatible. r=glandium!

We will only run the processes in CET compatible modules only mode when not
using the JIT code. So marking xul.dll as compatible should be OK.

Depends on D117550

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c5225386044
p1: Change CET support to compatible modules only. r=handyman
https://hg.mozilla.org/integration/autoland/rev/181a2776e265
p2: Flag all binaries apart from firefox, xpcshell and plugin-container as CET compatible. r=glandium

Comment 4

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/4c5225386044
https://hg.mozilla.org/mozilla-central/rev/181a2776e265