1736990 - Sandbox needs to expose /dev/random and /proc/sys/crypto/fips_enabled when running in FIPS mode

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P3)

Description

[msirringhaus]

For running in FIPS mode, NSS needs to check /proc/sys/crypto/fips_enabled, to be able to tell whether FIPS is enabled or not.
FIPS also mandates using /dev/random instead of /dev/urandom.

MediaPluginSandbox already exposes /proc/sys/crypto/fips_enabled, but not /dev/random.
Content- and SocketProcessPolicy expose neither.

Comment 1

[msirringhaus]

Attachment: Bug 1736990 - Expose /dev/random and /proc/sys/crypto/fips_enabled in sandboxes. r=gcp

For running in FIPS mode, NSS needs to check /proc/sys/crypto/fips_enabled, to be able to tell whether FIPS is enabled or not.
FIPS also mandates using /dev/random instead of /dev/urandom.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:msirringhaus, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a15a51cdc10b
Expose /dev/random and /proc/sys/crypto/fips_enabled in sandboxes. r=bryce,gcp

Comment 4

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/a15a51cdc10b