1755734 - Limit win32k lockdown for content to win10 1709 (build 16299) or later

Status: VERIFIED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Bob Owen (:bobowen)]

This is due to CoInitializeSecurity failing if user32 has loaded before it. From win10 1709 (build 16299) or later we have a work around already in place.

Comment 1

[Bob Owen (:bobowen)]

Attachment: Bug 1755734: Limit win32k lockdown for content process to Win10 build 16299 or later. r=gcp!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/33ac98b6c876
Limit win32k lockdown for content process to Win10 build 16299 or later. r=gcp

Comment 3

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/33ac98b6c876

Comment 4

[Bob Owen (:bobowen)]

Comment on attachment 9264192 [details]
Bug 1755734: Limit win32k lockdown for content process to Win10 build 16299 or later. r=gcp!

Beta/Release Uplift Approval Request

• User impact if declined: Required for win32k lockdown experiments.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Very simple change to single test from win8+ to win10 build 16299+ for enabling win32k lockdown.
• String changes made/needed: None

Comment 5

[Pascal Chevrel:pascalc]

Comment on attachment 9264192 [details]
Bug 1755734: Limit win32k lockdown for content process to Win10 build 16299 or later. r=gcp!

Approved for 98 beta 6, thanks.

Comment 6

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/fdcec913ef56

Comment 7

[Gabi Cheta [:Gabi] Desktop QA]

Verified that win32k lockdown for content processes is disabled in Fx 98.0b7 and Fx 99.0a1 when manually setting pref security.sandbox.content.win32k-disable = true on Windows 8.1 build 9600.
Unable to test on other pre 16299 builds, our test machines have Windows 8.1 9600 and Window 10 19043.