1767999 - Re-enable Win32k Lockdown by Default

Status: VERIFIED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Bob Owen (:bobowen)]

This was set to early beta and earlier in bug 1766033 for a staged roll-out.
We now need to flip it back to be on by default.

Comment 1

[Bob Owen (:bobowen)]

Attachment: Bug 1767999: Re-enable Win32k Lockdown by default. r=gcp!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/743e4a955fea
Re-enable Win32k Lockdown by default. r=gcp

Comment 3

[Bob Owen (:bobowen)]

Comment on attachment 9275252 [details]
Bug 1767999: Re-enable Win32k Lockdown by default. r=gcp!

Beta/Release Uplift Approval Request

• User impact if declined: Win32k lockdown enablement will rely on Normandy roll out instead of just being enabled by default.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Simple pref flip.
• String changes made/needed: None
• Is Android affected?: No

Comment 4

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/743e4a955fea

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Release Note Request (optional, but appreciated)
[Why is this notable]: Major improvement to sandbox strength
[Affects Firefox for Android]: No
[Suggested wording]: Firefox's security sandbox now blocks access to the Win32k APIs for Content Processes on Windows.
[Links (documentation, blog post, etc)]: To be announced on Hacks

Comment 6

[Dianna Smith [:diannaS]]

Comment on attachment 9275252 [details]
Bug 1767999: Re-enable Win32k Lockdown by default. r=gcp!

Approved for 100.0.1

Comment 7

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-release/rev/283f842c1bfe

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9275252 [details]
Bug 1767999: Re-enable Win32k Lockdown by default. r=gcp!

Approved for 101.0b7.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a21f05403031

Comment 10

[Gabi Cheta [:Gabi] Desktop QA]

Verified as enabled on Fx 100.0.1 and Fx 100.0b7 Windows 10 and Windows 11.

Comment 11

[Gabi Cheta [:Gabi] Desktop QA]

Verified as enabled with Fx 102.0a1 Windows 11 and Windows 10 x64.