1799470 - Tighten GPU sandbox's filesystem access

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P2)

Description

[Chris Martin [:cmartin]]

In Bug 1797887, we had to allow the sandboxed GPU process full access to the filesystem as a workaround because the sandbox was breaking the shader cache.

Even though the shader cache "Works on My Machine™", on other machines it appears that that the previous sandbox exception was not enough to allow it to work properly.

This is a follow-up bug to investigate why the shader cache was broken on some machines with the GPU sandbox enabled, and to re-tighten the filesystem access for the GPU sandbox.

Comment 1

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Remove dead startup code

Comment 2

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Merge old embedding logic into ContentChild

Depends on D164595

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cf7505ed9309
Remove dead startup code r=nika
https://hg.mozilla.org/integration/autoland/rev/f357acb2e2cc
Merge old embedding logic into ContentChild r=nika

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/cf7505ed9309
https://hg.mozilla.org/mozilla-central/rev/f357acb2e2cc

Comment 5

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Refactor app starter

Comment 6

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Eliminate dead code around mAppProvider + cleanup

Depends on D165414

Comment 7

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Refactor nsXREDirProvider::GetFile

Depends on D165415

Comment 8

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Do UTF-8 checks in nsXREDirProvider

Depends on D165416

Comment 9

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Add Profile Finalizer

Depends on D165417

Comment 10

[Chris Martin [:cmartin]]

Attachment: Bug 1799470 - Retighten GPU Process File Access

Depends on D165418

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6753eedb7343
Refactor app starter r=nika
https://hg.mozilla.org/integration/autoland/rev/a1555357e973
Eliminate dead code around mAppProvider + cleanup r=nika
https://hg.mozilla.org/integration/autoland/rev/c1b220d515f1
Refactor nsXREDirProvider::GetFile r=nika
https://hg.mozilla.org/integration/autoland/rev/158d3a10a7eb
Do UTF-8 checks in nsXREDirProvider r=nika

Comment 12

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6753eedb7343
https://hg.mozilla.org/mozilla-central/rev/a1555357e973
https://hg.mozilla.org/mozilla-central/rev/c1b220d515f1
https://hg.mozilla.org/mozilla-central/rev/158d3a10a7eb

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/69a6c2500cb5
Retighten GPU Process File Access r=nika,handyman

Comment 14

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/69a6c2500cb5

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Can this bug be closed now?

Comment 16

[Chris Martin [:cmartin]]

Thanks for the reminder, Ryan :)