1831036 - Ship untrusted integrity on content process and extension process for Windows to release

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P2)

Description

[Tom25519]

Now Google Chrome set untrusted integrity on content process and extension process on Windows. I think Firefox should also do this.

Comment 1

[Tom25519]

Note: If some extensions need to run in "low" integrity level, once firefox could run every extension in separate processes (https://bugzilla.mozilla.org/show_bug.cgi?id=1827085), we could run them in "low" integrity level, and others run in "untrusted".

Or, if extension needs to read/write files on local disk which need higher integrity level, parent process as broker, extension call it to do that, all exrension processes have "untrusted" integrity level.

Comment 3

[Bob Owen (:bobowen)]

This has been a long term goal of ours, although I don't think we already had a specific bug, so thanks for this one.

Comment 4

[Bob Owen (:bobowen)]

Attachment: Bug 1831036 p1: Remove nightly_build checks from webcodecs tests. r=padenot!

These pass due to fallback caused by untrusted integrity.

Comment 5

[Bob Owen (:bobowen)]

Attachment: Bug 1831036 p2: Ship untrusted integrity on Windows content process sandbox. r=handyman!

Leaving the NIGHTLY_BUILD #if because I will soon be using level 8 for
USER_RESTRICTED access token level.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0a945b0cb21c
p1: Remove nightly_build checks from webcodecs tests. r=padenot
https://hg.mozilla.org/integration/autoland/rev/f7432a10815f
p2: Ship untrusted integrity on Windows content process sandbox. r=handyman

Comment 7

[Tom25519]

(In reply to Bob Owen (:bobowen) from comment #5)

Created attachment 9405250 [details]
Bug 1831036 p2: Ship untrusted integrity on Windows content process sandbox. r=handyman!

Leaving the NIGHTLY_BUILD #if because I will soon be using level 8 for
USER_RESTRICTED access token level.

What's the difference between untrusted integrity and USER_RESTRICTED access token level?

Comment 8

[Bob Owen (:bobowen)]

(In reply to Tom25519 from comment #7)

(In reply to Bob Owen (:bobowen) from comment #5)

Created attachment 9405250 [details]
Bug 1831036 p2: Ship untrusted integrity on Windows content process sandbox. r=handyman!

Leaving the NIGHTLY_BUILD #if because I will soon be using level 8 for
USER_RESTRICTED access token level.

What's the difference between untrusted integrity and USER_RESTRICTED access token level?

They both affect access checks in different ways.
The access token levels (like USER_RESTRICTED) remove more and more SIDs from the restricted SIDs list on the process's access token. As well (in general) as making those SIDs only available for deny checks. Access checks have to pass for both the normal and restricted list of SIDs.
Integrity levels are a separate mechanism, where a token with a lower integrity level only gets certain access to resources with higher integrity levels.

Apart from the Microsoft documentation on these things, there is also the chromium sandbox doc.

Comment 9

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/0a945b0cb21c
https://hg.mozilla.org/mozilla-central/rev/f7432a10815f

Comment 10

[Bob Owen (:bobowen)]

Release Note Request (optional, but appreciated)
[Why is this notable]: Windows content process sandbox improvement.
[Affects Firefox for Android]: No
[Suggested wording]: To further restrict any write access that the content processes have on Windows we have reduced their integrity level from low to untrusted.
[Links (documentation, blog post, etc)]: