1877957 - Use untrusted integrity as the delayed integrity for the content process sandbox on Nightly

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Comment 1

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=c61aa1f9fdcc15396245640f4fd1e55e0d26fc69
https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=8de66836d8a40396c6eddc483bc03d9819a2a51e

Comment 2

[Bob Owen (:bobowen)]

New try push with only the fixes required for untrusted integrity. Other fixes in the first try pushes are needed for USER_RESTRICTED:
https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=417de311cf9d43a846dde7bd658c9a9f97c821ac

Comment 3

[Bob Owen (:bobowen)]

Attachment: Bug 1877957 p1: Add level 7 for untrusted integrity. r=handyman!

Comment 4

[Bob Owen (:bobowen)]

Attachment: Bug 1877957 p2: Flag webcodecs tests that now pass due to fall back. r=padenot!

Comment 5

[Bob Owen (:bobowen)]

Attachment: Bug 1877957 p3: Check gfxVars are initialised in ReportHardwareMediaCodecSupportIfNeeded. r=alwu!

This was causing a permanent failure for some xpcshell tests, possibly due to a
timing change.

Comment 6

[Bob Owen (:bobowen)]

Attachment: Bug 1877957 p4: Enable untrusted integrity for content process sandbox on Nightly. r=handyman!

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/16d2b3b29835
p1: Add level 7 for untrusted integrity. r=handyman
https://hg.mozilla.org/integration/autoland/rev/a2f1d2fe4a7b
p2: Flag webcodecs tests that now pass due to fall back. r=padenot
https://hg.mozilla.org/integration/autoland/rev/aa0cde9340b1
p3: Check gfxVars are initialised in ReportHardwareMediaCodecSupportIfNeeded. r=alwu
https://hg.mozilla.org/integration/autoland/rev/ee7693ef6d0d
p4: Enable untrusted integrity for content process sandbox on Nightly. r=handyman

Comment 8

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/16d2b3b29835
https://hg.mozilla.org/mozilla-central/rev/a2f1d2fe4a7b
https://hg.mozilla.org/mozilla-central/rev/aa0cde9340b1
https://hg.mozilla.org/mozilla-central/rev/ee7693ef6d0d

Comment 9

[Cristian Tuns]

Backout due to performance regressions
Backout link: https://hg.mozilla.org/integration/autoland/rev/87e13e7efccf76ca7bedab89509e5d17d895d8b5

Comment 10

[Bob Owen (:bobowen)]

(In reply to Cristian Tuns from comment #9)

Backout due to performance regressions
Backout link: https://hg.mozilla.org/integration/autoland/rev/87e13e7efccf76ca7bedab89509e5d17d895d8b5

thanks

Comment 11

[Andra Esanu (needinfo me)]

(In reply to Cristian Tuns from comment #9)

Backout due to performance regressions
Backout link: https://hg.mozilla.org/integration/autoland/rev/87e13e7efccf76ca7bedab89509e5d17d895d8b5

== Change summary for alert #41586 (as of Tue, 27 Feb 2024 06:12:14 GMT) ==

Regressions:

Ratio	Test	Platform	Options	Absolute values (old vs new)	Performance Profiles
19%	reddit-billgates-ama.billg-ama ContentfulSpeedIndex	windows10-64-shippable-qr	cold fission webrender	765.20 -> 911.54	Before/After
10%	facebook loadtime	windows10-64-shippable-qr	cold fission webrender	916.94 -> 1,013.12	Before/After

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)	Performance Profiles
23%	yahoo-mail fcp	windows10-64-shippable-qr	cold fission webrender	235.18 -> 180.00	Before/After
23%	yahoo-mail fcp	windows10-64-shippable-qr	bytecode-cached cold fission webrender	236.58 -> 181.50	Before/After
21%	wikipedia fcp	windows10-64-shippable-qr	bytecode-cached cold fission webrender	833.75 -> 656.78	Before/After
21%	bing-search fcp	windows10-64-shippable-qr	bytecode-cached cold fission webrender	180.48 -> 142.73	Before/After
21%	bing-search fcp	windows10-64-shippable-qr	cold fission webrender	179.49 -> 142.27	Before/After
...	...	...	...	...	...
2%	google-mail FirstVisualChange	windows10-64-shippable-qr	cold fission webrender	1,092.09 -> 1,068.78	Before/After

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=41586

Comment 12

[Florin Bilt]

Perfherder has detected an improvement for Backout link: https://hg.mozilla.org/integration/autoland/rev/87e13e7efccf76ca7bedab89509e5d17d895d8b5

== Change summary for alert #41589 (as of Tue, 27 Feb 2024 10:35:02 GMT) ==

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)
3%	startup_about_home_paint_cached	windows10-64-shippable-qr	e10s fission stylo webrender-sw	574.79 -> 555.25
3%	startup_about_home_paint_cached	windows10-64-shippable-qr	e10s fission stylo webrender-sw	570.75 -> 554.25

For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=41589

Comment 13

[Bob Owen (:bobowen)]

This got a bit messy, because of the webcodecs tests also needing to be reverted.
So I think I'll clone and close this one.

Comment 14

[Phabricator Automation]

Comment on attachment 9378514 [details]
Bug 1877957 p4: Enable untrusted integrity for content process sandbox on Nightly. r=handyman!

Revision D200796 was moved to bug 1889932. Setting attachment 9378514 [details] to obsolete.

Comment 15

[Bob Owen (:bobowen)]

Remaining work happening in bug 1889932.