1889932 - Use untrusted integrity as the delayed integrity for the content process sandbox on Nightly

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Comment 1

[Bob Owen (:bobowen)]

Attachment: Bug 1889932 p1: Set process ACL to the delayed integrity level in SetProcessIntegrityLevel. r=yjuglaret!

This allows us to maintain the same access to our process when the integrity
level on our access token is dropped.

Comment 2

[Bob Owen (:bobowen)]

Attachment: Bug 1889932 p2: Flag webcodecs tests that now pass due to fall back. r=padenot!

This is a relanding of the changes reverted in bug 1881670.

Comment 3

[Bob Owen (:bobowen)]

Attachment: Bug 1889932 p3: Enable untrusted integrity for content process sandbox on Nightly. r=handyman!

Comment 4

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/jobs?repo=try&revision=114ddb617655126769ae10642258138089a69da1

Comment 5

[Bob Owen (:bobowen)]

Hopefully this fixes most of the failures in the last try push.
It looks like the changes in p1 mean we don't need the changes in p2 any more, but I'll check that once I've reduced the noise.
https://treeherder.mozilla.org/jobs?repo=try&revision=0e08c3d40d120c953219557e4109031fbf72d42d

Comment 6

[Bob Owen (:bobowen)]

(In reply to Bob Owen (:bobowen) from comment #5)

Hopefully this fixes most of the failures in the last try push.
It looks like the changes in p1 mean we don't need the changes in p2 any more, but I'll check that once I've reduced the noise.
https://treeherder.mozilla.org/jobs?repo=try&revision=0e08c3d40d120c953219557e4109031fbf72d42d

Seems that we need at least some of the changes in p2:
https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=7932c31da92063e582c7489186b9674e8b73ea4c

If I just remove the PRECONDITION_FAILED part it works, my guess is the two fixes to my forgetting to back out the tests changes landed close together:
https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=2f7f2e36594c66ee6ce0ee92e3fa37c464ff016b

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d466146035c3
p1: Set process ACL to the delayed integrity level in SetProcessIntegrityLevel. r=yjuglaret
https://hg.mozilla.org/integration/autoland/rev/bb44305a37a6
p2: Flag webcodecs tests that now pass due to fall back. r=padenot
https://hg.mozilla.org/integration/autoland/rev/b74cbea79fd3
p3: Enable untrusted integrity for content process sandbox on Nightly. r=handyman

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/d466146035c3
https://hg.mozilla.org/mozilla-central/rev/bb44305a37a6
https://hg.mozilla.org/mozilla-central/rev/b74cbea79fd3