2054887 - Marionette should use "MOZ_REMOTE_ALLOW_SYSTEM_ACCESS" instead of "--remote-allow-system-access" command line argument

Status: RESOLVED FIXED

(Testing :: Marionette Client and Harness, enhancement, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Currently Marionette uses the --remote-allow-system-access command line argument for Firefox. We should change it to use the MOZ_REMOTE_ALLOW_SYSTEM_ACCESS environment variable instead.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

This is actually equivalent to the geckodriver part which is covered on bug 2037819.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Attachment: (secure)

Comment 3

[Tyson Smith [:tsmith]]

The rating assigned by our bug rating tool (currently under development) is:

Rating: sec-want

Explanation: Not a vulnerability. This is a testing/Marionette hardening-refactoring task to enable privileged system access via the MOZ_REMOTE_ALLOW_SYSTEM_ACCESS environment variable instead of the --remote-allow-system-access command-line flag (both already supported in RemoteAgent.sys.mjs), mirroring the geckodriver change in bug 2037819. Motivated by reducing exposure of the flag in process command lines, it is a security-relevant improvement rather than an exploitable flaw, so it maps to sec-want. The lone attachment is a patch; no evidence review needed.

whimboo: Please ni? me if you disagree with this rating.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

The rating seems fine to me. Thanks!

Just a note to myself: Once the bug is fixed we need to release a new marionette-driver release so that upstream web-platform tests will use the environment variable and not set the command line argument.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f0fad4713d31
https://hg.mozilla.org/integration/autoland/rev/683c60e16dea
[remote] Improve privileged context handling. r=Sasha

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/683c60e16dea