776652 - Tracking: Apply appropriate security checks for sensitive IPDL protocols

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Some protocols, like the ones used for gfx, don't need security checks (to a first approximation).  But the ones used for, e.g. telephony and SMS, do.

We need to do a second pass over our protocol code and apply capability checks where required.  We can go in order of most-sensitive to least-sensitive.  This is the debt we've been building up while we didn't have the permission model implemented.

The fact that some cross-process impls are in JS complicates this somewhat.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

We should implement one or two of these fully "manually" to get a feel for what this code should look like.  After that, we should consider tagging IPDL protocols/messages themselves with the required permission bits, and then auto-generating the boilerplate needed to delegate those security checks.

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

This isn't a complete set, but let's start here.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

So how does one know whether certain process has been granted permission for foo?

Comment 4

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

See bug 776649.  We'll reuse that mechanism for mm too.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Attachment: comments about ipdls

I went through the ipdl files I found and tried to figure out what
all needs some kind of permission check or perhaps parameter validation.

Next: messageManager communication

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: messagemanager usage

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Hmm, I missed BrowserElementParent.js and it is actually tricky one.
In a way all the messages from child process would need some kind of permissions check, but
in practice... maybe not.

So, I assume the developers of the relevant features add needed permission checks.
(hopefully it is possible to do permission checks both in JS and C++.)