776840 - Ensure no-rights content processes can't read user data

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Bug 776647 gets us on the way there.  I noticed with |ls -l| on device that the master b2g process is creating files that store user data with excessive perms, some o+rw and most o+r.  There are three paths to get here
 - fix gecko to umask properly. generally useful, even on "desktop"
 - chroot() the content processes.  This should be doable after bug 776648.
 - with seccomp, lock out open/stat and friends entirely

Comment 1

[Guillaume Destuynder [:kang] [this account is no longer active]]

see bug 776648 for chrooting
seccomp is blocked on having seccomp filter in the shipping device (ie kernel sources), nexus-s kernel support is in bug 790923

marked moco only as it involves issues with a non-released device, feel free to revert

Comment 2

[Doug Turner (:dougt)]

"Not going to make v1, k9o blockers".

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Oh, sorry: I ended up looking up a bug # that wasn't this one.  I think this should block.  It's mostly a matter of umask()ing correctly.

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

761438 fixes the umask

Comment 5

[Benjamin Smedberg]

Does this bug need to remain private and is there anything left to do?

Comment 6

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Oops, this didn't need to be moco private.  And yeah, we've got this locked down as well as we can with gecko18/b2gv1 technology.