781684 - Child processes should not be allowed to read all preferences

Status: REOPENED

(Core :: Preferences: Backend, defect, P3)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

We should probably have a whitelist of prefs that are acceptable for a child process to read. Right now there are some (printer name, moz sync ID, maybe others) that are exposed which should not be, and we shouldn't have to worry about constantly auditing for sensitive information stored there. (Addons are probably less careful too)

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

This isn't really ss since all subprocesses are trusted in all shipping code.

I agree with the whitelist solution.  We currently read the entire prefdb and serialize it for content processes.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

It might be good to keep this hidden for now given that it might take us longer to figure out the correct whitelist than we'll have time for before shipping B2G.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Given that we are no worse off than Firefox desktop here, I don't think this is a blocker. Definitely something we can look at if we have spare cycles, but not something I'd hold the release for.

I'm even thinking we should just open the bug...

Comment 4

[Nicholas Nethercote [inactive]]

This was a B2G bug. WONTFIX.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

It still seems like this is something we should do.