Closed Bug 795061 Opened 7 years ago Closed 7 years ago

AssertAppProcessPermission: Kill any process that doesn't have the specified permission, not just app processes

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla18
blocking-basecamp +

People

(Reporter: philikon, Assigned: philikon)

References

Details

Attachments

(1 file)

Bug 776850 got the logic slightly wrong. We bail out of AssertAppProcessPermission if we can't find an app associated with a process (which would be the case for regular <iframe mozbrowser> or <browser> elements), so we never end up killing it.

Kill kill kill them all.
Needs to block. Don't want pwned phone.
Assignee: nobody → philipp
blocking-basecamp: --- → ?
Attached patch v1Splinter Review
Try build: https://tbpl.mozilla.org/?tree=Try&rev=0d62f643987e
Attachment #665808 - Flags: review?(jones.chris.g)
Comment on attachment 665808 [details] [diff] [review]
v1


>diff --git a/dom/ipc/AppProcessPermissions.cpp b/dom/ipc/AppProcessPermissions.cpp

>+  if (!hasPermission) {
>+    printf_stderr("Security problem: App process does not have `%s' permission.  It will be killed.\n", aPermission);

s/App/Content/
Attachment #665808 - Flags: review?(jones.chris.g) → review+
Security is important enough for blocking :)
blocking-basecamp: ? → +
https://hg.mozilla.org/mozilla-central/rev/e81ac71f1107
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.