820202 - [tracker] Harden Message Manager protocols

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P3)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

This is a tracking bug to track the bugs identified as part of auditing the message manager protocols. The overall goal is to harden the message manager protocols, to limit what access a compromised child process can gain by sending spurious messages to the parent process.

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Note that DOM APIs missing parent permission checks will not be noted as part of this bug, since they are tracked under bug 776834.

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Quoting Jonas from bug 821671, since it is probably relevant to all of the bugs which block this:

---
Unfortunately I can't see how you in JS could check that the child process contains the app for a particular manifestURL.

What we probably need to do is to add a function on nsIPermissionChecker called something like assertContainsApp(manifestURL). The implementation would look a lot like assertPermission except that it wouldn't check in the permission database but rather check the url of the containing app.
---

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I believe that we are aiming for kernel sandbox to land on 1.2 (bug 790923). If that's the case, I think we should be pushing to resolve the bugs that blocked this metabug since they represent potential attacks from compromised child processes to the parent process. Some of them aren't so serious, but I will like to at least visit them and decide if they are going to block or not.

Comment 4

[Reuben Morais [:reuben]]

1.2 is blocking-b2g:koi, no?

Comment 5

[Jason Smith [:jsmith]]

(In reply to Paul Theriault [:pauljt] from comment #3)
> I believe that we are aiming for kernel sandbox to land on 1.2 (bug 790923).
> If that's the case, I think we should be pushing to resolve the bugs that
> blocked this metabug since they represent potential attacks from compromised
> child processes to the parent process. Some of them aren't so serious, but I
> will like to at least visit them and decide if they are going to block or
> not.

I think you meant to nominate this to koi. We can't block on this for leo - it's too late at this point.

Comment 6

[Andrew Overholt [:overholt]]

We don't normally block on tracking bugs so I've nommed all the blockers and removed the nom here.

Comment 7

[Paul Theriault [:pauljt] (no longer reading bugmail)]

This tracking bug isnt needed any more. Sandbox work is stracked under bug alias 'sandbox-sa'