846047 - Prevent nested subprocesses from attacking each other and their parent

Status: RESOLVED WONTFIX

(Core :: General, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

When we launch subprocesses from existing content processes, the parent process will run as "nobody" and can't change the real uid/gid of new processes it spawns.  This means that the launched subprocesses will run with the same real uid/gid as the parent.

This isn't the end of the world security-wise, but it means that a compromised process will be able to ptrace its parent and siblings and force them to do things it otherwise couldn't do itself.

The easiest way to mitigate this is with ptrace
 - use seccomp to disable ptrace in all processes by default
 - use seccomp to disable fork/exec in processes that don't have mozbrowser privileges

Comment 1

[(not currently active) Ted Mielczarek]

Did Ubuntu's ptrace hardening patches ever make it into upstream?
https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace_Protection

They disallow ptrace except from parent->child by default.

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

We don't currently have this patch.
Instead, each child runs with a different user id when the platform permits it (ie, it works on Firefox OS) so that childs can't ptrace one another.

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Chris Jones [:cjones] mostly inactive; ni?/f?/r? if you need me from comment #0)
> When we launch subprocesses from existing content processes

As far as I know we're not currently launching subprocesses from content processes — except on desktop, for plugins, and bug 641685 exists for us to stop doing that.  Is this bug still needed?

(Also, for the sake of completeness: a process can also use PR_SET_DUMPABLE to opt out of being ptraceable.)

Comment 4

[John Schoenick [:johns]]

Bug 641685 will indeed remove spawning plugin processes from content processes.

Comment 5

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

And "nested content processes" are created by the parent (or Nuwa), not by the process that's their logical parent.  So there's nothing left to do here.