943774 - The crash reporter doesn't work on seccomp-enabled non-profiling B2G builds.

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Breakpad calls sigaction in its signal handler; among other uses, it checks that nothing else cleared its SA_SIGINFO flag before proceeding.  If we kill the process at that point, we don't get a crash dump.  We currently allow sigaction on profiling builds and only profiling builds, meaning that production builds don't produce crash dumps when sandboxed, which is bad.

In the exciting future of bug 920372, we'd be able to allow sigaction to be used to read the signal disposition but not change it — however, we'd also have to modify both Breakpad and the IPC code that determines whether an exited child crashed (and maybe more things I'm not thinking of yet) in order to avoid recursive crashes.

In the less exciting present: Allowing a process to change its signal handlers doesn't grant it access to resources it doesn't already have, so it seems to me that allowing it is an acceptable risk (and certainly a much smaller risk than other interfaces we're already allowing with the expectation of restricting them later).

Comment 1

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: bug943774-sandbox-allow-sigaction-hg0.diff

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: bug943774-sandbox-allow-sigaction-hg1.diff

Fix obvious mistake in preprocessor directives.

Comment 3

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8339181 [details] [diff] [review]
bug943774-sandbox-allow-sigaction-hg1.diff

Review of attachment 8339181 [details] [diff] [review]:
-----------------------------------------------------------------

yes, sigaction is ok.

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

→ b2g-inbound.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fdd48523bfbe

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/fdd48523bfbe