Bug 1823458 - Call StartOpenBSDSandbox after JS_Init in generic utility process r=gerard-majax,sefeng

otherwise sandboxing is triggered by sysctl(KERN_PROC_PID) which
isnt permitted by the current sandboxing policy.

Differential Revision: https://phabricator.services.mozilla.com/D173152

ipc/glue/UtilityProcessChild.cpp

@@ -20,6 +20,10 @@
 #  include "mozilla/Sandbox.h"
 #endif
 
+#if defined(XP_OPENBSD) && defined(MOZ_SANDBOX)
+#  include "mozilla/SandboxSettings.h"
+#endif
+
 #if defined(MOZ_SANDBOX) && defined(MOZ_DEBUG) && defined(ENABLE_TESTS)
 #  include "mozilla/SandboxTestingChild.h"
 #endif
@@ -117,6 +121,12 @@ bool UtilityProcessChild::Init(mozilla::ipc::UntypedEndpoint&& aEndpoint,
     if (!JS_Init()) {
       return false;
     }
+#if defined(__OpenBSD__) && defined(MOZ_SANDBOX)
+    // Bug 1823458: delay pledge initialization, otherwise
+    // JS_Init triggers sysctl(KERN_PROC_ID) which isnt
+    // permitted with the current pledge.utility config
+    StartOpenBSDSandbox(GeckoProcessType_Utility, mSandbox);
+#endif
   }
 
   profiler_set_process_name(nsCString("Utility Process"));

ipc/glue/UtilityProcessImpl.cpp

@@ -64,8 +64,10 @@ bool UtilityProcessImpl::Init(int aArgc, char* aArgv[]) {
   // Go for it
   mozilla::SandboxTarget::Instance()->StartSandbox();
 #elif defined(__OpenBSD__) && defined(MOZ_SANDBOX)
-  StartOpenBSDSandbox(GeckoProcessType_Utility,
-                      (SandboxingKind)*sandboxingKind);
+  if (*sandboxingKind != SandboxingKind::GENERIC_UTILITY) {
+    StartOpenBSDSandbox(GeckoProcessType_Utility,
+                        (SandboxingKind)*sandboxingKind);
+  }
 #endif
 
   Maybe<const char*> parentBuildID =