nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1823458 - Call StartOpenBSDSandbox after JS_Init in generic utility process r=gerard-majax,sefeng

Browse source 
otherwise sandboxing is triggered by sysctl(KERN_PROC_PID) which
isnt permitted by the current sandboxing policy.

Differential Revision: https://phabricator.services.mozilla.com/D173152
This commit is contained in:
Landry Breuil 2023-03-22 16:04:09 +00:00
parent 2165378ccd
commit b114e49ce6
2 changed files with 14 additions and 2 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
ipc/glue/UtilityProcessChild.cpp
View file

@ -20,6 +20,10 @@
# include "mozilla/Sandbox.h" # include "mozilla/Sandbox.h"
#endif #endif
#if defined(XP_OPENBSD) && defined(MOZ_SANDBOX)
# include "mozilla/SandboxSettings.h"
#endif
#if defined(MOZ_SANDBOX) && defined(MOZ_DEBUG) && defined(ENABLE_TESTS) #if defined(MOZ_SANDBOX) && defined(MOZ_DEBUG) && defined(ENABLE_TESTS)
# include "mozilla/SandboxTestingChild.h" # include "mozilla/SandboxTestingChild.h"
#endif #endif
@ -117,6 +121,12 @@ bool UtilityProcessChild::Init(mozilla::ipc::UntypedEndpoint&& aEndpoint,
if (!JS_Init()) { if (!JS_Init()) {
return false; return false;
} }
#if defined(__OpenBSD__) && defined(MOZ_SANDBOX)
// Bug 1823458: delay pledge initialization, otherwise
// JS_Init triggers sysctl(KERN_PROC_ID) which isnt
// permitted with the current pledge.utility config
StartOpenBSDSandbox(GeckoProcessType_Utility, mSandbox);
#endif
} }
profiler_set_process_name(nsCString("Utility Process")); profiler_set_process_name(nsCString("Utility Process"));

2
ipc/glue/UtilityProcessImpl.cpp
View file

@ -64,8 +64,10 @@ bool UtilityProcessImpl::Init(int aArgc, char* aArgv[]) {
// Go for it // Go for it
mozilla::SandboxTarget::Instance()->StartSandbox(); mozilla::SandboxTarget::Instance()->StartSandbox();
#elif defined(__OpenBSD__) && defined(MOZ_SANDBOX) #elif defined(__OpenBSD__) && defined(MOZ_SANDBOX)
if (*sandboxingKind != SandboxingKind::GENERIC_UTILITY) {
StartOpenBSDSandbox(GeckoProcessType_Utility, StartOpenBSDSandbox(GeckoProcessType_Utility,
(SandboxingKind)*sandboxingKind); (SandboxingKind)*sandboxingKind);
}
#endif #endif
Maybe<const char*> parentBuildID = Maybe<const char*> parentBuildID =