adb9ba0744
See the previous commit, about content sandbox level 6, for details; this is basically the same (except with one more ioctl allowlisted, and controlled by a different pref). This patch also adds some plumbing to get the socket sandbox level into the code that constructs the policy, modeled on how it works for content processes. (Previously the only levels of the socket process sandbox were "on" and "off" so that wasn't necessary until now.) Differential Revision: https://phabricator.services.mozilla.com/D249018
311 lines
9.8 KiB
C++
311 lines
9.8 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
|
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
|
* You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "mozilla/SandboxSettings.h"
|
|
#include "mozISandboxSettings.h"
|
|
#include "nsServiceManagerUtils.h"
|
|
#include "nsAppRunner.h"
|
|
|
|
#include "mozilla/Components.h"
|
|
#include "mozilla/Preferences.h"
|
|
#include "mozilla/StaticPrefs_media.h"
|
|
#include "mozilla/StaticPrefs_network.h"
|
|
#include "mozilla/StaticPrefs_security.h"
|
|
#include "mozilla/StaticPrefs_webgl.h"
|
|
|
|
#include "prenv.h"
|
|
|
|
#ifdef XP_WIN
|
|
# include "mozilla/gfx/gfxVars.h"
|
|
# include "mozilla/WindowsVersion.h"
|
|
# include "nsExceptionHandler.h"
|
|
# include "PDMFactory.h"
|
|
#endif // XP_WIN
|
|
|
|
using namespace mozilla;
|
|
|
|
namespace mozilla {
|
|
|
|
const char* ContentWin32kLockdownStateToString(
|
|
nsIXULRuntime::ContentWin32kLockdownState aValue) {
|
|
switch (aValue) {
|
|
case nsIXULRuntime::ContentWin32kLockdownState::LockdownEnabled:
|
|
return "Win32k Lockdown enabled";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::MissingWebRender:
|
|
return "Win32k Lockdown disabled -- Missing WebRender";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::OperatingSystemNotSupported:
|
|
return "Win32k Lockdown disabled -- Operating system not supported";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::PrefNotSet:
|
|
return "Win32k Lockdown disabled -- Preference not set";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::MissingRemoteWebGL:
|
|
return "Win32k Lockdown disabled -- Missing Remote WebGL";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::MissingNonNativeTheming:
|
|
return "Win32k Lockdown disabled -- Missing Non-Native Theming";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DecodersArentRemote:
|
|
return "Win32k Lockdown disabled -- Not all media decoders are remoted "
|
|
"to Utility Process";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DisabledByEnvVar:
|
|
return "Win32k Lockdown disabled -- MOZ_ENABLE_WIN32K is set";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DisabledByE10S:
|
|
return "Win32k Lockdown disabled -- E10S is disabled";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DisabledByUserPref:
|
|
return "Win32k Lockdown disabled -- manually set "
|
|
"security.sandbox.content.win32k-disable to false";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::EnabledByUserPref:
|
|
return "Win32k Lockdown enabled -- manually set "
|
|
"security.sandbox.content.win32k-disable to true";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DisabledByControlGroup:
|
|
return "Win32k Lockdown disabled -- user in Control Group";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::EnabledByTreatmentGroup:
|
|
return "Win32k Lockdown enabled -- user in Treatment Group";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::DisabledByDefault:
|
|
return "Win32k Lockdown disabled -- default value is false";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::EnabledByDefault:
|
|
return "Win32k Lockdown enabled -- default value is true";
|
|
|
|
case nsIXULRuntime::ContentWin32kLockdownState::
|
|
IncompatibleMitigationPolicy:
|
|
return "Win32k Lockdown disabled -- Incompatible Windows Exploit "
|
|
"Protection policies enabled";
|
|
}
|
|
|
|
MOZ_CRASH("Should never reach here");
|
|
}
|
|
|
|
bool GetContentWin32kLockdownEnabled() {
|
|
auto state = GetContentWin32kLockdownState();
|
|
return state ==
|
|
nsIXULRuntime::ContentWin32kLockdownState::EnabledByUserPref ||
|
|
state == nsIXULRuntime::ContentWin32kLockdownState::
|
|
EnabledByTreatmentGroup ||
|
|
state == nsIXULRuntime::ContentWin32kLockdownState::EnabledByDefault;
|
|
}
|
|
|
|
nsIXULRuntime::ContentWin32kLockdownState GetContentWin32kLockdownState() {
|
|
#ifdef XP_WIN
|
|
|
|
static auto getLockdownState = [] {
|
|
auto state = GetWin32kLockdownState();
|
|
|
|
CrashReporter::RecordAnnotationCString(
|
|
CrashReporter::Annotation::ContentSandboxWin32kState,
|
|
ContentWin32kLockdownStateToString(state));
|
|
|
|
return state;
|
|
};
|
|
|
|
static nsIXULRuntime::ContentWin32kLockdownState result = getLockdownState();
|
|
return result;
|
|
|
|
#else // XP_WIN
|
|
|
|
return nsIXULRuntime::ContentWin32kLockdownState::OperatingSystemNotSupported;
|
|
|
|
#endif // XP_WIN
|
|
}
|
|
|
|
#if defined(XP_WIN)
|
|
static bool IsWebglOutOfProcessEnabled() {
|
|
if (StaticPrefs::webgl_out_of_process_force()) {
|
|
return true;
|
|
}
|
|
|
|
// We have to check initialization state for gfxVars, because of early use in
|
|
// child processes. In rare cases this could lead to the incorrect sandbox
|
|
// level being reported, but not the incorrect one being set.
|
|
if (gfx::gfxVars::IsInitialized() && !gfx::gfxVars::AllowWebglOop()) {
|
|
return false;
|
|
}
|
|
|
|
return StaticPrefs::webgl_out_of_process();
|
|
}
|
|
#endif
|
|
|
|
int GetEffectiveContentSandboxLevel() {
|
|
if (PR_GetEnv("MOZ_DISABLE_CONTENT_SANDBOX")) {
|
|
return 0;
|
|
}
|
|
int level = StaticPrefs::security_sandbox_content_level_DoNotUseDirectly();
|
|
#if !defined(NIGHTLY_BUILD) && (defined(XP_WIN) || defined(XP_MACOSX))
|
|
// On non-Nightly Windows and macOS, enforce a minimum sandbox level of 1.
|
|
static const int minimumLevel = 1;
|
|
#elif defined(NIGHTLY_BUILD) && defined(XP_WIN)
|
|
// On Windows Nightly, enforce a minimum sandbox level of 6.
|
|
static const int minimumLevel = 6;
|
|
#else
|
|
static const int minimumLevel = 0;
|
|
#endif
|
|
if (level < minimumLevel) {
|
|
level = minimumLevel;
|
|
}
|
|
#ifdef XP_LINUX
|
|
// Level 1 was a configuration with default-deny seccomp-bpf but
|
|
// which allowed direct filesystem access; that required additional
|
|
// code for the syscall filter which was untested and tended to
|
|
// bit-rot. It was trivially escapable and was no longer being used
|
|
// even for debugging, so it has been removed.
|
|
//
|
|
// If the content sandbox is enabled, enforce a minimum level of 2.
|
|
static constexpr int kMinSupportedLevel = 2;
|
|
|
|
if (level > 0 && level <= kMinSupportedLevel) {
|
|
level = kMinSupportedLevel;
|
|
}
|
|
// Level 4 and up will break direct access to audio.
|
|
if (level > 3 && !StaticPrefs::media_cubeb_sandbox()) {
|
|
level = 3;
|
|
}
|
|
// Turn off ioctl lockdown in safe mode, until it's gotten more testing.
|
|
if (level > 5 && gSafeMode) {
|
|
level = 5;
|
|
}
|
|
#endif
|
|
#if defined(XP_WIN)
|
|
// Sandbox level 8, which uses a USER_RESTRICTED access token level, breaks if
|
|
// prefs moving processing out of the content process are not the default.
|
|
if (level >= 8 &&
|
|
(!IsWebglOutOfProcessEnabled() ||
|
|
!PDMFactory::AllDecodersAreRemote()
|
|
# if defined(MOZ_WEBRTC) && !defined(MOZ_THUNDERBIRD)
|
|
// These are only relevant if webrtc is present. Thunderbird currently
|
|
// compiles with webrtc, but doesn't use it.
|
|
|| !StaticPrefs::network_process_enabled() ||
|
|
!Preferences::GetBool("media.peerconnection.mtransport_process")
|
|
# endif
|
|
)) {
|
|
level = 7;
|
|
}
|
|
#endif
|
|
|
|
return level;
|
|
}
|
|
|
|
bool IsContentSandboxEnabled() { return GetEffectiveContentSandboxLevel() > 0; }
|
|
|
|
int GetEffectiveSocketProcessSandboxLevel() {
|
|
if (PR_GetEnv("MOZ_DISABLE_SOCKET_PROCESS_SANDBOX")) {
|
|
return 0;
|
|
}
|
|
|
|
int level =
|
|
StaticPrefs::security_sandbox_socket_process_level_DoNotUseDirectly();
|
|
|
|
#ifdef XP_LINUX
|
|
// Turn off ioctl lockdown in safe mode, until it's gotten more testing.
|
|
if (level > 1 && gSafeMode) {
|
|
level = 1;
|
|
}
|
|
#endif
|
|
|
|
return level;
|
|
}
|
|
|
|
int GetEffectiveGpuSandboxLevel() {
|
|
return StaticPrefs::security_sandbox_gpu_level();
|
|
}
|
|
|
|
#if defined(MOZ_PROFILE_GENERATE)
|
|
// It should only be allowed on instrumented builds, never on production
|
|
// builds.
|
|
# if defined(XP_WIN)
|
|
bool GetLlvmProfileDir(std::wstring& parentPath) {
|
|
bool rv = false;
|
|
if (const wchar_t* llvmProfileFileEnv = _wgetenv(L"LLVM_PROFILE_FILE")) {
|
|
std::wstring llvmProfileDir(llvmProfileFileEnv);
|
|
const size_t found = llvmProfileDir.find_last_of(L"/\\");
|
|
if (found != std::string::npos) {
|
|
parentPath = llvmProfileDir.substr(0, found);
|
|
parentPath.append(L"\\*");
|
|
rv = true;
|
|
}
|
|
}
|
|
return rv;
|
|
}
|
|
# else // defined(XP_WIN)
|
|
bool GetLlvmProfileDir(std::string& parentPath) {
|
|
bool rv = false;
|
|
if (const char* llvmProfileFileEnv = getenv("LLVM_PROFILE_FILE")) {
|
|
std::string llvmProfileDir(llvmProfileFileEnv);
|
|
const size_t found = llvmProfileDir.find_last_of("/\\");
|
|
if (found != std::string::npos) {
|
|
parentPath = llvmProfileDir.substr(0, found);
|
|
rv = true;
|
|
}
|
|
}
|
|
return rv;
|
|
}
|
|
# endif // defined(XP_WIN)
|
|
#endif // defined(MOZ_PROFILE_GENERATE
|
|
|
|
#if defined(XP_MACOSX)
|
|
int ClampFlashSandboxLevel(const int aLevel) {
|
|
const int minLevel = 0;
|
|
const int maxLevel = 3;
|
|
|
|
if (aLevel < minLevel) {
|
|
return minLevel;
|
|
}
|
|
|
|
if (aLevel > maxLevel) {
|
|
return maxLevel;
|
|
}
|
|
return aLevel;
|
|
}
|
|
#endif
|
|
|
|
class SandboxSettings final : public mozISandboxSettings {
|
|
public:
|
|
NS_DECL_ISUPPORTS
|
|
NS_DECL_MOZISANDBOXSETTINGS
|
|
|
|
SandboxSettings() = default;
|
|
|
|
private:
|
|
~SandboxSettings() = default;
|
|
};
|
|
|
|
NS_IMPL_ISUPPORTS(SandboxSettings, mozISandboxSettings)
|
|
|
|
NS_IMETHODIMP SandboxSettings::GetEffectiveContentSandboxLevel(
|
|
int32_t* aRetVal) {
|
|
*aRetVal = mozilla::GetEffectiveContentSandboxLevel();
|
|
return NS_OK;
|
|
}
|
|
|
|
NS_IMETHODIMP SandboxSettings::GetContentWin32kLockdownState(int32_t* aRetVal) {
|
|
*aRetVal = static_cast<int32_t>(mozilla::GetContentWin32kLockdownState());
|
|
return NS_OK;
|
|
}
|
|
|
|
NS_IMETHODIMP
|
|
SandboxSettings::GetContentWin32kLockdownStateString(nsAString& aString) {
|
|
nsIXULRuntime::ContentWin32kLockdownState lockdownState =
|
|
mozilla::GetContentWin32kLockdownState();
|
|
aString = NS_ConvertASCIItoUTF16(
|
|
mozilla::ContentWin32kLockdownStateToString(lockdownState));
|
|
return NS_OK;
|
|
}
|
|
|
|
} // namespace mozilla
|
|
|
|
NS_IMPL_COMPONENT_FACTORY(mozISandboxSettings) {
|
|
return MakeAndAddRef<SandboxSettings>().downcast<nsISupports>();
|
|
}
|