adb9ba0744
See the previous commit, about content sandbox level 6, for details; this is basically the same (except with one more ioctl allowlisted, and controlled by a different pref). This patch also adds some plumbing to get the socket sandbox level into the code that constructs the policy, modeled on how it works for content processes. (Previously the only levels of the socket process sandbox were "on" and "off" so that wasn't necessary until now.) Differential Revision: https://phabricator.services.mozilla.com/D249018
103 lines
3.8 KiB
C++
103 lines
3.8 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
|
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
|
* You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#ifndef mozilla_Sandbox_h
|
|
#define mozilla_Sandbox_h
|
|
|
|
#include "mozilla/Maybe.h"
|
|
#include "mozilla/Types.h"
|
|
#include "mozilla/UniquePtrExtensions.h"
|
|
#include "nsXULAppAPI.h"
|
|
#include <vector>
|
|
|
|
#include "mozilla/ipc/UtilityProcessSandboxing.h"
|
|
|
|
// This defines the entry points for a content process to start
|
|
// sandboxing itself. See also SandboxInfo.h for what parts of
|
|
// sandboxing are enabled/supported.
|
|
|
|
namespace mozilla {
|
|
|
|
namespace ipc {
|
|
class FileDescriptor;
|
|
} // namespace ipc
|
|
|
|
// This must be called early, before glib creates any worker threads.
|
|
// (See bug 1176099.)
|
|
MOZ_EXPORT void SandboxEarlyInit(
|
|
Maybe<mozilla::UniqueFileHandle>&& aSandboxReporter,
|
|
Maybe<mozilla::UniqueFileHandle>&& aChrootClient);
|
|
|
|
// A collection of sandbox parameters that have to be extracted from
|
|
// prefs or other libxul facilities and passed down, because
|
|
// libmozsandbox can't link against the APIs to read them.
|
|
struct ContentProcessSandboxParams {
|
|
// Content sandbox level; see also GetEffectiveSandboxLevel in
|
|
// SandboxSettings.h and the comments for the Linux version of
|
|
// "security.sandbox.content.level" in browser/app/profile/firefox.js
|
|
int mLevel = 0;
|
|
// The filesystem broker client file descriptor, or -1 to allow
|
|
// direct filesystem access. (Warning: this is not a RAII class and
|
|
// will not close the fd on destruction.)
|
|
int mBrokerFd = -1;
|
|
// Determines whether we allow reading all files, for processes that
|
|
// render file:/// URLs.
|
|
bool mFileProcess = false;
|
|
// Syscall numbers to allow even if the seccomp-bpf policy otherwise
|
|
// wouldn't.
|
|
std::vector<int> mSyscallWhitelist;
|
|
|
|
static ContentProcessSandboxParams ForThisProcess(
|
|
const Maybe<ipc::FileDescriptor>& aBroker);
|
|
};
|
|
|
|
// Similarly to ContentProcessSandboxParams, a collection of
|
|
// parameters for the socket process. Currently this is just the
|
|
// level (and the broker), but in the future there could be more.
|
|
struct SocketProcessSandboxParams {
|
|
// Socket process sandbox level; see also GetEffectiveSandboxLevel
|
|
// and the comments for "security.sandbox.socket.process.level" in
|
|
// browser/app/profile/firefox.js
|
|
int mLevel = 0;
|
|
|
|
// The filesystem broker client fd; this *is* a RAII class so it
|
|
// needs to be `release()`d or moved to consume it.
|
|
mozilla::UniqueFileHandle mBroker;
|
|
|
|
static SocketProcessSandboxParams ForThisProcess(
|
|
const Maybe<ipc::FileDescriptor>& aBroker);
|
|
};
|
|
|
|
// Call only if SandboxInfo::CanSandboxContent() returns true.
|
|
// (No-op if the sandbox is disabled.)
|
|
// isFileProcess determines whether we allow system wide file reads.
|
|
MOZ_EXPORT bool SetContentProcessSandbox(ContentProcessSandboxParams&& aParams);
|
|
|
|
// Call only if SandboxInfo::CanSandboxMedia() returns true.
|
|
// (No-op if MOZ_DISABLE_GMP_SANDBOX is set.)
|
|
// aFilePath is the path to the plugin file.
|
|
MOZ_EXPORT void SetMediaPluginSandbox(const char* aFilePath);
|
|
|
|
MOZ_EXPORT void SetRemoteDataDecoderSandbox(int aBroker);
|
|
|
|
MOZ_EXPORT void SetSocketProcessSandbox(SocketProcessSandboxParams&& aParams);
|
|
|
|
MOZ_EXPORT void SetUtilitySandbox(int aBroker, ipc::SandboxingKind aKind);
|
|
|
|
// We want to turn on/off crashing on error when running some tests
|
|
// This will return current value and set the aValue we pass
|
|
MOZ_EXPORT bool SetSandboxCrashOnError(bool aValue);
|
|
|
|
// Call SandboxProfiler::Create to make sure SandboxProfiler exists if it should
|
|
// exists, i.e., profiler symbols were found and the profiler is running
|
|
MOZ_EXPORT void CreateSandboxProfiler();
|
|
|
|
MOZ_EXPORT void DestroySandboxProfiler();
|
|
|
|
} // namespace mozilla
|
|
|
|
#endif // mozilla_Sandbox_h
|