- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.3.0esr-7.5-2] fixup! Bug 16010: Fixing sandbox compile issues
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 2354d122644d82df54d655ece5b42bdfa4cf38f8 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 21 20:48:42 2017 +0000 fixup! Bug 16010: Fixing sandbox compile issues --- .../sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h index ed45f22bf0ff..e488712e4cdf 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h +++ b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h @@ -150,7 +150,7 @@ struct Opcode { // flag. unsigned int flag_dest_; unsigned int flag_source_; - unsigned flag_aux_; + unsigned int flag_aux_; // We indicate the mnemonic for debugging purposes const char* mnemonic_;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] We don't take the SANDBOX_EXPORTS path and fix compile issues along our way
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 0b5dfeae5d09168e020acd2f630c5352674075ab Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 18 19:06:56 2017 +0000 We don't take the SANDBOX_EXPORTS path and fix compile issues along our way --- security/sandbox/chromium/sandbox/win/src/interception.h | 4 ++-- security/sandbox/moz.build | 2 +- security/sandbox/win/src/sandboxbroker/moz.build | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/security/sandbox/chromium/sandbox/win/src/interception.h b/security/sandbox/chromium/sandbox/win/src/interception.h index 850e4eef54c6..ceff4b62d1a0 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.h +++ b/security/sandbox/chromium/sandbox/win/src/interception.h @@ -268,7 +268,7 @@ class InterceptionManager { #define ADD_NT_INTERCEPTION(service, id, num_params) \ AddToPatchedFunctions(kNtdllName, #service, \ sandbox::INTERCEPTION_SERVICE_CALL, \ - MAKE_SERVICE_NAME(service), id) + (void*)MAKE_SERVICE_NAME(service), id) #define INTERCEPT_NT(manager, service, id, num_params) \ manager->ADD_NT_INTERCEPTION(service, id, num_params) @@ -279,7 +279,7 @@ class InterceptionManager { // we are guaranteed that our IAT has been initialized. #define INTERCEPT_EAT(manager, dll, function, id, num_params) \ manager->AddToPatchedFunctions(dll, #function, sandbox::INTERCEPTION_EAT, \ - MAKE_SERVICE_NAME(function), id) + (void*)MAKE_SERVICE_NAME(function), id) #endif // SANDBOX_EXPORTS } // namespace sandbox diff --git a/security/sandbox/moz.build b/security/sandbox/moz.build index 1420d6498af9..7b9cb01e4e87 100644 --- a/security/sandbox/moz.build +++ b/security/sandbox/moz.build @@ -154,7 +154,7 @@ elif CONFIG['OS_ARCH'] == 'WINNT': 'chromium/sandbox/win/src/Wow64.cc', ] - for var in ('UNICODE', '_UNICODE', 'NS_NO_XPCOM', 'SANDBOX_EXPORTS', + for var in ('UNICODE', '_UNICODE', 'NS_NO_XPCOM', '_CRT_RAND_S', 'CHROMIUM_SANDBOX_BUILD'): DEFINES[var] = True diff --git a/security/sandbox/win/src/sandboxbroker/moz.build b/security/sandbox/win/src/sandboxbroker/moz.build index 4a9d01cc5fa5..4df77d232f38 100644 --- a/security/sandbox/win/src/sandboxbroker/moz.build +++ b/security/sandbox/win/src/sandboxbroker/moz.build @@ -12,7 +12,7 @@ EXPORTS += [ 'sandboxBroker.h', ] -for var in ('UNICODE', '_UNICODE', 'SANDBOX_EXPORTS'): +for var in ('UNICODE', '_UNICODE'): DEFINES[var] = True LOCAL_INCLUDES += [

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 6cafd21960e74a78317330c8559f643e4beac165 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 11 08:09:56 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. Enabling sandbox compiling for Windows platform --- .mozconfig-mingw | 3 --- 1 file changed, 3 deletions(-) diff --git a/.mozconfig-mingw b/.mozconfig-mingw index af305737e647..dfb33264d8a9 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -18,9 +18,6 @@ ac_add_options --enable-tor-browser-update ac_add_options --enable-signmar ac_add_options --enable-verify-mar -# We can't build the sandbox code with mingw-w64: -# https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 -ac_add_options --disable-sandbox # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 16010: Fixing sandbox compile issues
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 99e8c2c94986940de47d5f50a4b863cb6127df3d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 11 08:08:39 2017 +0000 Bug 16010: Fixing sandbox compile issues --- dom/media/gmp/rlz/GMPDeviceBinding.cpp | 2 +- js/xpconnect/src/XPCShellImpl.cpp | 2 +- security/sandbox/chromium-shim/base/win/sdkdecls.h | 2 +- .../sandbox/chromium/base/strings/utf_string_conversion_utils.cc | 4 ++-- security/sandbox/chromium/base/threading/platform_thread_win.cc | 2 ++ security/sandbox/chromium/base/time/time_win.cc | 2 +- security/sandbox/chromium/base/win/pe_image.h | 2 +- security/sandbox/chromium/base/win/scoped_handle.h | 2 +- security/sandbox/chromium/sandbox/win/src/acl.h | 2 +- security/sandbox/chromium/sandbox/win/src/app_container.cc | 6 +++--- security/sandbox/chromium/sandbox/win/src/broker_services.cc | 2 +- security/sandbox/chromium/sandbox/win/src/crosscall_params.h | 3 +++ security/sandbox/chromium/sandbox/win/src/handle_closer.cc | 2 +- security/sandbox/chromium/sandbox/win/src/interception.cc | 8 ++++---- security/sandbox/chromium/sandbox/win/src/interception.h | 1 + security/sandbox/chromium/sandbox/win/src/interception_internal.h | 1 + security/sandbox/chromium/sandbox/win/src/resolver.cc | 2 +- security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc | 8 ++++++++ security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h | 2 ++ security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc | 2 +- security/sandbox/chromium/sandbox/win/src/service_resolver.cc | 2 +- .../chromium/sandbox/win/src/sidestep/mini_disassembler_types.h | 6 +++--- security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc | 8 ++++++-- security/sandbox/chromium/sandbox/win/src/target_process.cc | 4 ++-- toolkit/xre/nsAppRunner.cpp | 2 +- 25 files changed, 50 insertions(+), 29 deletions(-) diff --git a/dom/media/gmp/rlz/GMPDeviceBinding.cpp b/dom/media/gmp/rlz/GMPDeviceBinding.cpp index c8aee2bcd898..f3e3747e04c2 100644 --- a/dom/media/gmp/rlz/GMPDeviceBinding.cpp +++ b/dom/media/gmp/rlz/GMPDeviceBinding.cpp @@ -62,7 +62,7 @@ GetStackAfterCurrentFrame(uint8_t** aOutTop, uint8_t** aOutBottom) { // "Top" of the free space on the stack is directly after the memory // holding our return address. - uint8_t* top = (uint8_t*)_AddressOfReturnAddress(); + uint8_t* top = (uint8_t*)__builtin_return_address(0);//_AddressOfReturnAddress(); // Look down the stack until we find the guard page... MEMORY_BASIC_INFORMATION memInfo = {0}; diff --git a/js/xpconnect/src/XPCShellImpl.cpp b/js/xpconnect/src/XPCShellImpl.cpp index d86b5c5d3e3d..bedcb9132fef 100644 --- a/js/xpconnect/src/XPCShellImpl.cpp +++ b/js/xpconnect/src/XPCShellImpl.cpp @@ -45,7 +45,7 @@ #include "mozilla/widget/AudioSession.h" #include <windows.h> #if defined(MOZ_SANDBOX) -#include "SandboxBroker.h" +#include "sandboxBroker.h" #endif #endif diff --git a/security/sandbox/chromium-shim/base/win/sdkdecls.h b/security/sandbox/chromium-shim/base/win/sdkdecls.h index e999ab967b72..127bfaabf5e9 100644 --- a/security/sandbox/chromium-shim/base/win/sdkdecls.h +++ b/security/sandbox/chromium-shim/base/win/sdkdecls.h @@ -115,7 +115,7 @@ QueryThreadCycleTime( #define PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_RESERVED (0x00000003 << 28) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_MASK (0x00000003ui64 << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_DEFER (0x00000000ui64 << 32) -#define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON (0x00000001ui64 << 32) +#define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON (0x00000001uLL << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_OFF (0x00000002ui64 << 32) #define PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_RESERVED (0x00000003ui64 << 32) diff --git a/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc b/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc index 3101a6028883..710fbd83a358 100644 --- a/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc +++ b/security/sandbox/chromium/base/strings/utf_string_conversion_utils.cc @@ -122,7 +122,7 @@ void PrepareForUTF8Output(const CHAR* src, // Instantiate versions we know callers will need. template void PrepareForUTF8Output(const wchar_t*, size_t, std::string*); -template void PrepareForUTF8Output(const char16*, size_t, std::string*); +//template void PrepareForUTF8Output(const char16*, size_t, std::string*); template<typename STRING> void PrepareForUTF16Or32Output(const char* src, @@ -143,6 +143,6 @@ void PrepareForUTF16Or32Output(const char* src, // Instantiate versions we know callers will need. template void PrepareForUTF16Or32Output(const char*, size_t, std::wstring*); -template void PrepareForUTF16Or32Output(const char*, size_t, string16*); +//template void PrepareForUTF16Or32Output(const char*, size_t, string16*); } // namespace base diff --git a/security/sandbox/chromium/base/threading/platform_thread_win.cc b/security/sandbox/chromium/base/threading/platform_thread_win.cc index d5bd9bed08e7..9750d99ed5fe 100644 --- a/security/sandbox/chromium/base/threading/platform_thread_win.cc +++ b/security/sandbox/chromium/base/threading/platform_thread_win.cc @@ -38,11 +38,13 @@ void SetNameInternal(PlatformThreadId thread_id, const char* name) { info.dwThreadID = thread_id; info.dwFlags = 0; +#if 0 __try { RaiseException(kVCThreadNameException, 0, sizeof(info)/sizeof(DWORD), reinterpret_cast<DWORD_PTR*>(&info)); } __except(EXCEPTION_CONTINUE_EXECUTION) { } +#endif } struct ThreadParams { diff --git a/security/sandbox/chromium/base/time/time_win.cc b/security/sandbox/chromium/base/time/time_win.cc index dc968ad63980..96ec6e2592cb 100644 --- a/security/sandbox/chromium/base/time/time_win.cc +++ b/security/sandbox/chromium/base/time/time_win.cc @@ -356,7 +356,7 @@ TimeDelta RolloverProtectedNow() { // we keep last_seen_now stay correctly in sync. DWORD now = g_tick_function(); if (now < g_last_seen_now) - g_rollover_ms += 0x100000000I64; // ~49.7 days. + g_rollover_ms += 0x100000000LL; // ~49.7 days. g_last_seen_now = now; return TimeDelta::FromMilliseconds(now + g_rollover_ms); } diff --git a/security/sandbox/chromium/base/win/pe_image.h b/security/sandbox/chromium/base/win/pe_image.h index 4c36bcf850e6..66897186d075 100644 --- a/security/sandbox/chromium/base/win/pe_image.h +++ b/security/sandbox/chromium/base/win/pe_image.h @@ -17,7 +17,7 @@ // The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h. #undef FACILITY_VISUALCPP #endif -#include <DelayIMP.h> +#include <delayimp.h> namespace base { namespace win { diff --git a/security/sandbox/chromium/base/win/scoped_handle.h b/security/sandbox/chromium/base/win/scoped_handle.h index 404ab669385a..a5d9a5fe1c23 100644 --- a/security/sandbox/chromium/base/win/scoped_handle.h +++ b/security/sandbox/chromium/base/win/scoped_handle.h @@ -18,7 +18,7 @@ #include <intrin.h> #define BASE_WIN_GET_CALLER _ReturnAddress() #elif defined(COMPILER_GCC) -#define BASE_WIN_GET_CALLER __builtin_extract_return_addr(\\ +#define BASE_WIN_GET_CALLER __builtin_extract_return_addr(\ __builtin_return_address(0)) #endif diff --git a/security/sandbox/chromium/sandbox/win/src/acl.h b/security/sandbox/chromium/sandbox/win/src/acl.h index b5021e7be865..098bc576c75c 100644 --- a/security/sandbox/chromium/sandbox/win/src/acl.h +++ b/security/sandbox/chromium/sandbox/win/src/acl.h @@ -5,7 +5,7 @@ #ifndef SANDBOX_SRC_ACL_H_ #define SANDBOX_SRC_ACL_H_ -#include <AccCtrl.h> +#include <accctrl.h> #include <windows.h> #include "base/memory/scoped_ptr.h" diff --git a/security/sandbox/chromium/sandbox/win/src/app_container.cc b/security/sandbox/chromium/sandbox/win/src/app_container.cc index a51f09208239..a9919a1cac22 100644 --- a/security/sandbox/chromium/sandbox/win/src/app_container.cc +++ b/security/sandbox/chromium/sandbox/win/src/app_container.cc @@ -4,7 +4,7 @@ #include "sandbox/win/src/app_container.h" -#include <Sddl.h> +#include <sddl.h> #include <stddef.h> #include <vector> @@ -27,10 +27,10 @@ PSID ConvertSid(const base::string16& sid) { template <typename T> T BindFunction(const char* name) { HMODULE module = GetModuleHandle(sandbox::kKerneldllName); - void* function = GetProcAddress(module, name); + void* function = (void*)GetProcAddress(module, name); if (!function) { module = GetModuleHandle(sandbox::kKernelBasedllName); - function = GetProcAddress(module, name); + function = (void*)GetProcAddress(module, name); } return reinterpret_cast<T>(function); } diff --git a/security/sandbox/chromium/sandbox/win/src/broker_services.cc b/security/sandbox/chromium/sandbox/win/src/broker_services.cc index d6acb66fdd79..1ea5da796363 100644 --- a/security/sandbox/chromium/sandbox/win/src/broker_services.cc +++ b/security/sandbox/chromium/sandbox/win/src/broker_services.cc @@ -4,7 +4,7 @@ #include "sandbox/win/src/broker_services.h" -#include <AclAPI.h> +#include <aclapi.h> #include <stddef.h> #include "base/logging.h" diff --git a/security/sandbox/chromium/sandbox/win/src/crosscall_params.h b/security/sandbox/chromium/sandbox/win/src/crosscall_params.h index eb59c44239e2..dd1591304320 100644 --- a/security/sandbox/chromium/sandbox/win/src/crosscall_params.h +++ b/security/sandbox/chromium/sandbox/win/src/crosscall_params.h @@ -16,6 +16,9 @@ #include "sandbox/win/src/internal_types.h" #include "sandbox/win/src/sandbox_types.h" +#define __try if(true) +#define __except(x) else + // Increases |value| until there is no need for padding given an int64_t // alignment. Returns the increased value. inline uint32_t Align(uint32_t value) { diff --git a/security/sandbox/chromium/sandbox/win/src/handle_closer.cc b/security/sandbox/chromium/sandbox/win/src/handle_closer.cc index f2012b7e071f..670a64721537 100644 --- a/security/sandbox/chromium/sandbox/win/src/handle_closer.cc +++ b/security/sandbox/chromium/sandbox/win/src/handle_closer.cc @@ -145,7 +145,7 @@ bool HandleCloser::SetupHandleList(void* buffer, size_t buffer_bytes) { output = &list_entry->handle_type[0]; // Copy the typename and set the offset and count. - i->first._Copy_s(output, i->first.size(), i->first.size()); + i->first.copy(output, i->first.size()); *(output += i->first.size()) = L'\0'; output++; list_entry->offset_to_names = reinterpret_cast<char*>(output) - diff --git a/security/sandbox/chromium/sandbox/win/src/interception.cc b/security/sandbox/chromium/sandbox/win/src/interception.cc index f0a2a61fb379..9eec063f3888 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.cc +++ b/security/sandbox/chromium/sandbox/win/src/interception.cc @@ -23,7 +23,7 @@ #include "sandbox/win/src/service_resolver.h" #include "sandbox/win/src/target_interceptions.h" #include "sandbox/win/src/target_process.h" -#include "sandbox/win/src/wow64.h" +#include "sandbox/win/src/Wow64.h" namespace sandbox { @@ -265,7 +265,7 @@ bool InterceptionManager::SetupDllInfo(const InterceptionData& data, dll_info->record_bytes = required; dll_info->offset_to_functions = required; dll_info->num_functions = 0; - data.dll._Copy_s(dll_info->dll_name, data.dll.size(), data.dll.size()); + data.dll.copy(dll_info->dll_name, data.dll.size()); dll_info->dll_name[data.dll.size()] = L'\0'; return true; @@ -307,12 +307,12 @@ bool InterceptionManager::SetupInterceptionInfo(const InterceptionData& data, function->interceptor_address = data.interceptor_address; char* names = function->function; - data.function._Copy_s(names, name_bytes, name_bytes); + data.function.copy(names, name_bytes); names += name_bytes; *names++ = '\0'; // interceptor follows the function_name - data.interceptor._Copy_s(names, interceptor_bytes, interceptor_bytes); + data.interceptor.copy(names, interceptor_bytes); names += interceptor_bytes; *names++ = '\0'; diff --git a/security/sandbox/chromium/sandbox/win/src/interception.h b/security/sandbox/chromium/sandbox/win/src/interception.h index 4d1ee82ba399..850e4eef54c6 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception.h +++ b/security/sandbox/chromium/sandbox/win/src/interception.h @@ -18,6 +18,7 @@ #include "base/macros.h" #include "base/strings/string16.h" #include "sandbox/win/src/sandbox_types.h" +#include "sandbox/win/src/interceptors.h" namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/interception_internal.h b/security/sandbox/chromium/sandbox/win/src/interception_internal.h index 45a0557e5efe..7f9cd0d763f0 100644 --- a/security/sandbox/chromium/sandbox/win/src/interception_internal.h +++ b/security/sandbox/chromium/sandbox/win/src/interception_internal.h @@ -12,6 +12,7 @@ #include <stddef.h> #include "sandbox/win/src/sandbox_types.h" +#include "sandbox/win/src/interceptors.h" namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/resolver.cc b/security/sandbox/chromium/sandbox/win/src/resolver.cc index d1719da51a57..508a305a140a 100644 --- a/security/sandbox/chromium/sandbox/win/src/resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/resolver.cc @@ -53,7 +53,7 @@ NTSTATUS ResolverThunk::ResolveInterceptor(const void* interceptor_module, if (!pe.VerifyMagic()) return STATUS_INVALID_IMAGE_FORMAT; - *address = pe.GetProcAddress(interceptor_name); + *address = (void*)pe.GetProcAddress(interceptor_name); if (!(*address)) return STATUS_PROCEDURE_NOT_FOUND; diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc index 62f2422ca432..408d544a55e4 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.cc @@ -13,6 +13,9 @@ #include "sandbox/win/src/sandbox_factory.h" #include "sandbox/win/src/target_services.h" +#define __try if(true) +#define __except(x) else + namespace sandbox { // This is the list of all imported symbols from ntdll.dll. @@ -645,6 +648,11 @@ void* operator new(size_t size, sandbox::AllocationType type, return result; } +void* operator new [](size_t size, sandbox::AllocationType type, + void* near_to) { + return operator new(size, type, near_to); +} + void operator delete(void* memory, sandbox::AllocationType type) { if (type == sandbox::NT_ALLOC) { // Use default flags. diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h index 3e0238206768..d0bc4174ce46 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_nt_util.h @@ -16,6 +16,8 @@ // Placement new and delete to be used from ntdll interception code. void* __cdecl operator new(size_t size, sandbox::AllocationType type, void* near_to = NULL); +void* __cdecl operator new[](size_t size, sandbox::AllocationType type, + void* near_to = NULL); void __cdecl operator delete(void* memory, sandbox::AllocationType type); // Add operator delete that matches the placement form of the operator new // above. This is required by compiler to generate code to call operator delete diff --git a/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc b/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc index b3f977374b33..92d3e721fcec 100644 --- a/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc +++ b/security/sandbox/chromium/sandbox/win/src/sandbox_rand.cc @@ -10,7 +10,7 @@ // "Community Additions" comment on MSDN here: // http://msdn.microsoft.com/en-us/library/windows/desktop/aa387694.aspx #define SystemFunction036 NTAPI SystemFunction036 -#include <NTSecAPI.h> +#include <ntsecapi.h> #undef SystemFunction036 namespace sandbox { diff --git a/security/sandbox/chromium/sandbox/win/src/service_resolver.cc b/security/sandbox/chromium/sandbox/win/src/service_resolver.cc index 92f21a7c2c95..0e63d704f4e0 100644 --- a/security/sandbox/chromium/sandbox/win/src/service_resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/service_resolver.cc @@ -29,7 +29,7 @@ NTSTATUS ServiceResolverThunk::ResolveTarget(const void* module, return STATUS_UNSUCCESSFUL; base::win::PEImage module_image(module); - *address = module_image.GetProcAddress(function_name); + *address = (void*)module_image.GetProcAddress(function_name); if (NULL == *address) { NOTREACHED_NT(); diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h index 1c1062631340..ed45f22bf0ff 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h +++ b/security/sandbox/chromium/sandbox/win/src/sidestep/mini_disassembler_types.h @@ -148,9 +148,9 @@ struct Opcode { // Description of the type of the dest, src and aux operands, // put together from an enOperandType flag and an enAddressingMethod // flag. - int flag_dest_; - int flag_source_; - int flag_aux_; + unsigned int flag_dest_; + unsigned int flag_source_; + unsigned flag_aux_; // We indicate the mnemonic for debugging purposes const char* mnemonic_; diff --git a/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc b/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc index d5da2fbe95a5..072be907146b 100644 --- a/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc +++ b/security/sandbox/chromium/sandbox/win/src/sidestep_resolver.cc @@ -108,14 +108,14 @@ NTSTATUS SmartSidestepResolverThunk::Setup(const void* target_module, // to our internal smart interceptor. size_t standard_bytes = storage_bytes - offsetof(SmartThunk, sidestep); ret = SidestepResolverThunk::Setup(target_module, interceptor_module, - target_name, NULL, &SmartStub, + target_name, NULL, (void*)&SmartStub, &thunk->sidestep, standard_bytes, NULL); if (!NT_SUCCESS(ret)) return ret; // Fix the internal thunk to pass the whole buffer to the interceptor. SetInternalThunk(&thunk->sidestep.internal_thunk, GetInternalThunkSize(), - thunk_storage, &SmartStub); + thunk_storage, (void*)&SmartStub); if (storage_used) *storage_used = GetThunkSize(); @@ -148,6 +148,7 @@ size_t SmartSidestepResolverThunk::GetThunkSize() const { // [xxx] [saved ebx] [xxx] // [xxx] [saved ecx] [xxx] // [xxx] [saved edx] [xxx] +#if 0 __declspec(naked) void SmartSidestepResolverThunk::SmartStub() { __asm { @@ -189,6 +190,9 @@ void SmartSidestepResolverThunk::SmartStub() { ret // Jump to original function. } } +#else +void SmartSidestepResolverThunk::SmartStub() {} // FIXME !! +#endif bool SmartSidestepResolverThunk::IsInternalCall(const void* base, void* return_address) { diff --git a/security/sandbox/chromium/sandbox/win/src/target_process.cc b/security/sandbox/chromium/sandbox/win/src/target_process.cc index e27655e7ecfb..92be96cc4173 100644 --- a/security/sandbox/chromium/sandbox/win/src/target_process.cc +++ b/security/sandbox/chromium/sandbox/win/src/target_process.cc @@ -221,7 +221,7 @@ DWORD TargetProcess::Create(const wchar_t* exe_path, static_cast<PROCESS_INFORMATION_CLASS>(NtProcessInformationAccessToken), &process_access_token, sizeof(process_access_token)); if (!NT_SUCCESS(status)) { - win_result = ERROR_INVALID_TOKEN; + win_result = ::GetLastError(); //ERROR_INVALID_TOKEN; ::TerminateProcess(process_info.process_handle(), 0); // exit code return win_result; } @@ -244,7 +244,7 @@ ResultCode TargetProcess::TransferVariable(const char* name, void* address, if (NULL == module) return SBOX_ERROR_GENERIC; - child_var = ::GetProcAddress(module, name); + child_var = (void*)::GetProcAddress(module, name); ::FreeLibrary(module); if (NULL == child_var) diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 190fec19e520..bb469aa33100 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -213,7 +213,7 @@ #if defined(XP_LINUX) && !defined(ANDROID) #include "mozilla/SandboxInfo.h" #elif defined(XP_WIN) -#include "SandboxBroker.h" +#include "sandboxBroker.h" #endif #endif

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 5b224c4272f4752dea577c92f41b2f651778e975 Author: Haik Aftandilian <haftandilian(a)mozilla.com> Date: Fri Mar 3 09:50:29 2017 +0100 Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik MozReview-Commit-ID: 9tI2S6fEYkD --HG-- extra : rebase_source : 0a5d00f8498861e7ea281e527b2be6b2c4e472d6 --- .../sandbox/test/browser_content_sandbox_fs.js | 20 -------------------- .../test/browser_content_sandbox_syscalls.js | 22 +--------------------- 2 files changed, 1 insertion(+), 41 deletions(-) diff --git a/security/sandbox/test/browser_content_sandbox_fs.js b/security/sandbox/test/browser_content_sandbox_fs.js index 946f86bb9a92..7439bd46ee53 100644 --- a/security/sandbox/test/browser_content_sandbox_fs.js +++ b/security/sandbox/test/browser_content_sandbox_fs.js @@ -96,25 +96,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -124,12 +110,6 @@ add_task(function*() { let isFileIOSandboxed = isContentFileIOSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(isFileIOSandboxed, "content file I/O sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include file I/O sandboxing. ok(isFileIOSandboxed, "content file I/O sandboxing is enabled."); if (!isFileIOSandboxed) { diff --git a/security/sandbox/test/browser_content_sandbox_syscalls.js b/security/sandbox/test/browser_content_sandbox_syscalls.js index d56456966b8a..848b145429f2 100644 --- a/security/sandbox/test/browser_content_sandbox_syscalls.js +++ b/security/sandbox/test/browser_content_sandbox_syscalls.js @@ -104,7 +104,7 @@ function areContentSyscallsSandboxed(level) { syscallsSandboxMinLevel = 1; break; case "Linux": - syscallsSandboxMinLevel = 2; + syscallsSandboxMinLevel = 1; break; default: Assert.ok(false, "Unknown OS"); @@ -140,25 +140,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -168,12 +154,6 @@ add_task(function*() { let areSyscallsSandboxed = areContentSyscallsSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(areSyscallsSandboxed, "content syscall sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include syscall sandboxing. ok(areSyscallsSandboxed, "content syscall sandboxing is enabled."); if (!areSyscallsSandboxed) {

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 08e00435a6657b00a06f7650276944d9b36ee36d Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Wed Nov 16 01:13:22 2016 -0500 Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld The sandboxing code generates this signal nowadays, which makes debugging with tools like rr quite frustrating. DONTBUILD because NPOTB --- .gdbinit | 1 + 1 file changed, 1 insertion(+) diff --git a/.gdbinit b/.gdbinit index dd9a005f67a1..08f1fc0f2011 100644 --- a/.gdbinit +++ b/.gdbinit @@ -16,6 +16,7 @@ handle SIGPIPE noprint nostop pass # sandboxing code on older kernels. handle SIG38 noprint nostop pass handle SIG64 noprint nostop pass +handle SIGSYS noprint nostop pass # Show the concrete types behind nsIFoo set print object on

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1374281. r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 722a1a652291a27657ed1a0b7eefd134519daa8f Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Jun 19 20:07:38 2017 +0200 Bug 1374281. r=jld MozReview-Commit-ID: Ko5m5i4Wkd6 --HG-- extra : rebase_source : 3076315ef3639a89f752addbb01d5d08a9c2db75 --- security/sandbox/linux/broker/SandboxBroker.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index a31d1fc6684a..d79656c3407f 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -360,6 +360,10 @@ AllowOpen(int aReqFlags, int aPerms) if (aReqFlags & O_CREAT) { needed |= SandboxBroker::MAY_CREATE; } + // Linux allows O_TRUNC even with O_RDONLY + if (aReqFlags & O_TRUNC) { + needed |= SandboxBroker::MAY_WRITE; + } return (aPerms & needed) == needed; }

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 8bf9587a88239cdac723a5b1c37ef46a90a49c21 Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Feb 27 18:01:33 2017 +0100 Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted MozReview-Commit-ID: 65aPquHzyfP --HG-- extra : rebase_source : 017080e3ae33289bb0b6a790027f9d02c380d47b --- old-configure.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/old-configure.in b/old-configure.in index 620e38b40eaa..24fb1f5fc5cc 100644 --- a/old-configure.in +++ b/old-configure.in @@ -3997,14 +3997,14 @@ if test -n "$gonkdir"; then MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX fi -case "$OS_TARGET:$NIGHTLY_BUILD" in -WINNT:*) +case "$OS_TARGET" in +WINNT) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Darwin:*) +Darwin) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Linux:1) +Linux) case $CPU_ARCH in x86_64|x86) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 018cc6d1fd6751a21bb46aa1b9afc7ca96a42c8c Author: Jed Davis <jld(a)mozilla.com> Date: Tue Aug 8 18:02:31 2017 -0600 Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp 1. X_OK is now allowed, and is limited only by the MAY_ACCESS permission. 2. The actual access() syscall is now used, if access is granted by the broker policy. This fixed bug 1382246, which explains the background. MozReview-Commit-ID: 926429PlBnL --HG-- extra : rebase_source : 6ae54c4c25e1389fa3af75b0bdf727323448294a --- security/sandbox/linux/broker/SandboxBroker.cpp | 14 ++------------ security/sandbox/linux/gtest/TestBroker.cpp | 15 +++++++++++---- 2 files changed, 13 insertions(+), 16 deletions(-) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index d79656c3407f..56215b89b232 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -306,7 +306,7 @@ AllowOperation(int aReqFlags, int aPerms) static bool AllowAccess(int aReqFlags, int aPerms) { - if (aReqFlags & ~(R_OK|W_OK|F_OK)) { + if (aReqFlags & ~(R_OK|W_OK|X_OK|F_OK)) { return false; } int needed = 0; @@ -569,17 +569,7 @@ SandboxBroker::ThreadMain(void) case SANDBOX_FILE_ACCESS: if (permissive || AllowAccess(req.mFlags, perms)) { - // This can't use access() itself because that uses the ruid - // and not the euid. In theory faccessat() with AT_EACCESS - // would work, but Linux doesn't actually implement the - // flags != 0 case; glibc has a hack which doesn't even work - // in this case so it'll ignore the flag, and Bionic just - // passes through the syscall and always ignores the flags. - // - // Instead, because we've already checked the requested - // r/w/x bits against the policy, just return success if the - // file exists and hope that's close enough. - if (stat(pathBuf, (struct stat*)&respBuf) == 0) { + if (access(pathBuf, req.mFlags) == 0) { resp.mError = 0; } else { resp.mError = -errno; diff --git a/security/sandbox/linux/gtest/TestBroker.cpp b/security/sandbox/linux/gtest/TestBroker.cpp index a311e181a9b1..bf5e58acbc40 100644 --- a/security/sandbox/linux/gtest/TestBroker.cpp +++ b/security/sandbox/linux/gtest/TestBroker.cpp @@ -133,6 +133,8 @@ SandboxBrokerTest::GetPolicy() const policy->AddPath(MAY_READ | MAY_WRITE, "/tmp", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublu", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublublu", AddAlways); + // This should be non-writable by the user running the test: + policy->AddPath(MAY_READ | MAY_WRITE, "/etc", AddAlways); return Move(policy); } @@ -206,6 +208,14 @@ TEST_F(SandboxBrokerTest, Access) EXPECT_EQ(-EACCES, Access("/proc/self", R_OK)); EXPECT_EQ(-EACCES, Access("/proc/self/stat", F_OK)); + + EXPECT_EQ(0, Access("/tmp", X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|W_OK|X_OK)); + EXPECT_EQ(0, Access("/proc/self", X_OK)); + + EXPECT_EQ(0, Access("/etc", R_OK|X_OK)); + EXPECT_EQ(-EACCES, Access("/etc", W_OK)); } TEST_F(SandboxBrokerTest, Stat) @@ -257,10 +267,7 @@ TEST_F(SandboxBrokerTest, Chmod) close(fd); // Set read only. SandboxBroker enforces 0600 mode flags. ASSERT_EQ(0, Chmod("/tmp/blublu", S_IRUSR)); - // SandboxBroker doesn't use real access(), it just checks against - // the policy. So it can't see the change in permisions here. - // This won't work: - // EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); + EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); statstruct realStat; EXPECT_EQ(0, statsyscall("/tmp/blublu", &realStat)); EXPECT_EQ((mode_t)S_IRUSR, realStat.st_mode & 0777);

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit e3693eef06cadfc24d50abe34ae1bedf0385c3f8 Author: Jed Davis <jld(a)mozilla.com> Date: Fri Jan 27 14:25:50 2017 -0700 Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp MozReview-Commit-ID: 1It6HNizbAc --HG-- extra : rebase_source : 1e96f11904abf2c38c5b4e50de7609ddc86cdd8a --- security/sandbox/linux/Sandbox.cpp | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/security/sandbox/linux/Sandbox.cpp b/security/sandbox/linux/Sandbox.cpp index 7f1182be9972..b4e65a1745df 100644 --- a/security/sandbox/linux/Sandbox.cpp +++ b/security/sandbox/linux/Sandbox.cpp @@ -73,6 +73,8 @@ int gSeccompTsyncBroadcastSignum = 0; namespace mozilla { +static bool gSandboxCrashOnError = false; + // This is initialized by SandboxSetCrashFunc(). SandboxCrashFunc gSandboxCrashFunc; @@ -148,15 +150,18 @@ SigSysHandler(int nr, siginfo_t *info, void *void_context) // TODO, someday when this is enabled on MIPS: include the two extra // args in the error message. SANDBOX_LOG_ERROR("seccomp sandbox violation: pid %d, syscall %d," - " args %d %d %d %d %d %d. Killing process.", + " args %d %d %d %d %d %d.%s", pid, syscall_nr, - args[0], args[1], args[2], args[3], args[4], args[5]); + args[0], args[1], args[2], args[3], args[4], args[5], + gSandboxCrashOnError ? " Killing process." : ""); - // Bug 1017393: record syscall number somewhere useful. - info->si_addr = reinterpret_cast<void*>(syscall_nr); + if (gSandboxCrashOnError) { + // Bug 1017393: record syscall number somewhere useful. + info->si_addr = reinterpret_cast<void*>(syscall_nr); - gSandboxCrashFunc(nr, info, &savedCtx); - _exit(127); + gSandboxCrashFunc(nr, info, &savedCtx); + _exit(127); + } } /** @@ -515,6 +520,21 @@ SandboxEarlyInit(GeckoProcessType aType) } MOZ_RELEASE_ASSERT(IsSingleThreaded()); + // Set gSandboxCrashOnError if appropriate. This doesn't need to + // happen this early, but for now it's here so that I don't need to + // add NSPR dependencies for PR_GetEnv. + // + // This also means that users with "unexpected threads" setups won't + // crash even on nightly. +#ifdef NIGHTLY_BUILD + gSandboxCrashOnError = true; +#endif + if (const char* envVar = getenv("MOZ_SANDBOX_CRASH_ON_ERROR")) { + if (envVar[0]) { + gSandboxCrashOnError = envVar[0] != '0'; + } + } + // Which kinds of resource isolation (of those that need to be set // up at this point) can be used by this process? bool canChroot = false;

1 0