- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit bf2b5cefbaddca978d5c5eca3b54f0f0af5c8d32 Author: Jed Davis <jld(a)mozilla.com> Date: Mon Nov 28 12:05:28 2016 -0700 Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd This applies only to content processes, where we already allow getrlimit (but not setrlimit). The rule added here does not allow using prlimit64 to set any resource limits or interact with any other process. MozReview-Commit-ID: nMry3t6QPj --HG-- extra : rebase_source : ecf792077a672ab1f2c5edf9fbeb915a0d8dd30e --- security/sandbox/linux/SandboxFilter.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f8db9dc802ea..018e9c64446c 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -735,6 +735,18 @@ public: CASES_FOR_getresgid: return Allow(); + case __NR_prlimit64: { + // Allow only the getrlimit() use case. (glibc seems to use + // only pid 0 to indicate the current process; pid == getpid() + // is equivalent and could also be allowed if needed.) + Arg<pid_t> pid(0); + // This is really a const struct ::rlimit*, but Arg<> doesn't + // work with pointers, only integer types. + Arg<uintptr_t> new_limit(2); + return If(AllOf(pid == 0, new_limit == 0), Allow()) + .Else(InvalidSyscall()); + } + case __NR_umask: case __NR_kill: case __NR_wait4:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 9a694d0d0cda658157ec2f86e68db0e72b556e04 Author: Jed Davis <jld(a)mozilla.com> Date: Mon May 1 21:51:11 2017 -0600 Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp MozReview-Commit-ID: 3M3T3bkx4nP --HG-- extra : rebase_source : b67332889615ae34cc67737da361f21ae545aeb4 --- security/sandbox/linux/SandboxFilter.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f1520aa29e15..7e1771a62665 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -531,6 +531,7 @@ public: case SYS_SEND: case SYS_SOCKET: // DANGEROUS case SYS_CONNECT: // DANGEROUS + case SYS_ACCEPT4: // Used by a11y; see bug 1361238 case SYS_GETSOCKOPT: case SYS_SETSOCKOPT: case SYS_GETSOCKNAME:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 5b224c4272f4752dea577c92f41b2f651778e975 Author: Haik Aftandilian <haftandilian(a)mozilla.com> Date: Fri Mar 3 09:50:29 2017 +0100 Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik MozReview-Commit-ID: 9tI2S6fEYkD --HG-- extra : rebase_source : 0a5d00f8498861e7ea281e527b2be6b2c4e472d6 --- .../sandbox/test/browser_content_sandbox_fs.js | 20 -------------------- .../test/browser_content_sandbox_syscalls.js | 22 +--------------------- 2 files changed, 1 insertion(+), 41 deletions(-) diff --git a/security/sandbox/test/browser_content_sandbox_fs.js b/security/sandbox/test/browser_content_sandbox_fs.js index 946f86bb9a92..7439bd46ee53 100644 --- a/security/sandbox/test/browser_content_sandbox_fs.js +++ b/security/sandbox/test/browser_content_sandbox_fs.js @@ -96,25 +96,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -124,12 +110,6 @@ add_task(function*() { let isFileIOSandboxed = isContentFileIOSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(isFileIOSandboxed, "content file I/O sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include file I/O sandboxing. ok(isFileIOSandboxed, "content file I/O sandboxing is enabled."); if (!isFileIOSandboxed) { diff --git a/security/sandbox/test/browser_content_sandbox_syscalls.js b/security/sandbox/test/browser_content_sandbox_syscalls.js index d56456966b8a..848b145429f2 100644 --- a/security/sandbox/test/browser_content_sandbox_syscalls.js +++ b/security/sandbox/test/browser_content_sandbox_syscalls.js @@ -104,7 +104,7 @@ function areContentSyscallsSandboxed(level) { syscallsSandboxMinLevel = 1; break; case "Linux": - syscallsSandboxMinLevel = 2; + syscallsSandboxMinLevel = 1; break; default: Assert.ok(false, "Unknown OS"); @@ -140,25 +140,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -168,12 +154,6 @@ add_task(function*() { let areSyscallsSandboxed = areContentSyscallsSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(areSyscallsSandboxed, "content syscall sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include syscall sandboxing. ok(areSyscallsSandboxed, "content syscall sandboxing is enabled."); if (!areSyscallsSandboxed) {

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 08e00435a6657b00a06f7650276944d9b36ee36d Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Wed Nov 16 01:13:22 2016 -0500 Bug 1317802 - don't stop for SIGSYS in .gdbinit; r=jld The sandboxing code generates this signal nowadays, which makes debugging with tools like rr quite frustrating. DONTBUILD because NPOTB --- .gdbinit | 1 + 1 file changed, 1 insertion(+) diff --git a/.gdbinit b/.gdbinit index dd9a005f67a1..08f1fc0f2011 100644 --- a/.gdbinit +++ b/.gdbinit @@ -16,6 +16,7 @@ handle SIGPIPE noprint nostop pass # sandboxing code on older kernels. handle SIG38 noprint nostop pass handle SIG64 noprint nostop pass +handle SIGSYS noprint nostop pass # Show the concrete types behind nsIFoo set print object on

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1374281. r=jld
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 722a1a652291a27657ed1a0b7eefd134519daa8f Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Jun 19 20:07:38 2017 +0200 Bug 1374281. r=jld MozReview-Commit-ID: Ko5m5i4Wkd6 --HG-- extra : rebase_source : 3076315ef3639a89f752addbb01d5d08a9c2db75 --- security/sandbox/linux/broker/SandboxBroker.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index a31d1fc6684a..d79656c3407f 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -360,6 +360,10 @@ AllowOpen(int aReqFlags, int aPerms) if (aReqFlags & O_CREAT) { needed |= SandboxBroker::MAY_CREATE; } + // Linux allows O_TRUNC even with O_RDONLY + if (aReqFlags & O_TRUNC) { + needed |= SandboxBroker::MAY_WRITE; + } return (aPerms & needed) == needed; }

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 8bf9587a88239cdac723a5b1c37ef46a90a49c21 Author: Gian-Carlo Pascutto <gcp(a)mozilla.com> Date: Mon Feb 27 18:01:33 2017 +0100 Bug 1337162 - Enable the Linux content sandbox for non-Nightly builds. r=ted MozReview-Commit-ID: 65aPquHzyfP --HG-- extra : rebase_source : 017080e3ae33289bb0b6a790027f9d02c380d47b --- old-configure.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/old-configure.in b/old-configure.in index 620e38b40eaa..24fb1f5fc5cc 100644 --- a/old-configure.in +++ b/old-configure.in @@ -3997,14 +3997,14 @@ if test -n "$gonkdir"; then MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX fi -case "$OS_TARGET:$NIGHTLY_BUILD" in -WINNT:*) +case "$OS_TARGET" in +WINNT) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Darwin:*) +Darwin) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX ;; -Linux:1) +Linux) case $CPU_ARCH in x86_64|x86) MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 018cc6d1fd6751a21bb46aa1b9afc7ca96a42c8c Author: Jed Davis <jld(a)mozilla.com> Date: Tue Aug 8 18:02:31 2017 -0600 Bug 1386279 - Renovate Linux sandbox file broker handling of access(). r=gcp 1. X_OK is now allowed, and is limited only by the MAY_ACCESS permission. 2. The actual access() syscall is now used, if access is granted by the broker policy. This fixed bug 1382246, which explains the background. MozReview-Commit-ID: 926429PlBnL --HG-- extra : rebase_source : 6ae54c4c25e1389fa3af75b0bdf727323448294a --- security/sandbox/linux/broker/SandboxBroker.cpp | 14 ++------------ security/sandbox/linux/gtest/TestBroker.cpp | 15 +++++++++++---- 2 files changed, 13 insertions(+), 16 deletions(-) diff --git a/security/sandbox/linux/broker/SandboxBroker.cpp b/security/sandbox/linux/broker/SandboxBroker.cpp index d79656c3407f..56215b89b232 100644 --- a/security/sandbox/linux/broker/SandboxBroker.cpp +++ b/security/sandbox/linux/broker/SandboxBroker.cpp @@ -306,7 +306,7 @@ AllowOperation(int aReqFlags, int aPerms) static bool AllowAccess(int aReqFlags, int aPerms) { - if (aReqFlags & ~(R_OK|W_OK|F_OK)) { + if (aReqFlags & ~(R_OK|W_OK|X_OK|F_OK)) { return false; } int needed = 0; @@ -569,17 +569,7 @@ SandboxBroker::ThreadMain(void) case SANDBOX_FILE_ACCESS: if (permissive || AllowAccess(req.mFlags, perms)) { - // This can't use access() itself because that uses the ruid - // and not the euid. In theory faccessat() with AT_EACCESS - // would work, but Linux doesn't actually implement the - // flags != 0 case; glibc has a hack which doesn't even work - // in this case so it'll ignore the flag, and Bionic just - // passes through the syscall and always ignores the flags. - // - // Instead, because we've already checked the requested - // r/w/x bits against the policy, just return success if the - // file exists and hope that's close enough. - if (stat(pathBuf, (struct stat*)&respBuf) == 0) { + if (access(pathBuf, req.mFlags) == 0) { resp.mError = 0; } else { resp.mError = -errno; diff --git a/security/sandbox/linux/gtest/TestBroker.cpp b/security/sandbox/linux/gtest/TestBroker.cpp index a311e181a9b1..bf5e58acbc40 100644 --- a/security/sandbox/linux/gtest/TestBroker.cpp +++ b/security/sandbox/linux/gtest/TestBroker.cpp @@ -133,6 +133,8 @@ SandboxBrokerTest::GetPolicy() const policy->AddPath(MAY_READ | MAY_WRITE, "/tmp", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublu", AddAlways); policy->AddPath(MAY_READ | MAY_WRITE | MAY_CREATE, "/tmp/blublublu", AddAlways); + // This should be non-writable by the user running the test: + policy->AddPath(MAY_READ | MAY_WRITE, "/etc", AddAlways); return Move(policy); } @@ -206,6 +208,14 @@ TEST_F(SandboxBrokerTest, Access) EXPECT_EQ(-EACCES, Access("/proc/self", R_OK)); EXPECT_EQ(-EACCES, Access("/proc/self/stat", F_OK)); + + EXPECT_EQ(0, Access("/tmp", X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|X_OK)); + EXPECT_EQ(0, Access("/tmp", R_OK|W_OK|X_OK)); + EXPECT_EQ(0, Access("/proc/self", X_OK)); + + EXPECT_EQ(0, Access("/etc", R_OK|X_OK)); + EXPECT_EQ(-EACCES, Access("/etc", W_OK)); } TEST_F(SandboxBrokerTest, Stat) @@ -257,10 +267,7 @@ TEST_F(SandboxBrokerTest, Chmod) close(fd); // Set read only. SandboxBroker enforces 0600 mode flags. ASSERT_EQ(0, Chmod("/tmp/blublu", S_IRUSR)); - // SandboxBroker doesn't use real access(), it just checks against - // the policy. So it can't see the change in permisions here. - // This won't work: - // EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); + EXPECT_EQ(-EACCES, Access("/tmp/blublu", W_OK)); statstruct realStat; EXPECT_EQ(0, statsyscall("/tmp/blublu", &realStat)); EXPECT_EQ((mode_t)S_IRUSR, realStat.st_mode & 0777);

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 18101: Suppress upload file dialog proxy bypass (linux)
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit eb7cb8fe69de4ca08b8aa2ece0faeb7ea6217004 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Sep 20 09:35:38 2017 -0700 Bug 18101: Suppress upload file dialog proxy bypass (linux) --- widget/gtk/nsFilePicker.cpp | 14 +++----------- widget/gtk/nsFilePicker.h | 2 -- 2 files changed, 3 insertions(+), 13 deletions(-) diff --git a/widget/gtk/nsFilePicker.cpp b/widget/gtk/nsFilePicker.cpp index 172cb4444849..d1ab963e1012 100644 --- a/widget/gtk/nsFilePicker.cpp +++ b/widget/gtk/nsFilePicker.cpp @@ -170,7 +170,6 @@ NS_IMPL_ISUPPORTS(nsFilePicker, nsIFilePicker) nsFilePicker::nsFilePicker() : mSelectedType(0) , mRunning(false) - , mAllowURLs(false) #if (MOZ_WIDGET_GTK == 3) , mFileChooserDelegate(nullptr) #endif @@ -240,13 +239,6 @@ nsFilePicker::InitNative(nsIWidget *aParent, } NS_IMETHODIMP -nsFilePicker::AppendFilters(int32_t aFilterMask) -{ - mAllowURLs = !!(aFilterMask & filterAllowURLs); - return nsBaseFilePicker::AppendFilters(aFilterMask); -} - -NS_IMETHODIMP nsFilePicker::AppendFilter(const nsAString& aTitle, const nsAString& aFilter) { if (aFilter.EqualsLiteral("..apps")) { @@ -402,9 +394,9 @@ nsFilePicker::Open(nsIFilePickerShownCallback *aCallback) GTK_RESPONSE_ACCEPT, GTK_RESPONSE_CANCEL, -1); - if (mAllowURLs) { - gtk_file_chooser_set_local_only(GTK_FILE_CHOOSER(file_chooser), FALSE); - } + + // Don't allow remote URLs. + gtk_file_chooser_set_local_only(GTK_FILE_CHOOSER(file_chooser), TRUE); if (action == GTK_FILE_CHOOSER_ACTION_OPEN || action == GTK_FILE_CHOOSER_ACTION_SAVE) { GtkWidget *img_preview = gtk_image_new(); diff --git a/widget/gtk/nsFilePicker.h b/widget/gtk/nsFilePicker.h index 2b5042098c65..f7b1bf639bdd 100644 --- a/widget/gtk/nsFilePicker.h +++ b/widget/gtk/nsFilePicker.h @@ -25,7 +25,6 @@ public: // nsIFilePicker (less what's in nsBaseFilePicker) NS_IMETHOD Open(nsIFilePickerShownCallback *aCallback) override; - NS_IMETHOD AppendFilters(int32_t aFilterMask) override; NS_IMETHOD AppendFilter(const nsAString& aTitle, const nsAString& aFilter) override; NS_IMETHOD SetDefaultString(const nsAString& aString) override; @@ -62,7 +61,6 @@ protected: int16_t mSelectedType; int16_t mResult; bool mRunning; - bool mAllowURLs; nsCString mFileURL; nsString mTitle; nsString mDefault;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] squash! Bug 6253: Add canvas image extraction prompt.
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 69666b09b12a51ce30d7b0d0e669eb773aca4e0f Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Sep 20 09:26:21 2017 -0400 squash! Bug 6253: Add canvas image extraction prompt. When processing the ShowCanvasPermissionPrompt message in the main (parent) process, avoid returning an error from the IPC handler if the browser element cannot be obtained. Prior to this change, canvas prompt requests that arrived as a tab was closing would generate an error, which in turn caused the main process to kill the content process. --- dom/ipc/TabParent.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp index ff1b41afafdb..9731561ce0b3 100644 --- a/dom/ipc/TabParent.cpp +++ b/dom/ipc/TabParent.cpp @@ -3281,7 +3281,12 @@ bool TabParent::RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) { nsCOMPtr<nsIBrowser> browser = do_QueryInterface(mFrameElement); - NS_ENSURE_TRUE(browser, false); + if (!browser) { + // If the tab is being closed, the browser may not be available. + // In this case we can ignore the request. + return true; + } + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); NS_ENSURE_TRUE(os, false); nsresult rv = os->NotifyObservers(browser, "canvas-permissions-prompt",

1 0

[tor-browser-build/master] Bug 23384: Fix ssh key for mcs
by boklm＠torproject.org 21 Sep '17

21 Sep '17

commit 57e3f2513809d98c419b5b30f85326c7250e68b1 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Sep 21 17:56:01 2017 +0200 Bug 23384: Fix ssh key for mcs --- tools/ansible/roles/tbb-team/files/mcs.pub | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/ansible/roles/tbb-team/files/mcs.pub b/tools/ansible/roles/tbb-team/files/mcs.pub index 669c324..af8dd08 100644 --- a/tools/ansible/roles/tbb-team/files/mcs.pub +++ b/tools/ansible/roles/tbb-team/files/mcs.pub @@ -1 +1 @@ -ssh key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDipHBalbwyEb0AWwbRPa+pxGGSyFTkoOtyn76AqTD6WZIJKBBe4PkkqkJOI7STWxwVkbzTZoC1UyzUCXc3L/bxt85bopAgg0EucM3z3t6XX3kbaDPEGi+mhA4lFYdpJmWe1wbDhiAMYSAONnVcRgmk6bPkgRBWM5zCshOOS5/hs1HW6/zOzgJX6+B7vLYiccHkRj9YeOln+OyR+ko1nFovBFIeDw5DjZqNHki0/hBe1SpaBKCUWHBwkugmvI3Q/VL5pQhWAcMwqEmEcosmX5SPBsAn8217u0mPLcW2cAx30Yj95lfO3LzOV27dnqYfT0IN4gysm2S9Z0mV7yMgSkgV mcs +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDipHBalbwyEb0AWwbRPa+pxGGSyFTkoOtyn76AqTD6WZIJKBBe4PkkqkJOI7STWxwVkbzTZoC1UyzUCXc3L/bxt85bopAgg0EucM3z3t6XX3kbaDPEGi+mhA4lFYdpJmWe1wbDhiAMYSAONnVcRgmk6bPkgRBWM5zCshOOS5/hs1HW6/zOzgJX6+B7vLYiccHkRj9YeOln+OyR+ko1nFovBFIeDw5DjZqNHki0/hBe1SpaBKCUWHBwkugmvI3Q/VL5pQhWAcMwqEmEcosmX5SPBsAn8217u0mPLcW2cAx30Yj95lfO3LzOV27dnqYfT0IN4gysm2S9Z0mV7yMgSkgV mcs

1 0