Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-27 12:50:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1207972: Move to using USER_INTERACTIVE and JOB_INTERACTIVE by default for the Windows content sandbox. r=tabraldes

Browse Source
This commit is contained in:
Bob Owen 2015-10-05 11:10:46 +01:00
parent 76cb22230c
commit 96010550f8
4 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
browser/app/profile/firefox.js
View File

@ -1174,12 +1174,10 @@ pref("dom.ipc.plugins.sandbox-level.flash", 0);
// This controls the strength of the Windows content process sandbox for testing
// purposes. This will require a restart.
// On windows these levels are:
// 0 - sandbox with USER_NON_ADMIN access token level
// 1 - level 0 plus low integrity
// 2 - a policy that we can reasonably call an effective sandbox
// 3 - an equivalent basic policy to the Chromium renderer processes
// See - security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
// SetSecurityLevelForContentProcess() for what the different settings mean.
#if defined(NIGHTLY_BUILD)
pref("security.sandbox.content.level", 1);
pref("security.sandbox.content.level", 2);
#else
pref("security.sandbox.content.level", 0);
#endif

4
dom/ipc/ContentProcess.cpp
View File

@ -28,9 +28,9 @@ SetUpSandboxEnvironment()
"SetUpSandboxEnvironment relies on nsDirectoryService being initialized");
// A low integrity temp only currently makes sense for Vista or Later and
// sandbox pref level 1.
// sandbox pref level >= 1.
if (!IsVistaOrLater() ||
Preferences::GetInt("security.sandbox.content.level") != 1) {
Preferences::GetInt("security.sandbox.content.level") < 1) {
return;
}

14
security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
View File

@ -85,16 +85,24 @@ SandboxBroker::SetSecurityLevelForContentProcess(int32_t aSandboxLevel)
sandbox::IntegrityLevel initialIntegrityLevel;
sandbox::IntegrityLevel delayedIntegrityLevel;
if (aSandboxLevel > 2) {
// The setting of these levels is pretty arbitrary, but they are a useful (if
// crude) tool while we are tightening the policy. Gaps are left to try and
// avoid changing their meaning.
if (aSandboxLevel >= 20) {
jobLevel = sandbox::JOB_LOCKDOWN;
accessTokenLevel = sandbox::USER_LOCKDOWN;
initialIntegrityLevel = sandbox::INTEGRITY_LEVEL_LOW;
delayedIntegrityLevel = sandbox::INTEGRITY_LEVEL_UNTRUSTED;
} else if (aSandboxLevel == 2) {
} else if (aSandboxLevel >= 10) {
jobLevel = sandbox::JOB_RESTRICTED;
accessTokenLevel = sandbox::USER_LIMITED;
initialIntegrityLevel = sandbox::INTEGRITY_LEVEL_LOW;
delayedIntegrityLevel = sandbox::INTEGRITY_LEVEL_LOW;
} else if (aSandboxLevel == 2) {
jobLevel = sandbox::JOB_INTERACTIVE;
accessTokenLevel = sandbox::USER_INTERACTIVE;
initialIntegrityLevel = sandbox::INTEGRITY_LEVEL_LOW;
delayedIntegrityLevel = sandbox::INTEGRITY_LEVEL_LOW;
} else if (aSandboxLevel == 1) {
jobLevel = sandbox::JOB_NONE;
accessTokenLevel = sandbox::USER_NON_ADMIN;
@ -120,7 +128,7 @@ SandboxBroker::SetSecurityLevelForContentProcess(int32_t aSandboxLevel)
result = mPolicy->SetDelayedIntegrityLevel(delayedIntegrityLevel);
ret = ret && (sandbox::SBOX_ALL_OK == result);
if (aSandboxLevel > 1) {
if (aSandboxLevel > 2) {
result = mPolicy->SetAlternateDesktop(true);
ret = ret && (sandbox::SBOX_ALL_OK == result);
}

4
toolkit/xre/nsAppRunner.cpp
View File

@ -623,9 +623,9 @@ static void
SetUpSandboxEnvironment()
{
// A low integrity temp only currently makes sense for Vista and later, e10s
// and sandbox pref level 1.
// and sandbox pref level >= 1.
if (!IsVistaOrLater() || !BrowserTabsRemoteAutostart() ||
Preferences::GetInt("security.sandbox.content.level") != 1) {
Preferences::GetInt("security.sandbox.content.level") < 1) {
return;
}