Jed Davis 3680ce4b19 Bug 1440203 - Support memfd_create in IPC shared memory. r=glandium ... This commit also allows `memfd_create` in the seccomp-bpf policy for all process types. `memfd_create` is an API added in Linux 3.17 (and adopted by FreeBSD for the upcoming version 13) for creating anonymous shared memory not connected to any filesystem. Supporting it means that sandboxed child processes on Linux can create shared memory directly instead of messaging a broker, which is unavoidably slower, and it should avoid the problems we'd been seeing with overly small `/dev/shm` in container environments (which were causing serious problems for using Firefox for automated testing of frontend projects). `memfd_create` also introduces the related operation of file seals: irrevocably preventing types of modifications to a file. Unfortunately, the most useful one, `F_SEAL_WRITE`, can't be relied on; see the large comment in `SharedMemory:ReadOnlyCopy` for details. So we still use the applicable seals as defense in depth, but read-only copies are implemented on Linux by using procfs (and see the comments on the `ReadOnlyCopy` function in `shared_memory_posix.cc` for the subtleties there). There's also a FreeBSD implementation, using `cap_rights_limit` for read-only copies, if the build host is new enough to have the `memfd_create` function. Differential Revision: https://phabricator.services.mozilla.com/D90605		2020-10-08 02:25:20 +00:00
..
external
faster
makefiles	Bug 1669633 - Remove MOZ_BUILD_ROOT. r=firefox-build-system-reviewers,andi,rstewart	2020-10-07 17:57:38 +00:00
mozunit
tests
AB_rCD.mk
autoconf-js.mk.in
autoconf.mk.in
baseconfig.mk
check_js_msg_encoding.py
check_js_opcode.py
check_macroassembler_style.py
check_source_count.py
check_spidermonkey_style.py
check_vanilla_allocations.py
config.mk
create_rc.py
create_res.py
createprecomplete.py
emptyvars-js.mk.in
emptyvars.mk.in
gcc_hidden.h
gcc-stl-wrapper.template.h
install.bat
make-stl-wrappers.py
make-system-wrappers.py
make-windows-h-wrapper.py
Makefile.in
milestone.txt
moz.build
MozZipFile.py
msvc-stl-wrapper.template.h
nsinstall.c
nsinstall.py
pathsub.c
pathsub.h
printconfigsetting.py
printprereleasesuffix.py
rebuild_check.py
recurse.mk
rules.mk
run_spidermonkey_checks.py
run-and-prefix.py
static-checking-config.mk
stl-headers.mozbuild
system-headers.mozbuild	Bug 1440203 - Support memfd_create in IPC shared memory. r=glandium	2020-10-08 02:25:20 +00:00
windows-h-constant.decls.h
windows-h-unicode.decls.h
windows-h-wrapper.template.h