mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-24 21:31:04 +00:00
a76fa3e411
Content sandbox level 1 was a configuration with a default-deny seccomp-bpf policy but which allowed direct filesystem access; that required additional code for the syscall filter which was untested and tended to bit-rot. It was trivially escapable and was no longer being used even for debugging, so this patch removes it. The `security.sandbox.content.level` pref can still be set to 0 to disable the sandbox, but if it's nonzero then we now enforce a minimum level of 2, which restricts write access to files (but not read access or the use of sockets). Differential Revision: https://phabricator.services.mozilla.com/D176968 |
||
|---|---|---|
| .. | ||
| certverifier | ||
| ct | ||
| mac/hardenedruntime | ||
| manager | ||
| nss | ||
| rlbox | ||
| sandbox | ||
| .eslintrc.js | ||
| generate_certdata.py | ||
| generate_mapfile.py | ||
| moz.build | ||
| nss.symbols | ||