Bug 1672482 - Move getdents allowance to SandboxPolicyCommon. r=jld,gcp
authorEmilio Cobos Álvarez <emilio@crisal.io>
Fri, 23 Oct 2020 09:05:29 +0000
changeset 554168 1c7244c1d3b5dcc3a2e9e9f425c723ef42c99cd2
parent 554167 e29df844f897b1efc5f07f16925c89e1835ee60d
child 554169 1e4ad9f00671a125feee6e1a707ac633f64e1c25
push id37889
push userbtara@mozilla.com
push dateFri, 23 Oct 2020 21:47:13 +0000
treeherdermozilla-central@1980f87855fc [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjld, gcp
bugs1672482
milestone84.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1672482 - Move getdents allowance to SandboxPolicyCommon. r=jld,gcp I think since it takes an FD this might be ok, but let me know if this somehow doesn't cut it and a more nuanced fix is needed. Since stuff like PR_GetNumberOfProcessors() uses it with some glibc versions, which is pretty basic functionality, we probably need to make it work in all processes. Differential Revision: https://phabricator.services.mozilla.com/D94358
security/sandbox/linux/SandboxFilter.cpp
--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -686,16 +686,19 @@ class SandboxPolicyCommon : public Sandb
       case __NR_pread64:
       case __NR_write:
       case __NR_read:
       case __NR_readv:
       case __NR_writev:  // see SandboxLogging.cpp
       CASES_FOR_lseek:
         return Allow();
 
+      CASES_FOR_getdents:
+        return Allow();
+
       CASES_FOR_ftruncate:
       case __NR_fallocate:
         return mMayCreateShmem ? Allow() : InvalidSyscall();
 
         // Used by our fd/shm classes
       case __NR_dup:
         return Allow();
 
@@ -1221,17 +1224,16 @@ class ContentSandboxPolicy : public Sand
 #  endif
       case __NR_fchownat:
         return Error(EPERM);
 #endif
 
       CASES_FOR_select:
         return Allow();
 
-      CASES_FOR_getdents:
       case __NR_writev:
 #ifdef DESKTOP
       case __NR_pwrite64:
       case __NR_readahead:
 #endif
         return Allow();
 
       case __NR_ioctl: {