security/sandbox/linux/SandboxFilter.cpp
fb637352a959581a2c7e3fc02b4801e27518761b
created 2017-10-05 19:53 -0600
pushed 2017-11-02 16:33 +0000
Jed Davis Jed Davis - Bug 1405891 - Block tty-related ioctl()s in sandboxed content processes. r=gcp
40e071f08bf6a3c4f97f77f02fc83ba93dda06e6
created 2017-09-07 08:29 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1397753 - Disallow kill() in sandboxed content processes. r=gcp
2e6bfbf7e58e0f691bc03fdb5d1fad17f946ccf8
created 2017-09-07 08:27 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1299581 - Fail waitpid et al. with ECHILD in sandboxed content processes. r=gcp
59db725def8282e1d77e83f002d247c7d0f95237
created 2017-07-27 17:22 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1383888 - Restrict sandboxed readlinkat() the same as readlink(). r=gcp
4ffacd080dc6030453c08549f8c65a94fccb94be
created 2017-08-24 15:02 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Backed out 3 changesets (bug 1380701, bug 1384804)
afdd35ed8902c1a6d670a56996673e91e30979f7
created 2017-08-17 16:59 +0200
pushed 2017-09-15 00:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1384804 - Allow libnuma to read /proc/self/status, block get_mempolicy. r=jld
0d56979a6efae4883ab2bd015dae79271b832725
created 2017-07-20 13:43 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1380701 - Remove brokering for link, unlink, and rename. r=gcp
bb2e59766bada3c9528e48c70b60ee0681c3db1e
created 2017-08-16 09:46 -0700
pushed 2017-09-15 00:19 +0000
Wes Kocher Wes Kocher - Backed out 2 changesets (bug 1380701) for bustage in SandboxBroker a=backout
4456ebfe5657fa3ab3d0e83f8d3494122588cb06
created 2017-07-20 13:43 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1380701 - Remove brokering for link, unlink, and rename. r=gcp
7ea87b92669121e030c14df64b4d1edcdcc044bc
created 2017-07-27 15:27 -0600
pushed 2017-09-15 00:19 +0000
Jed Davis Jed Davis - Bug 1384306 - Allow SOCK_CLOEXEC in socketpair(). r=gcp
1efacc8c49ba68b524de18c6b30153cb78e524d2
created 2017-07-26 12:50 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Backed out 3 changesets (bug 1383007, bug 1376910)
394b3d22db1988839462c9832f4ef309aef556a1
created 2017-07-21 23:28 +0200
pushed 2017-08-02 08:25 +0000
Sylvestre Ledru Sylvestre Ledru - Bug 1383007 - Move the declaration in the #ifdef declaration to silent a warning r=jld
d11cd5c3fc6f5e1ec439e6d15e3f911f3e967e3c
created 2017-06-28 06:33 -0700
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1376910 - Block syscalls for SysV IPC in content processes. r=gcp
9b5bb669d1283995fd8d01fe779bd8646cb2cd92
created 2017-07-11 16:59 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1376653 - Unconditionalize the tkill() polyfill. r=gcp
a8f06d32af317f7db813252afbaae05a13d8863a
created 2017-07-11 14:23 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1376653 - Loosen restrictions on clone flags for musl. r=gcp
52e1b27c1cb085997440183cf28686c36f5591b3
created 2017-07-07 08:58 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1372428 - Extend file pre-opening for sandboxed media plugins. r=gcp
9d96ca099f2106d59bf65c0e0b77d0422f2dd51b
created 2017-07-07 08:58 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1372428 - Deal with fcntl() in media plugins. r=gcp
ca32657a32377a20f127d9f01eb5e4cbb8c2cee1
created 2017-07-07 08:58 -0600
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1372428 - Deal with uname() in media plugins. r=gcp
f551e82578c1e0537ed829dab8e71c0614c80e2b
created 2017-06-27 17:57 +0200
pushed 2017-08-02 08:25 +0000
Jan Keromnes Jan Keromnes - Bug 1376643 - Use 'override' and '= default' on applicable methods in security/sandbox/. r=gcp
2fe9bcd421fffb0c90abf3cb616844bc69f04c53
created 2017-06-27 14:52 -0700
pushed 2017-08-02 08:25 +0000
Jed Davis Jed Davis - Bug 1362537 - Re-disallow accept4 in Linux content processes. r=gcp
5bbdb7d36ee3c136a0ed03be9d5b012d05dfd08e
created 2017-06-13 01:54 -0400
pushed 2017-08-02 08:25 +0000
Randell Jesup Randell Jesup - Bug 1361703: enable NR_epoll_create/create1 in linux sandbox r=jld
45afa550d6cc52effd06f7c42ca99d2ea68bcfa1
created 2017-07-07 08:58 -0600
pushed 2017-07-19 23:02 +0000
Jed Davis Jed Davis - Bug 1372428 - Extend file pre-opening for sandboxed media plugins. r=gcp, a=jcristau
01af915e2e85c9f116aa92ff5c2ea76dd7ca75fa
created 2017-07-07 08:58 -0600
pushed 2017-07-19 23:02 +0000
Jed Davis Jed Davis - Bug 1372428 - Deal with fcntl() in media plugins. r=gcp, a=jcristau
e5e3e626cdaf6b52570b242fe38c1d7f03079a22
created 2017-07-07 08:58 -0600
pushed 2017-07-19 23:02 +0000
Jed Davis Jed Davis - Bug 1372428 - Deal with uname() in media plugins. r=gcp, a=jcristau
fe87806bd7f49b07860acc97c16ecd5c9cab794f
created 2017-05-30 23:13 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1322784 - Gently fail utime(), to deal with GConf/ORBit. r=gcp
9920ad0223261212b6800d1f6f018b515f023586
created 2017-04-11 20:55 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1355274 - Polyfill SOCK_DGRAM socketpairs with SOCK_SEQPACKET, for libasyncns. r=gcp
c8a8173ef13816a4df32fd387ddd298d2b66f38b
created 2017-05-12 20:04 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1364533 - Allow madvise huge page hints. r=gcp
13407f841b7fc1544beb2262f340eff1f79aa2eb
created 2017-05-01 21:51 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp
c1339155e30164c191881948a06c8906d8c13f57
created 2017-04-25 19:29 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1358647 - Disallow bind/listen/accept for Linux content processes. r=gcp
eded510b0f3b73ef0c7ee74387bf0ff3719d98d8
created 2017-04-14 16:17 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1355273 - Allow inotify_init alongside inotify_init1. r=Alex_Gaynor,gcp
9135513229b9f24fdb120d16ead7b019ad3fbe5b
created 2017-04-11 13:22 -0600
pushed 2017-06-12 13:08 +0000
Jed Davis Jed Davis - Bug 1354731 - Quietly fail mknod of character devices in content sandbox. r=gcp
64d812edc8bcdd3fb725f7fe2a93d678a21d4d18
created 2017-04-14 16:17 -0600
pushed 2017-05-22 09:54 +0000
Jed Davis Jed Davis - Bug 1355273 - Allow inotify_init alongside inotify_init1. r=Alex_Gaynor,gcp a=gchang
7a9b07064c28ac88d837c14e3cc85e95a8597aa9
created 2017-02-24 13:18 +0100
pushed 2017-04-18 12:07 +0000
Benjamin Bouvier Benjamin Bouvier - Bug 1342385: Allow mremap on linux32 for wasm; r=jld
f73368ed36cf12bf18f7d66f370d5cd6b8a5e8db
created 2017-01-30 18:49 -0700
pushed 2017-04-18 12:07 +0000
Jed Davis Jed Davis - Bug 1286865 - Step 1: Gather syscall info from SIGSYS handlers into the parent process. r=gcp
50ff055b70fe829d26c01342a906d53c1d41e645
created 2017-01-26 19:59 +0100
pushed 2017-04-18 12:07 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1330326 - Make sandboxing policy more configurable via preferences. r=jld
2633df8bf5d3969230f0627eda9c01e239f1091d
created 2017-01-27 20:59 +0100
pushed 2017-04-18 12:07 +0000
Sebastian Hengst Sebastian Hengst - Backed out changeset e87ae43ca443 (bug 1330326)
e87ae43ca44332a0bf30a4151b57cbb9b8e369ac
created 2017-01-26 19:59 +0100
pushed 2017-04-18 12:07 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1330326 - Make sandboxing policy more configurable via preferences. r=jld
26025c7f0d298872c5fe88739c9897254da6fc75
created 2016-12-06 12:38 -1000
pushed 2017-03-06 20:48 +0000
Jed Davis Jed Davis - Bug 1257361 - Simplify detecting threads that already have seccomp-bpf applied. r=tedd r=gcp
c021b68fc7dfbc9890e225db9d98e4763d7f08b6
created 2016-11-28 12:05 -0700
pushed 2017-03-06 20:48 +0000
Jed Davis Jed Davis - Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd
52318ef46d8b447b41d71900d7428c03b3a593e3
created 2016-12-06 12:38 -1000
pushed 2017-02-09 17:25 +0000
Jed Davis Jed Davis - Bug 1257361 - Simplify detecting threads that already have seccomp-bpf applied. r=tedd, r=gcp, a=jcristau
b54a7014e03d92571b341b9ce82772305685a58d
created 2016-12-12 11:49 +0100
pushed 2017-01-23 14:19 +0000
Carsten "Tomcat" Book Carsten "Tomcat" Book - Backed out changeset 3a761e5cc19c (bug 1257361) for bustage
3a761e5cc19c38782cfc0da0bba68954bd06cd27
created 2016-12-06 12:38 -1000
pushed 2017-01-23 14:19 +0000
Jed Davis Jed Davis - Bug 1257361 - Simplify detecting threads that already have seccomp-bpf applied. r=tedd r=gcp a=gchang
15775247c226598e8b00a5229c4f2c20a35b2c3a
created 2016-10-25 20:43 +0200
pushed 2017-01-23 14:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1310116 - Allow waitpid but warn on creating processes in content. r=jld
61aed24ee7e7d856f0a3bee895dc85b443f69d91
created 2016-10-07 23:22 -0400
pushed 2017-01-23 14:19 +0000
Ryan VanderMeulen Ryan VanderMeulen - Merge m-c to autoland. a=merge
d3f56ee6993a1ec8e4529a583a93342b2cdf9c47
created 2016-10-07 22:07 +0200
pushed 2017-01-23 14:19 +0000
Sebastian Hengst Sebastian Hengst - Backed out changeset 9887bfe1f8fa (bug 1308568) on request of its developer. r=backout
9887bfe1f8fa7a7ae5ce58a68acb5a1f6c3dccd0
created 2016-10-07 20:58 +0200
pushed 2017-01-23 14:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1308568 - Add missing filesystem calls to Allow in case broker is disabled. r=haik
099e8386665bce6331b79a9e0568075037f00b86
created 2016-10-07 22:09 +0200
pushed 2017-01-23 14:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1308568 - Add missing filesystem calls to Allow in case broker is disabled. r=haik
c838d2546cadd65bf8d5579db20a268c8b6e4b87
created 2016-10-06 13:25 +0200
pushed 2017-01-23 14:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1289718 - Clean up stat/stat64 wrapper. Deal with non-default TMPDIR. r=jld
a79ec9afac7b7cbed2802c7ffa9db47313b1f445
created 2016-09-27 17:25 +0200
pushed 2017-01-23 14:19 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1289718 - Extend sandbox file broker to handle paths, support more syscalls. r=jld,tedd
11a470398b1f22a7be23b4a02d42fcb3fbf343da
created 2016-09-26 16:10 -0400
pushed 2017-01-23 14:19 +0000
Jed Davis Jed Davis - Bug 1303813 - Allow media plugins to call madvise with MADV_FREE. r=gcp
17592aa0049962153db68fb10e4893b99116b8f2
created 2016-09-26 16:32 -0400
pushed 2017-01-23 14:19 +0000
Jed Davis Jed Davis - Bug 1304220 - Allow media plugins to use the times(2) syscall. r=gcp
a738538c802e5162c1088487117179f5a4d39be3
created 2016-09-26 16:32 -0400
pushed 2016-11-14 12:26 +0000
Jed Davis Jed Davis - Bug 1304220 - Allow media plugins to use the times(2) syscall. r=gcp, a=ritu
d3af65afc4c8a3abfb07f294dcb92ec52d58cbca
created 2016-09-26 16:10 -0400
pushed 2016-11-14 12:26 +0000
Jed Davis Jed Davis - Bug 1303813 - Allow media plugins to call madvise with MADV_FREE. r=gcp, a=ritu
a46f0e32289bb8975eef7f87d14cbd71c9c10582
created 2016-09-06 08:57 +0100
pushed 2016-11-14 12:26 +0000
Bob Owen Bob Owen - Bug 1287426 Part 3: Update security/sandbox/chromium/ to commit 4ec79b7f2379a60cdc15599e93255c0fa417f1ed. r=aklotz, r=jld
0fab4436ad09df818b87d4dba3e11b15b5a804d9
created 2016-08-30 18:15 -0700
pushed 2016-11-14 12:26 +0000
Wes Kocher Wes Kocher - Merge m-c to autoland, a=merge
b8771e81cc6ee8c95ba3e6f251ca94a732eef5ad
created 2016-08-22 15:51 +0200
pushed 2016-11-14 12:26 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1295190 - Add sys_flock to seccomp whitelist. r=jld
1a6361b000fcb97f941e4091001e88be0e46927f
created 2016-08-30 16:59 +0200
pushed 2016-11-14 12:26 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1296309 - Return umask (PulseAudio) and wait4 (threads) to the whitelist. r=tedd
7239d050d65fbc4dbe4387c59d07cd68649e35c3
created 2016-08-18 16:56 +0200
pushed 2016-11-14 12:26 +0000
Gian-Carlo Pascutto Gian-Carlo Pascutto - Bug 1296309 - Remove unused syscalls from the seccomp whitelist. r=tedd
f416db46e66e9b89ecf3767f3a2b08f26504cabb
created 2016-08-08 14:59 -0700
pushed 2016-11-14 12:26 +0000
Jed Davis Jed Davis - Bug 1290896 - Allow readlink() in desktop Linux content processes. r=gps
847bef59265f604cc2fca1aaf5d4b731afb20851
created 2016-08-01 13:10 +0200
pushed 2016-11-14 12:26 +0000
Jed Davis Jed Davis - Bug 1290343 - Fix Linux GMP sandbox policy's geteuid rule for 32-bit. r=tedd
less more (0) -100 -60 tip