Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b63160a5c14f72dbb4f570a9893904b0df49ffda)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Pavel Vinogradov <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b63160a5c14f72dbb4f570a9893904b0df49ffda)
  • Date: Fri, 10 Mar 2017 18:08:59 +0000

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemage.org>:

http/firefox/HISTORY | 4 +
http/firefox/patches/sandbox-allow-getrlimit.patch | 46
+++++++++++++++++++++
2 files changed, 50 insertions(+)

New commits:
commit b63160a5c14f72dbb4f570a9893904b0df49ffda
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Pavel Vinogradov <public AT sourcemage.org>

http/firefox: added upstream patch to fix sandbox bug

diff --git a/http/firefox/HISTORY b/http/firefox/HISTORY
index 30491ef..e093827 100644
--- a/http/firefox/HISTORY
+++ b/http/firefox/HISTORY
@@ -1,3 +1,7 @@
+2017-03-10 Pavel Vinogradov <public AT sourcemage.org>
+ * patches/sandbox-allow-getrlimit.patch: added upstream patch to fix
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1320085
+
2017-03-08 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DEPENDS: fix alsa sound
* DETAILS: PATCHLEVEL++
diff --git a/http/firefox/patches/sandbox-allow-getrlimit.patch
b/http/firefox/patches/sandbox-allow-getrlimit.patch
new file mode 100644
index 0000000..e0190f3
--- /dev/null
+++ b/http/firefox/patches/sandbox-allow-getrlimit.patch
@@ -0,0 +1,46 @@
+# HG changeset patch
+# User Jed Davis <jld AT mozilla.com>
+# Date 1480359928 25200
+# Node ID c021b68fc7dfbc9890e225db9d98e4763d7f08b6
+# Parent 7eab0a7c766e258f2849edf6b8666727354a2968
+Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd
+
+This applies only to content processes, where we already allow getrlimit
+(but not setrlimit). The rule added here does not allow using prlimit64
+to set any resource limits or interact with any other process.
+
+MozReview-Commit-ID: nMry3t6QPj
+
+diff --git a/security/sandbox/linux/SandboxFilter.cpp
b/security/sandbox/linux/SandboxFilter.cpp
+--- a/security/sandbox/linux/SandboxFilter.cpp
++++ b/security/sandbox/linux/SandboxFilter.cpp
+@@ -711,16 +711,28 @@ public:
+ return Allow();
+
+ CASES_FOR_getrlimit:
+ case __NR_clock_getres:
+ CASES_FOR_getresuid:
+ CASES_FOR_getresgid:
+ return Allow();
+
++ case __NR_prlimit64: {
++ // Allow only the getrlimit() use case. (glibc seems to use
++ // only pid 0 to indicate the current process; pid == getpid()
++ // is equivalent and could also be allowed if needed.)
++ Arg<pid_t> pid(0);
++ // This is really a const struct ::rlimit*, but Arg<> doesn't
++ // work with pointers, only integer types.
++ Arg<uintptr_t> new_limit(2);
++ return If(AllOf(pid == 0, new_limit == 0), Allow())
++ .Else(InvalidSyscall());
++ }
++
+ case __NR_umask:
+ case __NR_kill:
+ case __NR_wait4:
+ #ifdef __NR_waitpid
+ case __NR_waitpid:
+ #endif
+ #ifdef __NR_arch_prctl
+ case __NR_arch_prctl:
+



  • [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (b63160a5c14f72dbb4f570a9893904b0df49ffda), Pavel Vinogradov, 03/10/2017

Archive powered by MHonArc 2.6.24.

Top of Page