Are you tired of compiling Firefox yet? The preference keys for pledge and unveil settings were concerning from a security standpoint, so I've taken a new direction and moved them both to root-owned files. Landry and I are discussing this with upstream:
https://bugzilla.mozilla.org/show_bug.cgi?id=1584839 These files are now installed to /usr/local/lib/firefox/browser/defaults/preferences/ and you can put your own versions in /etc/firefox if you need to override them (but you shouldn't). This also changes the way unveil or pledge are disabled for testing, because the environment variable mechanism was scaring me by allowing a potentially compromised main process to influence a new content process. Now the only way to disable it is by modifying those root-owned files to just contain "disable". This also does essentially a 'mkdir -p $XDG_CACHE_HOME/dconf' on startup from the main process if needed (like on a fresh login account) because otherwise lots of things complain. This also adds back the video pledge to the main process which got lost along the way. I would really like to commit this version to ports so we can at least get snapshot packages out with this for testing before 6.6. Index: Makefile =================================================================== RCS file: /cvs/ports/www/mozilla-firefox/Makefile,v retrieving revision 1.396 diff -u -p -u -p -r1.396 Makefile --- Makefile 3 Oct 2019 17:57:49 -0000 1.396 +++ Makefile 4 Oct 2019 01:49:27 -0000 @@ -10,6 +10,8 @@ MOZILLA_BRANCH = release MOZILLA_PROJECT = firefox MOZILLA_CODENAME = browser +REVISION= 0 + WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/b[0-9]*//} HOMEPAGE = https://www.mozilla.org/firefox/ SO_VERSION = 84.0 @@ -51,6 +53,8 @@ BUILD_DEPENDS += lang/node BUILD_DEPENDS += devel/cbindgen>=0.9.0 # 67 requires nasm for bundled libav1d BUILD_DEPENDS += devel/nasm +# unveil support relies on xdg-open +RUN_DEPENDS += devel/xdg-utils WANTLIB += X11-xcb Xcursor Xi intl xcb xcb-shm ${COMPILER_LIBCXX} @@ -64,7 +68,7 @@ MAKE_ENV += BUILD_VERBOSE_LOG="1" CONFIGURE_ARGS += --enable-release #1386371 CONFIGURE_ARGS += --enable-sandbox CONFIGURE_ARGS += --with-libclang-path=${LOCALBASE}/lib -SUBST_VARS += LOCALBASE X11BASE +SUBST_VARS += LOCALBASE X11BASE MOZILLA_PROJECT show-commit: @curl -s https://releases.mozilla.org/pub/mozilla.org/firefox/releases/${MOZILLA_VERSION}/SOURCE| awk -F / '/^https:\/\/hg/ {print $$7 }' @@ -92,6 +96,10 @@ post-install: ${PREFIX}/share/pixmaps/firefox.png # link default48.png to default.png to be used by default by non-icccm compliant wm - ln ${PREFIX}/lib/${MOZILLA_PROJECT}/browser/chrome/icons/default/default{48,}.png + ln -f ${PREFIX}/lib/${MOZILLA_PROJECT}/browser/chrome/icons/default/default{48,}.png + +.for f in unveil.content unveil.gpu unveil.main pledge.content pledge.gpu pledge.main + ${INSTALL_DATA} ${FILESDIR}/${f} ${PREFIX}/lib/${MOZILLA_PROJECT}/browser/defaults/preferences/ +.endfor .include <bsd.port.mk> Index: files/all-openbsd.js =================================================================== RCS file: /cvs/ports/www/mozilla-firefox/files/all-openbsd.js,v retrieving revision 1.10 diff -u -p -u -p -r1.10 all-openbsd.js --- files/all-openbsd.js 9 Sep 2019 18:50:35 -0000 1.10 +++ files/all-openbsd.js 4 Oct 2019 01:49:27 -0000 @@ -5,10 +5,6 @@ pref("app.normandy.enabled",false); pref("browser.safebrowsing.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("spellchecker.dictionary_path", "${LOCALBASE}/share/mozilla-dicts/"); -// enable pledging the content process -pref("security.sandbox.content.level", 1); -pref("security.sandbox.pledge.main","stdio rpath wpath cpath inet proc exec prot_exec flock ps sendfd recvfd dns vminfo tty drm unix fattr getpw mcast video"); -pref("security.sandbox.pledge.content","stdio rpath wpath cpath inet recvfd sendfd prot_exec unix drm ps"); pref("extensions.pocket.enabled", false); pref("browser.newtabpage.enabled", false); pref("browser.startup.homepage", "about:blank"); Index: files/pledge.content =================================================================== RCS file: files/pledge.content diff -N files/pledge.content --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/pledge.content 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,10 @@ +stdio +rpath +wpath +cpath +recvfd +sendfd +prot_exec +unix +drm +ps Index: files/pledge.gpu =================================================================== RCS file: files/pledge.gpu diff -N files/pledge.gpu --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/pledge.gpu 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,11 @@ +stdio +rpath +wpath +cpath +ps +sendfd +recvfd +drm +dns +unix +prot_exec Index: files/pledge.main =================================================================== RCS file: files/pledge.main diff -N files/pledge.main --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/pledge.main 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,21 @@ +stdio +rpath +wpath +cpath +inet +proc +exec +prot_exec +flock +ps +sendfd +recvfd +dns +vminfo +tty +drm +unix +fattr +getpw +mcast +video Index: files/unveil.content =================================================================== RCS file: files/unveil.content diff -N files/unveil.content --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/unveil.content 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,43 @@ +/dev/drm0 rw + +/etc/fonts r +/etc/machine-id r +/usr/local/lib r +/usr/local/firefox r +/usr/local/share r +/usr/share/locale r +/var/cache/fontconfig r +/usr/X11R6/lib r +/usr/X11R6/share r +/var/run r + +~/.XCompose r +~/.Xauthority r +~/.Xdefaults r +~/.fontconfig r +~/.fonts r +~/.fonts.conf r +~/.fonts.conf.d r +~/.icons r +~/.pki rwc +~/.sndio rwc +~/.terminfo r + +~/.mozilla r +~/Downloads r + +/tmp rwc + +$XDG_CONFIG_HOME/dconf rwc +$XDG_CONFIG_HOME/fontconfig r +$XDG_CONFIG_HOME/gtk-3.0 r +$XDG_CONFIG_HOME/mimeapps.list r +$XDG_CONFIG_HOME/mozilla rwc +$XDG_CONFIG_HOME/user-dirs.dirs r +$XDG_DATA_HOME/applications r +$XDG_DATA_HOME/applnk r +$XDG_DATA_HOME/fonts r +$XDG_DATA_HOME/glib-2.0 r +$XDG_DATA_HOME/icons r +$XDG_DATA_HOME/mime r +$XDG_DATA_HOME/themes r Index: files/unveil.gpu =================================================================== RCS file: files/unveil.gpu diff -N files/unveil.gpu --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/unveil.gpu 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,11 @@ +/dev/drm0 rw + +/usr/local/lib/firefox r +/usr/local/lib/gdk-pixbuf-2.0 r +/usr/X11R6/lib r +/usr/share/locale r +/usr/local/share r + +/tmp rwc + +~/.Xauthority r Index: files/unveil.main =================================================================== RCS file: files/unveil.main diff -N files/unveil.main --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/unveil.main 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,63 @@ +# for uuid generation? +/dev/urandom r +/dev/video rw + +/etc/fonts r +/etc/machine-id r + +/usr/local/lib r +/usr/local/firefox r +/usr/local/lib/firefox rx +/usr/local/share r +/usr/share/locale r +/var/cache/fontconfig r +/usr/X11R6/lib r +/usr/X11R6/share r +/var/run r + +# printing +/usr/bin/lpr rx + +# for launching registered 3rd party applications like pdf readers +/usr/local/bin/gio-launch-desktop rx +/etc/mailcap r +~/.mailcap r +~/.mime.types r + +~/.XCompose r +~/.Xauthority r +~/.Xdefaults r +~/.fontconfig r +~/.fonts r +~/.fonts.conf r +~/.fonts.conf.d r +~/.icons r +~/.pki rwc +~/.sndio rwc +~/.terminfo r + +~/.mozilla rwc +~/Downloads rwc + +# for at least shm_open (for now) +/tmp rwc + +# $XDG_CACHE_HOME, $XDG_CONFIG_HOME, and $XDG_DATA_HOME will expand to the +# given variable if it exists in the environment, otherwise defaulting to +# ~/.cache, ~/.config, and ~/.local/share +$XDG_CACHE_HOME/dconf rwc +$XDG_CACHE_HOME/thumbnails rwc +$XDG_CONFIG_HOME/dconf rw +$XDG_CONFIG_HOME/fontconfig r +$XDG_CONFIG_HOME/gtk-3.0 r +$XDG_CONFIG_HOME/mimeapps.list r +$XDG_CONFIG_HOME/mozilla rwc +$XDG_CONFIG_HOME/user-dirs.dirs r +$XDG_DATA_HOME/applications rwc +$XDG_DATA_HOME/applnk r +$XDG_DATA_HOME/fonts r +$XDG_DATA_HOME/glib-2.0 r +$XDG_DATA_HOME/icons r +$XDG_DATA_HOME/mime r +$XDG_DATA_HOME/recently-used.xbel rwc +$XDG_DATA_HOME/themes r Index: patches/patch-browser_app_profile_firefox_js =================================================================== RCS file: patches/patch-browser_app_profile_firefox_js diff -N patches/patch-browser_app_profile_firefox_js --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-browser_app_profile_firefox_js 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,20 @@ +$OpenBSD$ + +https://bugzilla.mozilla.org/show_bug.cgi?id=1584839 + +Index: browser/app/profile/firefox.js +--- browser/app/profile/firefox.js.orig ++++ browser/app/profile/firefox.js +@@ -1130,11 +1130,8 @@ pref("security.sandbox.content.syscall_whitelist", "") + #endif + + #if defined(XP_OPENBSD) && defined(MOZ_SANDBOX) +-// default pledge strings for the main & content processes, cf bug 1457092 +-// broad list for now, has to be refined over time +-pref("security.sandbox.pledge.main", "stdio rpath wpath cpath inet proc exec prot_exec flock ps sendfd recvfd dns vminfo tty drm unix fattr getpw mcast"); + pref("security.sandbox.content.level", 1); +-pref("security.sandbox.pledge.content", "stdio rpath wpath cpath inet recvfd sendfd prot_exec unix drm ps"); ++// Custom sandboxing done in StartOpenBSDSandbox() + #endif + + #if defined(MOZ_SANDBOX) Index: patches/patch-dom_ipc_ContentChild_cpp =================================================================== RCS file: patches/patch-dom_ipc_ContentChild_cpp diff -N patches/patch-dom_ipc_ContentChild_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-dom_ipc_ContentChild_cpp 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,328 @@ +$OpenBSD$ + +https://bugzilla.mozilla.org/show_bug.cgi?id=1580268 +https://bugzilla.mozilla.org/show_bug.cgi?id=1580271 +https://bugzilla.mozilla.org/show_bug.cgi?id=1584839 + +Index: dom/ipc/ContentChild.cpp +--- dom/ipc/ContentChild.cpp.orig ++++ dom/ipc/ContentChild.cpp +@@ -126,6 +126,11 @@ + # include "mozilla/Sandbox.h" + # elif defined(__OpenBSD__) + # include <unistd.h> ++# include <sys/stat.h> ++# include <err.h> ++# include <fstream> ++# include "nsILineInputStream.h" ++# include "SpecialSystemDirectory.h" + # endif + #endif + +@@ -701,6 +706,10 @@ bool ContentChild::Init(MessageLoop* aIOLoop, base::Pr + ProcessChild::QuickExit(); + } + ++#if defined(__OpenBSD__) && defined(MOZ_SANDBOX) ++ StartOpenBSDSandbox(GeckoProcessType_Content); ++#endif ++ + #ifdef MOZ_X11 + # ifdef MOZ_WIDGET_GTK + if (GDK_IS_X11_DISPLAY(gdk_display_get_default()) && +@@ -1743,15 +1752,6 @@ mozilla::ipc::IPCResult ContentChild::RecvSetProcessSa + mozilla::SandboxTarget::Instance()->StartSandbox(); + # elif defined(XP_MACOSX) + sandboxEnabled = StartMacOSContentSandbox(); +-# elif defined(__OpenBSD__) +- sandboxEnabled = StartOpenBSDSandbox(GeckoProcessType_Content); +- /* dont overwrite an existing session dbus address, but ensure it is set */ +- if (!PR_GetEnv("DBUS_SESSION_BUS_ADDRESS")) { +- static LazyLogModule sPledgeLog("SandboxPledge"); +- MOZ_LOG(sPledgeLog, LogLevel::Debug, +- ("no session dbus found, faking one\n")); +- PR_SetEnv("DBUS_SESSION_BUS_ADDRESS="); +- } + # endif + + CrashReporter::AnnotateCrashReport( +@@ -4048,48 +4048,252 @@ void ContentChild::HoldBrowsingContextGroup(BrowsingCo + } // namespace dom + + #if defined(__OpenBSD__) && defined(MOZ_SANDBOX) +-# include <unistd.h> + +-static LazyLogModule sPledgeLog("SandboxPledge"); ++/* TODO: get this from the build system */ ++#ifndef MOZ_APP_NAME ++#define MOZ_APP_NAME "firefox" ++#endif + ++static LazyLogModule sPledgeLog("OpenBSDSandbox"); ++ ++NS_IMETHODIMP ++OpenBSDFindPledgeUnveilFilePath(const char *file, nsACString &result) { ++ struct stat st; ++ ++ // Allow overriding files in /etc/$MOZ_APP_NAME ++ result.Assign(nsPrintfCString("/etc/%s/%s", MOZ_APP_NAME, file)); ++ if (stat(PromiseFlatCString(result).get(), &st) == 0) { ++ return NS_OK; ++ } ++ ++ // Or look in the system default directory ++ result.Assign(nsPrintfCString( ++ "/usr/local/lib/%s/browser/defaults/preferences/%s", MOZ_APP_NAME, file)); ++ if (stat(PromiseFlatCString(result).get(), &st) == 0) { ++ return NS_OK; ++ } ++ ++ errx(1, "can't locate %s", file); ++} ++ ++NS_IMETHODIMP ++OpenBSDPledgePromises(const nsACString& aPath) { ++ // Using NS_LOCAL_FILE_CONTRACTID/NS_LOCALFILEINPUTSTREAM_CONTRACTID requires ++ // a lot of setup before they are supported and we want to pledge early on ++ // before all of that, so read the file directly ++ std::ifstream input(PromiseFlatCString(aPath).get()); ++ ++ // Build up one line of pledge promises without comments ++ nsAutoCString promises; ++ bool disabled = false; ++ int linenum = 0; ++ for (std::string tLine; std::getline(input, tLine); ) { ++ nsAutoCString line(tLine.c_str()); ++ linenum++; ++ ++ // Cut off any comments at the end of the line, also catches lines ++ // that are entirely a comment ++ int32_t hash = line.FindChar('#'); ++ if (hash >= 0) { ++ line = Substring(line, 0, hash); ++ } ++ line.CompressWhitespace(true, true); ++ if (line.IsEmpty()) { ++ continue; ++ } ++ ++ if (linenum == 1 && line.EqualsLiteral("disable")) { ++ disabled = true; ++ break; ++ } ++ ++ if (!promises.IsEmpty()) { ++ promises.Append(" "); ++ } ++ promises.Append(line); ++ } ++ input.close(); ++ ++ if (disabled) { ++ warnx("%s: disabled", PromiseFlatCString(aPath).get()); ++ } else { ++ MOZ_LOG(sPledgeLog, LogLevel::Debug, ("%s: pledge(%s)\n", ++ PromiseFlatCString(aPath).get(), promises.get())); ++ if (pledge(promises.get(), nullptr) != 0) { ++ err(1, "%s: pledge(%s) failed", PromiseFlatCString(aPath).get(), ++ promises.get()); ++ } ++ } ++ ++ return NS_OK; ++} ++ ++void ++ExpandUnveilPath(nsAutoCString& path) { ++ // Expand $XDG_CONFIG_HOME to the environment variable, or ~/.config ++ nsCString xdgConfigHome(PR_GetEnv("XDG_CONFIG_HOME")); ++ if (xdgConfigHome.IsEmpty()) { ++ xdgConfigHome = "~/.config"; ++ } ++ path.ReplaceSubstring("$XDG_CONFIG_HOME", xdgConfigHome.get()); ++ ++ // Expand $XDG_CACHE_HOME to the environment variable, or ~/.cache ++ nsCString xdgCacheHome(PR_GetEnv("XDG_CACHE_HOME")); ++ if (xdgCacheHome.IsEmpty()) { ++ xdgCacheHome = "~/.cache"; ++ } ++ path.ReplaceSubstring("$XDG_CACHE_HOME", xdgCacheHome.get()); ++ ++ // Expand $XDG_DATA_HOME to the environment variable, or ~/.local/share ++ nsCString xdgDataHome(PR_GetEnv("XDG_DATA_HOME")); ++ if (xdgDataHome.IsEmpty()) { ++ xdgDataHome = "~/.local/share"; ++ } ++ path.ReplaceSubstring("$XDG_DATA_HOME", xdgDataHome.get()); ++ ++ // Expand leading ~ to the user's home directory ++ nsCOMPtr<nsIFile> homeDir; ++ nsresult rv = GetSpecialSystemDirectory(Unix_HomeDirectory, ++ getter_AddRefs(homeDir)); ++ if (NS_FAILED(rv)) { ++ errx(1, "failed getting home directory"); ++ } ++ if (path.FindChar('~') == 0) { ++ nsCString tHome(homeDir->NativePath()); ++ tHome.Append(Substring(path, 1, path.Length() - 1)); ++ path = tHome.get(); ++ } ++} ++ ++void ++MkdirP(nsAutoCString& path) { ++ // nsLocalFile::CreateAllAncestors would be nice to use ++ ++ nsAutoCString tPath(""); ++ for (const nsACString& dir : path.Split('/')) { ++ struct stat st; ++ ++ if (dir.IsEmpty()) { ++ continue; ++ } ++ ++ tPath.Append("/"); ++ tPath.Append(dir); ++ ++ if (stat(tPath.get(), &st) == -1) { ++ if (mkdir(tPath.get(), 0700) == -1) { ++ err(1, "failed mkdir(%s) while MkdirP(%s)", ++ PromiseFlatCString(tPath).get(), PromiseFlatCString(path).get()); ++ } ++ } ++ ++ } ++} ++ ++NS_IMETHODIMP ++OpenBSDUnveilPaths(const nsACString& uPath, const nsACString& pledgePath) { ++ // Using NS_LOCAL_FILE_CONTRACTID/NS_LOCALFILEINPUTSTREAM_CONTRACTID requires ++ // a lot of setup before they are allowed/supported and we want to pledge and ++ // unveil early on before all of that is setup ++ std::ifstream input(PromiseFlatCString(uPath).get()); ++ ++ bool disabled = false; ++ int linenum = 0; ++ for (std::string tLine; std::getline(input, tLine); ) { ++ nsAutoCString line(tLine.c_str()); ++ linenum++; ++ ++ // Cut off any comments at the end of the line, also catches lines ++ // that are entirely a comment ++ int32_t hash = line.FindChar('#'); ++ if (hash >= 0) { ++ line = Substring(line, 0, hash); ++ } ++ line.CompressWhitespace(true, true); ++ if (line.IsEmpty()) { ++ continue; ++ } ++ ++ int32_t space = line.FindChar(' '); ++ if (space <= 0) { ++ errx(1, "%s: line %d: invalid format", PromiseFlatCString(uPath).get(), ++ linenum); ++ } ++ ++ if (linenum == 1 && line.EqualsLiteral("disable")) { ++ disabled = true; ++ break; ++ } ++ ++ nsAutoCString uPath(Substring(line, 0, space)); ++ ExpandUnveilPath(uPath); ++ ++ nsAutoCString perms(Substring(line, space + 1, line.Length() - space - 1)); ++ ++ MOZ_LOG(sPledgeLog, LogLevel::Debug, ("%s: unveil(%s, %s)\n", ++ PromiseFlatCString(uPath).get(), uPath.get(), perms.get())); ++ if (unveil(uPath.get(), perms.get()) == -1 && errno != ENOENT) { ++ err(1, "%s: unveil(%s, %s) failed", PromiseFlatCString(uPath).get(), ++ uPath.get(), perms.get()); ++ } ++ } ++ input.close(); ++ ++ if (disabled) { ++ warnx("%s: disabled", PromiseFlatCString(uPath).get()); ++ } else { ++ if (unveil(PromiseFlatCString(pledgePath).get(), "r") == -1) { ++ err(1, "unveil(%s, r) failed", PromiseFlatCString(pledgePath).get()); ++ } ++ } ++ ++ return NS_OK; ++} ++ + bool StartOpenBSDSandbox(GeckoProcessType type) { +- nsAutoCString promisesString; +- nsAutoCString processTypeString; ++ nsAutoCString pledgeFile; ++ nsAutoCString unveilFile; + + switch (type) { +- case GeckoProcessType_Default: +- processTypeString = "main"; +- Preferences::GetCString("security.sandbox.pledge.main", promisesString); ++ case GeckoProcessType_Default: { ++ OpenBSDFindPledgeUnveilFilePath("pledge.main", pledgeFile); ++ OpenBSDFindPledgeUnveilFilePath("unveil.main", unveilFile); ++ ++ // Ensure dconf dir exists before we veil the filesystem ++ nsAutoCString dConf("$XDG_CACHE_HOME/dconf"); ++ ExpandUnveilPath(dConf); ++ MkdirP(dConf); + break; ++ } + + case GeckoProcessType_Content: +- processTypeString = "content"; +- Preferences::GetCString("security.sandbox.pledge.content", +- promisesString); ++ OpenBSDFindPledgeUnveilFilePath("pledge.content", pledgeFile); ++ OpenBSDFindPledgeUnveilFilePath("unveil.content", unveilFile); + break; + ++ case GeckoProcessType_GPU: ++ OpenBSDFindPledgeUnveilFilePath("pledge.gpu", pledgeFile); ++ OpenBSDFindPledgeUnveilFilePath("unveil.gpu", unveilFile); ++ break; ++ + default: + MOZ_ASSERT(false, "unknown process type"); + return false; +- }; ++ } + +- if (pledge(promisesString.get(), NULL) == -1) { +- if (errno == EINVAL) { +- MOZ_LOG(sPledgeLog, LogLevel::Error, +- ("pledge promises for %s process is a malformed string: '%s'\n", +- processTypeString.get(), promisesString.get())); +- } else if (errno == EPERM) { +- MOZ_LOG( +- sPledgeLog, LogLevel::Error, +- ("pledge promises for %s process can't elevate privileges: '%s'\n", +- processTypeString.get(), promisesString.get())); +- } +- return false; +- } else { +- MOZ_LOG(sPledgeLog, LogLevel::Debug, +- ("pledged %s process with promises: '%s'\n", +- processTypeString.get(), promisesString.get())); ++ if (NS_WARN_IF(NS_FAILED(OpenBSDUnveilPaths(unveilFile, pledgeFile)))) { ++ errx(1, "failed reading/parsing %s", unveilFile.get()); + } ++ ++ if (NS_WARN_IF(NS_FAILED(OpenBSDPledgePromises(pledgeFile)))) { ++ errx(1, "failed reading/parsing %s", pledgeFile.get()); ++ } ++ ++ // Don't overwrite an existing session dbus address, but ensure it is set ++ if (!PR_GetEnv("DBUS_SESSION_BUS_ADDRESS")) { ++ PR_SetEnv("DBUS_SESSION_BUS_ADDRESS="); ++ } ++ + return true; + } + #endif Index: patches/patch-gfx_ipc_GPUProcessImpl_cpp =================================================================== RCS file: patches/patch-gfx_ipc_GPUProcessImpl_cpp diff -N patches/patch-gfx_ipc_GPUProcessImpl_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-gfx_ipc_GPUProcessImpl_cpp 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,25 @@ +$OpenBSD$ + +https://bugzilla.mozilla.org/show_bug.cgi?id=1580268 + +Index: gfx/ipc/GPUProcessImpl.cpp +--- gfx/ipc/GPUProcessImpl.cpp.orig ++++ gfx/ipc/GPUProcessImpl.cpp +@@ -10,6 +10,8 @@ + + #if defined(OS_WIN) && defined(MOZ_SANDBOX) + # include "mozilla/sandboxTarget.h" ++#elif defined(__OpenBSD__) && defined(MOZ_SANDBOX) ++# include "mozilla/SandboxSettings.h" + #endif + + namespace mozilla { +@@ -25,6 +27,8 @@ GPUProcessImpl::~GPUProcessImpl() {} + bool GPUProcessImpl::Init(int aArgc, char* aArgv[]) { + #if defined(MOZ_SANDBOX) && defined(OS_WIN) + mozilla::SandboxTarget::Instance()->StartSandbox(); ++#elif defined(__OpenBSD__) && defined(MOZ_SANDBOX) ++ StartOpenBSDSandbox(GeckoProcessType_GPU); + #endif + char* parentBuildID = nullptr; + char* prefsHandle = nullptr; Index: patches/patch-toolkit_system_gnome_nsGIOService_cpp =================================================================== RCS file: patches/patch-toolkit_system_gnome_nsGIOService_cpp diff -N patches/patch-toolkit_system_gnome_nsGIOService_cpp --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-toolkit_system_gnome_nsGIOService_cpp 4 Oct 2019 01:49:27 -0000 @@ -0,0 +1,27 @@ +$OpenBSD$ + +https://bugzilla.mozilla.org/show_bug.cgi?id=1580271 + +Index: toolkit/system/gnome/nsGIOService.cpp +--- toolkit/system/gnome/nsGIOService.cpp.orig ++++ toolkit/system/gnome/nsGIOService.cpp +@@ -497,7 +497,19 @@ nsGIOService::GetAppForMimeType(const nsACString& aMim + return NS_ERROR_NOT_AVAILABLE; + } + ++#if defined(__OpenBSD__) && defined(MOZ_SANDBOX) ++ // g_app_info_get_default_for_type will fail on OpenBSD's veiled filesystem ++ // since we most likely don't have direct access to the binaries that are ++ // registered as defaults for this type. Fake it up by just executing ++ // xdg-open via gio-launch-desktop (which we do have access to) and letting ++ // it figure out which program to execute for this MIME type ++ GAppInfo* app_info = g_app_info_create_from_commandline( ++ "/usr/local/bin/xdg-open", ++ nsPrintfCString("System default for %s", content_type).get(), ++ G_APP_INFO_CREATE_NONE, NULL); ++#else + GAppInfo* app_info = g_app_info_get_default_for_type(content_type, false); ++#endif + if (app_info) { + nsGIOMimeApp* mozApp = new nsGIOMimeApp(app_info); + NS_ENSURE_TRUE(mozApp, NS_ERROR_OUT_OF_MEMORY); Index: pkg/PLIST =================================================================== RCS file: /cvs/ports/www/mozilla-firefox/pkg/PLIST,v retrieving revision 1.80 diff -u -p -u -p -r1.80 PLIST --- pkg/PLIST 21 May 2019 16:51:12 -0000 1.80 +++ pkg/PLIST 4 Oct 2019 01:49:27 -0000 @@ -28,6 +28,12 @@ lib/${MOZILLA_PROJECT}/browser/chrome/ic lib/${MOZILLA_PROJECT}/browser/defaults/ lib/${MOZILLA_PROJECT}/browser/defaults/preferences/ lib/${MOZILLA_PROJECT}/browser/defaults/preferences/all-openbsd.js +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/pledge.content +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/pledge.gpu +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/pledge.main +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/unveil.content +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/unveil.gpu +lib/${MOZILLA_PROJECT}/browser/defaults/preferences/unveil.main lib/${MOZILLA_PROJECT}/browser/features/ lib/${MOZILLA_PROJECT}/browser/features/[email protected] lib/${MOZILLA_PROJECT}/browser/features/[email protected] Index: pkg/README =================================================================== RCS file: /cvs/ports/www/mozilla-firefox/pkg/README,v retrieving revision 1.24 diff -u -p -u -p -r1.24 README --- pkg/README 11 Jun 2019 06:01:20 -0000 1.24 +++ pkg/README 4 Oct 2019 01:49:27 -0000 @@ -14,6 +14,43 @@ firefox -ProfileManager, and click "Crea If Firefox doesn't start at all, try starting it with -safe-mode switch, which disables extensions and themes for your session. +pledge(2) and unveil(2) Support +=============================== +Firefox on OpenBSD is secured with pledge(2) and unveil(2) to limit +the system calls and filesystem access that each of Firefox's three +process types (main, content, and GPU) is permitted. By default, +only ~/Downloads and /tmp can be written to when downloading files, +or when viewing local files as file:// URLs. + +Files containing pledge promises and unveil paths and permissions +for each type of process are located in +${LOCALBASE}/lib/${MOZILLA_PROJECT}/browser/defaults/preferences/. +Each file can be overridden by copying it to ${SYSCONFDIR}/firefox/ +and modifying it. + +3rd-Party MIME Handlers +======================= +Due to unveil(2) limiting filesystem access, only the default MIME +handler registered for a given type can be chosen when opening a +downloaded file. For example, to use the mupdf package to read +PDFs, it must be registered as the default with XDG: + + $ xdg-mime default mupdf.desktop application/pdf + +The current default for a given type can be viewed with xdg-mime's +query command: + + $ xdg-mime query default application/pdf + +The older mailcap-format handlers are also supported, but the path +being executed must be explicitly added to the unveil.main file +with "rx" permissions. For example, a ~/.mailcap file specifying: + + application/pdf; ${LOCALBASE}/bin/xpdf %s + +must have "${LOCALBASE}/bin/xpdf rx" added to unveil.main for it to +appear as an option in the "Open With" drop-down. + Using mailto: links =================== To enable mailto: links in Firefox to open in your mail program, @@ -33,22 +70,25 @@ Debugging If you encounter crashes, you might want to build the debug FLAVOR of this package, and run firefox inside egdb, so that you can gather debugging logs and traces (for all threads!). + If this is a pledge violation, you should figure out which codepath in which process leads to calling a forbidden syscall, and which pledge -is missing from the two default sets configured in -security.sandbox.pledge.main and security.sandbox.pledge.content -about:config keys. MOZ_LOG=SandboxPledge:5 should help. -Bug reports without enough information will be ignored. +is missing from the sets configured according to the section above. +Setting MOZ_LOG=SandboxPledge:5 should help. Bug reports without +enough information will be ignored. Note that if you're using NIS or your profile is located on a NFS share, -you might need to add 'getpw' to security.sandbox.pledge.content in -about:config. +you might need to add 'getpw' to the the pledge.content file. + +If using the amdgpu driver, you might need to add 'ioctl' to the +pledge.content file. -If using the amdgpu driver, you might need to add 'ioctl' to -security.sandbox.pledge.content in about:config. +If you're not running sndiod(8) you will need to add 'audio' to the +pledge.main file. -If you're not running sndiod(8) you will need to add 'audio' to -security.sandbox.pledge.main in about:config. +To disable pledge and/or unveil support when troubleshooting, set +the corresponding pledge or unveil file to just contain the string +"disable". D-BUS =====
