From 07e2068a94e5c065693fa9c9ae7d669bb190b8677d7417c5d2a4c124de43cc77 Mon Sep 17 00:00:00 2001
From: Wolfgang Rosenauer <wolfgang@rosenauer.org>
Date: Thu, 21 Oct 2021 06:51:24 +0000
Subject: [PATCH] Accepting request 926488 from
 home:MSirringhaus:branches:mozilla:Factory

- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141

OBS-URL: https://build.opensuse.org/request/show/926488
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=938
---
 MozillaFirefox.changes     |  8 +++++++
 mozilla-sandbox-fips.patch | 47 +++++++++++++++-----------------------
 2 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes
index d75b3c0c..6c2fe80a 100644
--- a/MozillaFirefox.changes
+++ b/MozillaFirefox.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Oct 20 06:49:52 UTC 2021 - Martin Sirringhaus <martin.sirringhaus@suse.com>
+
+- Rebase mozilla-sandbox-fips.patch to punch another hole in the
+  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled 
+  from within the newly introduced socket process sandbox.
+  This fixes bsc#1191815 and bsc#1190141
+
 -------------------------------------------------------------------
 Mon Oct 18 12:44:44 UTC 2021 - Guillaume GARDET <guillaume.gardet@opensuse.org>
 
diff --git a/mozilla-sandbox-fips.patch b/mozilla-sandbox-fips.patch
index 8381299f..fda8b550 100644
--- a/mozilla-sandbox-fips.patch
+++ b/mozilla-sandbox-fips.patch
@@ -4,15 +4,11 @@ References:
 http://bugzilla.suse.com/show_bug.cgi?id=1167132
 bsc#1174284 - Firefox tab just crashed in FIPS mode
 
-diff --git a/security/sandbox/linux/Sandbox.cpp b/security/sandbox/linux/Sandbox.cpp
---- a/security/sandbox/linux/Sandbox.cpp
-+++ b/security/sandbox/linux/Sandbox.cpp
-@@ -650,16 +650,17 @@ void SetMediaPluginSandbox(const char* a
-     SANDBOX_LOG_ERROR("failed to open plugin file %s: %s", aFilePath,
-                       strerror(errno));
-     MOZ_CRASH("failed while trying to open the plugin file ");
-   }
- 
+Index: firefox-93.0/security/sandbox/linux/Sandbox.cpp
+===================================================================
+--- firefox-93.0.orig/security/sandbox/linux/Sandbox.cpp
++++ firefox-93.0/security/sandbox/linux/Sandbox.cpp
+@@ -655,6 +655,7 @@ void SetMediaPluginSandbox(const char* a
    auto files = new SandboxOpenedFiles();
    files->Add(std::move(plugin));
    files->Add("/dev/urandom", SandboxOpenedFile::Dup::YES);
@@ -20,20 +16,11 @@ diff --git a/security/sandbox/linux/Sandbox.cpp b/security/sandbox/linux/Sandbox
    files->Add("/etc/ld.so.cache");  // Needed for NSS in clearkey.
    files->Add("/sys/devices/system/cpu/cpu0/tsc_freq_khz");
    files->Add("/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq");
-   files->Add("/proc/cpuinfo");  // Info also available via CPUID instruction.
-   files->Add("/proc/sys/crypto/fips_enabled");  // Needed for NSS in clearkey.
- #ifdef __i386__
-   files->Add("/proc/self/auxv");  // Info also in process's address space.
- #endif
-diff --git a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
---- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-+++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-@@ -315,16 +315,18 @@ void SandboxBrokerPolicyFactory::InitCon
-     policy->AddDir(rdwr, "/dev/dri");
-   }
- 
-   // Bug 1575985: WASM library sandbox needs RW access to /dev/null
-   policy->AddPath(rdwr, "/dev/null");
+Index: firefox-93.0/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
+===================================================================
+--- firefox-93.0.orig/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
++++ firefox-93.0/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
+@@ -320,6 +320,8 @@ void SandboxBrokerPolicyFactory::InitCon
  
    // Read permissions
    policy->AddPath(rdonly, "/dev/urandom");
@@ -42,8 +29,12 @@ diff --git a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp b/secu
    policy->AddPath(rdonly, "/proc/cpuinfo");
    policy->AddPath(rdonly, "/proc/meminfo");
    policy->AddDir(rdonly, "/sys/devices/cpu");
-   policy->AddDir(rdonly, "/sys/devices/system/cpu");
-   policy->AddDir(rdonly, "/lib");
-   policy->AddDir(rdonly, "/lib64");
-   policy->AddDir(rdonly, "/usr/lib");
-   policy->AddDir(rdonly, "/usr/lib32");
+@@ -792,6 +794,8 @@ SandboxBrokerPolicyFactory::GetSocketPro
+   auto policy = MakeUnique<SandboxBroker::Policy>();
+ 
+   policy->AddPath(rdonly, "/dev/urandom");
++  policy->AddPath(rdonly, "/dev/random");
++  policy->AddPath(rdonly, "/proc/sys/crypto/fips_enabled");
+   policy->AddPath(rdonly, "/proc/cpuinfo");
+   policy->AddPath(rdonly, "/proc/meminfo");
+   policy->AddDir(rdonly, "/sys/devices/cpu");