== Use in Gecko ==
Gecko on the desktop and in B2G use seccomp when running on Linux.The code is in mozilla-central at /security/sandbox/linux. Files of interest:
'''File''' security/* Sandbox.h: the public interface; used when a child process is ready to enter sandboxed mode* SandboxFilter.cpp: the sandbox policy definitions* SandboxAssembler.{h,cpp}: implements the policies in terms of the Chromium CodeGen module* Sandbox.cpp: the code that starts the sandbox/linux/seccomp_filterand handles violations (note: this is changing soon; see {{bug|1041886}}).* {arm,x86_{32,64}}_linux_syscalls.h: syscall number definitions; grep these to translate syscall numbers seen in error messages (use the file corresponding to the architecture in question)
Contains a whitelist We also have an import of allowed system calls. '''File''' the Chromium seccomp-bpf libraries at security/sandbox/chromium/sandbox/linux/Sandbox.cpp Contains seccomp-bpf; we're currently using the sandbox installation codeCodeGen/BasicBlock/Instruction layer, called by: SetCurrentProcessSandboxbut not ErrorCode or SandboxBPF (voidyet).
=== Seccomp reporter ===
The reporter is an option which will log exactly which system call has been denied by seccomp. It is enabled by default in engineering builds ("eng" builds).The option is --content-sandbox-reporter. When seccomp denies a system call, it sends a signal (SIGSYS) which is caught handled by the reporter. The reporter then kills itself (and thus logs information about the content-process).The report kill itself because syscall, invokes the content process may not handle crash reporter, tries to log the denied system call properly current JS stack if any, and be in a non-working state anywayfinally terminates the process.
When the reporter is enabled, the The log message looks like this:
seccomp sandbox violation: pid %u, syscall %lu, args %lu %lu %lu %lu %lu. Killing Process.
=== How do I check my processes are sandboxed by seccomp? ===
There is a seccomp flag in the process status
: Replace . Use this command, replacing <pid>
by with the process's PID
.: grep Seccomp /proc/<pid>/status
* 0: Seccomp is not enabled (bad!)
* 1: Seccomp "strict mode" is enabled (shouldn't happen)
* 2: Seccomp-bpf is enabled (correct)
=== How do I disable the sandbox temporarily? ===
For content process ([[Electrolysis|e10s]], B2G) sandboxing:
export MOZ_DISABLE_CONTENT_SANDBOX=1
export MOZ_DISABLE_CONTENT_SANDBOX=1
/system/bin/b2g.sh
For Gecko Media Plugin sandboxing on desktop (OpenH264, EME, etc.):
export MOZ_DISABLE_GMP_SANDBOX=1
Also, to simulate the effect of having no sandbox support in the kernel:
export MOZ_FAKE_NO_SANDBOX=1
In particular, this will disable media plugin support on desktop, and cause B2G based on Android KitKat or later to completely refuse to start, unless the corresponding DISABLE option is set — which is the intended behavior if sandboxing isn't possible in those cases. This is probably not useful except to test that kind of mandatory-sandboxing feature.
== More information ==
