Hi,
so i've had various reports from confused ppl about pledge in firefox.
Here's more info on how you can be helpful when reporting issues:
The default pledges are set in about:config (via
www/mozilla-firefox/files/all-openbsd.js) and are:
pref("security.sandbox.pledge.main","stdio rpath wpath cpath inet proc exec
prot_exec flock ps sendfd recvfd dns vminfo tty drm unix fattr");
pref("security.sandbox.pledge.content","stdio rpath wpath cpath inet recvfd
sendfd prot_exec unix drm ps");
Those are the ones you can tweak for now via about:config at runtime (or vi
~/.mozilla/firefox/$YOURPROFILE/prefs.js if it doesnt start)
If you want to disable a pledge, put a random invalid string in the config key.
Of course, you'll get zero support from me.
I've been using those without issues for the past two weeks, but always in a
desktop environment (Xfce). For some of you who don't run desktop sessions and
have no dbus-daemon running, maybe you should start it somehow within your
session, otherwise the content process seems to try spawning it via glib at the
first use, and gets killed as it has no 'proc' or 'exec' rights. Tough luck.
If you get an abort from pledge, collect:
- what you were doing, on which website, etc etc
- firefox stdout, to figure out the various processes/pids running
- what process was killed, for which syscall (ie in dmesg)
- have a look at ~/firefox.core via egdb, try to get a meaningful trace of the
codepath that triggered the pledge. There might be dragons/hidden signal
handlers.
- try to reproduce the crash inside ktrace/kdump (ie start ffx via 'ktrace -di
-t cp -- firefox', thx kn@)
- the codebase is huge, but try to figure out where that codepath is.
https://dxr.mozilla.org/mozilla-release/source/ is here for that
- try adding a missing pledge. There are already many (way too many, some might
say), but maybe some are missing for valid usecases. I don't know, i don't
have such usecases. Those WFM.
All that to say, please try to figure out stuff by yourself before sending me
sparse info that wont help at all.
Thx
Landry
