From 7998846c205aa0683565546ec3fcf4746f9c2701 Mon Sep 17 00:00:00 2001 From: Carmelo Messina Date: Wed, 6 Dec 2023 13:44:19 +0100 Subject: [PATCH] Improve the browser sandbox by using the new flags on android and renamed the patch name --- build/bromite_patches_list.txt | 2 +- ...atch => Improve-the-browser-sandbox.patch} | 33 ++++++++++--------- 2 files changed, 18 insertions(+), 17 deletions(-) rename build/patches/{00WIN-Enable-Network-Service-Sandbox-and-CIG.patch => Improve-the-browser-sandbox.patch} (58%) diff --git a/build/bromite_patches_list.txt b/build/bromite_patches_list.txt index 541e3b54..fb76e954 100644 --- a/build/bromite_patches_list.txt +++ b/build/bromite_patches_list.txt @@ -206,7 +206,7 @@ AudioBuffer-AnalyserNode-fp-mitigations.patch 00Disable-visited-pseudo-class.patch 00Add-setting-to-clear-data-on-exit.patch 00WIN-Disable-sharing-hub.patch -00WIN-Enable-Network-Service-Sandbox-and-CIG.patch +Improve-the-browser-sandbox.patch 00Disable-csp-reports.patch 00Fonts-fingerprinting-mitigation.patch 00Keyboard-protection-flag.patch diff --git a/build/patches/00WIN-Enable-Network-Service-Sandbox-and-CIG.patch b/build/patches/Improve-the-browser-sandbox.patch similarity index 58% rename from build/patches/00WIN-Enable-Network-Service-Sandbox-and-CIG.patch rename to build/patches/Improve-the-browser-sandbox.patch index 833c3383..0432fa48 100644 --- a/build/patches/00WIN-Enable-Network-Service-Sandbox-and-CIG.patch +++ b/build/patches/Improve-the-browser-sandbox.patch @@ -1,12 +1,15 @@ From: uazo Date: Fri, 17 Feb 2023 16:23:20 +0000 -Subject: WIN Enable Network Service Sandbox and CIG +Subject: Improve the browser sandbox + +by enabling network service sandbox and CIG in windows and +using the new flags on android License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- chrome/browser/chrome_content_browser_client.cc | 2 +- - sandbox/policy/features.cc | 6 +++++- - 2 files changed, 6 insertions(+), 2 deletions(-) + sandbox/policy/features.cc | 7 +++++++ + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc --- a/chrome/browser/chrome_content_browser_client.cc @@ -23,19 +26,17 @@ diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/ch diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc --- a/sandbox/policy/features.cc +++ b/sandbox/policy/features.cc -@@ -18,8 +18,12 @@ namespace sandbox::policy::features { - // Enables network service sandbox. - // (Only causes an effect when feature kNetworkServiceInProcess is disabled.) - BASE_FEATURE(kNetworkServiceSandbox, -- "NetworkServiceSandbox", -+ "NetworkServiceSandbox", // enabled only in windows -+#if BUILDFLAG(IS_WIN) -+ base::FEATURE_ENABLED_BY_DEFAULT); -+#else - base::FEATURE_DISABLED_BY_DEFAULT); -+#endif +@@ -194,4 +194,11 @@ bool IsNetworkSandboxEnabled() { + #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) + } - #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) - // Enables a fine-grained seccomp-BPF syscall filter for the network service. ++#if BUILDFLAG(IS_ANDROID) ++SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy); ++SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline); ++#endif ++#if BUILDFLAG(IS_WIN) ++SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox); ++#endif + } // namespace sandbox::policy::features -- 2.25.1