From 8ac9a4bfce9265cd5f9b93c737c0b76efd7f3bcb Mon Sep 17 00:00:00 2001 From: Carmelo Messina Date: Wed, 22 Jan 2025 13:51:53 +0100 Subject: [PATCH] Improve the browser sandbox: enable kCommittedOriginEnforcements by default Turn on enforcements based on tracking the list of committed origins in ChildProcessSecurityPolicy::CanAccessMaybeOpaqueOrigin() see https://issues.chromium.org/issues/40148776 Enable kUseBrowserCalculatedOrigin by default (will be activated by default with 133) see https://issues.chromium.org/issues/40092527 --- .../patches/Improve-the-browser-sandbox.patch | 21 +++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/build/patches/Improve-the-browser-sandbox.patch b/build/patches/Improve-the-browser-sandbox.patch index 2134a8ed..39c1e8b8 100644 --- a/build/patches/Improve-the-browser-sandbox.patch +++ b/build/patches/Improve-the-browser-sandbox.patch @@ -7,9 +7,26 @@ using the new flags on android License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- - sandbox/policy/features.cc | 9 +++++++++ - 1 file changed, 9 insertions(+) + .../common/features_cc/Improve-the-browser-sandbox.inc | 2 ++ + .../content_features_cc/Improve-the-browser-sandbox.inc | 1 + + sandbox/policy/features.cc | 9 +++++++++ + 3 files changed, 12 insertions(+) + create mode 100644 cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc + create mode 100644 cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc +diff --git a/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc +new file mode 100644 +--- /dev/null ++++ b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc +@@ -0,0 +1,2 @@ ++SET_CROMITE_FEATURE_ENABLED(kCommittedOriginEnforcements); ++SET_CROMITE_FEATURE_ENABLED(kCommittedOriginTracking); +diff --git a/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc +new file mode 100644 +--- /dev/null ++++ b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc +@@ -0,0 +1 @@ ++SET_CROMITE_FEATURE_ENABLED(kUseBrowserCalculatedOrigin); diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc --- a/sandbox/policy/features.cc +++ b/sandbox/policy/features.cc