From: uazo Date: Fri, 17 Feb 2023 16:23:20 +0000 Subject: Improve the browser sandbox by enabling network service sandbox and CIG in windows and using the new flags on android License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- .../android/java/res/xml/developer_preferences.xml | 5 +++++ chrome/browser/net/system_network_context_manager.cc | 2 +- .../Improve-the-browser-sandbox.grdp | 9 +++++++++ .../about_flags_cc/Improve-the-browser-sandbox.inc | 12 ++++++++++++ .../features_cc/Improve-the-browser-sandbox.inc | 2 ++ .../Improve-the-browser-sandbox.inc | 1 + sandbox/policy/features.cc | 10 +++++++++- 7 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc create mode 100644 cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc create mode 100644 cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml --- a/chrome/android/java/res/xml/developer_preferences.xml +++ b/chrome/android/java/res/xml/developer_preferences.xml @@ -20,4 +20,9 @@ found in the LICENSE file. android:title="Hint: You can also enable Developer options on Beta/Stable channels by tapping the Chrome version in "Settings > About Chrome" multiple times." app:allowDividerAbove="false" app:allowDividerBelow="false" /> + diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc --- a/chrome/browser/net/system_network_context_manager.cc +++ b/chrome/browser/net/system_network_context_manager.cc @@ -358,7 +358,7 @@ namespace features { // this feature is disabled any failed launches in the current browser session // will still result in sandbox being disabled for the lifetime of the running // browser. -BASE_FEATURE(kPersistFailedLaunchState, base::FEATURE_ENABLED_BY_DEFAULT); +BASE_FEATURE(kPersistFailedLaunchState, base::FEATURE_DISABLED_BY_DEFAULT); } // namespace features class SystemNetworkContextManager::NetworkProcessLaunchWatcher diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp new file mode 100644 --- /dev/null +++ b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp @@ -0,0 +1,9 @@ + + + + Android GPU sandbox + + + Enables the experimental Android GPU sandbox using Landlock (A16+) + + diff --git a/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc b/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc @@ -0,0 +1,12 @@ +#ifdef FLAG_SECTION + +#if BUILDFLAG(IS_ANDROID) + + {"android-gpu-sandbox", + "Enable Gpu Sandbox", + "Enables the experimental Android GPU sandbox using Landlock", kOsAndroid, + FEATURE_VALUE_TYPE(sandbox::policy::features::kAndroidGpuSandbox)}, + +#endif + +#endif // ifdef FLAG_SECTION diff --git a/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc @@ -0,0 +1,2 @@ +SET_CROMITE_FEATURE_ENABLED(kCommittedOriginEnforcements); +SET_CROMITE_FEATURE_ENABLED(kCommittedOriginTracking); diff --git a/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc @@ -0,0 +1 @@ +// intentionally empty diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc --- a/sandbox/policy/features.cc +++ b/sandbox/policy/features.cc @@ -112,7 +112,7 @@ BASE_FEATURE(kHigherRendererMemoryLimit, base::FEATURE_DISABLED_BY_DEFAULT); #if BUILDFLAG(IS_ANDROID) // Enables the experimental Android GPU sandbox using Landlock. -BASE_FEATURE(kAndroidGpuSandbox, base::FEATURE_DISABLED_BY_DEFAULT); +CROMITE_FEATURE(kAndroidGpuSandbox, "AndroidGpuSandbox", base::FEATURE_DISABLED_BY_DEFAULT); // Enables the renderer on Android to use a separate seccomp policy. BASE_FEATURE(kUseRendererProcessPolicy, base::FEATURE_ENABLED_BY_DEFAULT); // When enabled, this features restricts a set of syscalls in @@ -167,4 +167,12 @@ bool IsNetworkSandboxEnabled() { #endif // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) } +#if BUILDFLAG(IS_ANDROID) +SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy); +SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline); +#endif +#if BUILDFLAG(IS_WIN) +SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox); +SET_CROMITE_FEATURE_ENABLED(kNetworkServiceCodeIntegrity); +#endif } // namespace sandbox::policy::features --