cromite/build/patches/Improve-the-browser-sandbox.patch

From: uazo <uazo@users.noreply.github.com>
Date: Fri, 17 Feb 2023 16:23:20 +0000
Subject: Improve the browser sandbox

by enabling network service sandbox and CIG in windows and
using the new flags on android

License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
 .../android/java/res/xml/developer_preferences.xml   |  5 +++++
 chrome/browser/net/system_network_context_manager.cc |  2 +-
 .../Improve-the-browser-sandbox.grdp                 |  9 +++++++++
 .../about_flags_cc/Improve-the-browser-sandbox.inc   | 12 ++++++++++++
 .../features_cc/Improve-the-browser-sandbox.inc      |  2 ++
 .../Improve-the-browser-sandbox.inc                  |  1 +
 sandbox/policy/features.cc                           | 10 +++++++++-
 7 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc
 create mode 100644 cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
 create mode 100644 cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc

diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml
--- a/chrome/android/java/res/xml/developer_preferences.xml
+++ b/chrome/android/java/res/xml/developer_preferences.xml
@@ -20,4 +20,9 @@ found in the LICENSE file.
         android:title="Hint: You can also enable Developer options on Beta/Stable channels by tapping the Chrome version in &quot;Settings > About Chrome&quot; multiple times."
         app:allowDividerAbove="false"
         app:allowDividerBelow="false" />
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:title="@string/android_gpu_sandbox_title"
+        android:summary="@string/android_gpu_sandbox_summary"
+        app:featureName="android-gpu-sandbox"
+        app:needRestart="true" />
 </PreferenceScreen>
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -358,7 +358,7 @@ namespace features {
 // this feature is disabled any failed launches in the current browser session
 // will still result in sandbox being disabled for the lifetime of the running
 // browser.
-BASE_FEATURE(kPersistFailedLaunchState, base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kPersistFailedLaunchState, base::FEATURE_DISABLED_BY_DEFAULT);
 }  // namespace features
 
 class SystemNetworkContextManager::NetworkProcessLaunchWatcher
diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp
new file mode 100644
--- /dev/null
+++ b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Improve-the-browser-sandbox.grdp
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<grit-part>
+    <message name="IDS_ANDROID_GPU_SANDBOX_TITLE" desc="Text for 'Enable Landlock' settings option.">
+        Android GPU sandbox
+    </message>
+    <message name="IDS_ANDROID_GPU_SANDBOX_SUMMARY" desc="Summary text for 'Enable Landlock' settings option.">
+        Enables the experimental Android GPU sandbox using Landlock (A16+)
+    </message>
+</grit-part>
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc b/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Improve-the-browser-sandbox.inc
@@ -0,0 +1,12 @@
+#ifdef FLAG_SECTION
+
+#if BUILDFLAG(IS_ANDROID)
+
+    {"android-gpu-sandbox",
+     "Enable Gpu Sandbox",
+     "Enables the experimental Android GPU sandbox using Landlock", kOsAndroid,
+     FEATURE_VALUE_TYPE(sandbox::policy::features::kAndroidGpuSandbox)},
+
+#endif
+
+#endif // ifdef FLAG_SECTION
diff --git a/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
@@ -0,0 +1,2 @@
+SET_CROMITE_FEATURE_ENABLED(kCommittedOriginEnforcements);
+SET_CROMITE_FEATURE_ENABLED(kCommittedOriginTracking);
diff --git a/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
@@ -0,0 +1 @@
+// intentionally empty
diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
--- a/sandbox/policy/features.cc
+++ b/sandbox/policy/features.cc
@@ -112,7 +112,7 @@ BASE_FEATURE(kHigherRendererMemoryLimit, base::FEATURE_DISABLED_BY_DEFAULT);
 
 #if BUILDFLAG(IS_ANDROID)
 // Enables the experimental Android GPU sandbox using Landlock.
-BASE_FEATURE(kAndroidGpuSandbox, base::FEATURE_DISABLED_BY_DEFAULT);
+CROMITE_FEATURE(kAndroidGpuSandbox, "AndroidGpuSandbox", base::FEATURE_DISABLED_BY_DEFAULT);
 // Enables the renderer on Android to use a separate seccomp policy.
 BASE_FEATURE(kUseRendererProcessPolicy, base::FEATURE_ENABLED_BY_DEFAULT);
 // When enabled, this features restricts a set of syscalls in
@@ -167,4 +167,12 @@ bool IsNetworkSandboxEnabled() {
 #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
 }
 
+#if BUILDFLAG(IS_ANDROID)
+SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy);
+SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline);
+#endif
+#if BUILDFLAG(IS_WIN)
+SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox);
+SET_CROMITE_FEATURE_ENABLED(kNetworkServiceCodeIntegrity);
+#endif
 }  // namespace sandbox::policy::features
--