48 lines
2.1 KiB
Diff
48 lines
2.1 KiB
Diff
From: uazo <uazo@users.noreply.github.com>
|
|
Date: Fri, 17 Feb 2023 16:23:20 +0000
|
|
Subject: Improve the browser sandbox
|
|
|
|
by enabling network service sandbox and CIG in windows and
|
|
using the new flags on android
|
|
|
|
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
|
|
---
|
|
.../common/features_cc/Improve-the-browser-sandbox.inc | 2 ++
|
|
.../content_features_cc/Improve-the-browser-sandbox.inc | 1 +
|
|
sandbox/policy/features.cc | 9 +++++++++
|
|
3 files changed, 12 insertions(+)
|
|
create mode 100644 cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
|
|
create mode 100644 cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
|
|
|
|
diff --git a/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
|
|
@@ -0,0 +1,2 @@
|
|
+SET_CROMITE_FEATURE_ENABLED(kCommittedOriginEnforcements);
|
|
+SET_CROMITE_FEATURE_ENABLED(kCommittedOriginTracking);
|
|
diff --git a/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ b/cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
|
|
@@ -0,0 +1 @@
|
|
+// intentionally empty
|
|
diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
|
|
--- a/sandbox/policy/features.cc
|
|
+++ b/sandbox/policy/features.cc
|
|
@@ -224,4 +224,13 @@ bool IsParallelLaunchEnabled() {
|
|
return base::FeatureList::IsEnabled(kWinSboxParallelProcessLaunch);
|
|
}
|
|
#endif // BUILDFLAG(IS_WIN)
|
|
+
|
|
+#if BUILDFLAG(IS_ANDROID)
|
|
+SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy);
|
|
+SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline);
|
|
+#endif
|
|
+#if BUILDFLAG(IS_WIN)
|
|
+SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox);
|
|
+SET_CROMITE_FEATURE_ENABLED(kNetworkServiceCodeIntegrity);
|
|
+#endif
|
|
} // namespace sandbox::policy::features
|
|
--
|