Merge pull request #17739 from Rmys/master

firefox-145.0
2025-11-15 17:00:24 +03:00
parent a4b5c2fc1d abdcbb06ce
commit 9be4f647eb
2 changed files with 40 additions and 1 deletions
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jed Davis <jld@mozilla.com>
+Date: Fri, 31 Oct 2025 05:25:52 +0100
+Subject: [PATCH] Bug 1995035 - Allow `F_DUPFD_QUERY` in the Linux sandboxes.
+ r?gcp,thinker
+
+Differential Revision: https://phabricator.services.mozilla.com/D270797
+---
+ security/sandbox/linux/SandboxFilter.cpp | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp
+index aabfd088f8be..4a161fe53e90 100644
+--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
+@@ -130,6 +130,13 @@ static_assert(MFD_HUGE_MASK == MAP_HUGE_MASK);
+ static_assert(MFD_HUGE_SHIFT == MAP_HUGE_SHIFT);
+ #endif
+ 
+// Added in 6.10
+#ifndef F_DUPFD_QUERY
+#  define F_DUPFD_QUERY (F_LINUX_SPECIFIC_BASE + 3)
+#else
+static_assert(F_DUPFD_QUERY == (F_LINUX_SPECIFIC_BASE + 3));
+#endif
+
+ // To avoid visual confusion between "ifdef ANDROID" and "ifndef ANDROID":
+ #ifndef ANDROID
+ #  define DESKTOP
+@@ -1112,6 +1119,9 @@ class SandboxPolicyCommon : public SandboxPolicyBase {
+ #endif
+             // Not much different from other forms of dup(), and commonly used.
+             .Case(F_DUPFD_CLOEXEC, Allow())
+            // Used by Mesa, generally useful, and harmless: tests if
+            // two file descriptors refer to the same file description.
+            .Case(F_DUPFD_QUERY, Allow())
+             .Default(SandboxPolicyBase::EvaluateSyscall(sysno));
+       }
+ 
@@ -77,7 +77,7 @@
            <Dependency>jack-audio-connection-kit-devel</Dependency>
        </BuildDependencies>
        <Patches>
-<!--             <Patch level="1">rust-lto-thin.patch</Patch> -->
+            <Patch level="1">0002-Bug-1995035-Allow-F_DUPFD_QUERY-in-the-Linux-sandbox.patch</Patch>
 <!--             <Patch level="1">riscv64-no-lto.patch</Patch> -->
 <!--             <Patch level="1">0002-Bug-1804973-Wayland-Check-size-for-valid-EGLWindows-.patch</Patch> -->
 <!--             <Patch level="1">zstandard-0.18.0.diff</Patch> -->