Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(340)

Issue 2338793003: services/shell: Turn on sandboxing for mojo apps.

Created:
1 year, 2 months ago by sadrul
Modified:
2 months, 2 weeks ago
CC:
chromium-reviews, qsr+mojo_chromium.org, viettrungluu+watch_chromium.org, yzshen+watch_chromium.org, abarth-chromium, Aaron Boodman, kalyank, darin (slow to review), rjkroege, fwang, tonikitoo
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

services/shell: Turn on sandboxing for mojo apps. Turn on sandbox for mojo apps by default. Apps that need to run without a sandbox need to include 'shell:unsandboxed' in their capabilities in manifest for mojo:shell. Update manifests for mojo:ui, mojo:font_service, mojo:file_system, and mojo:leveldb services to include 'shell:unsandboxed'. BUG=645602, 646376 Committed: https://crrev.com/43aa4f706d6020c93f11fa952d7f1d7a7337c570 Cr-Commit-Position: refs/heads/master@{#419891}

Patch Set 1 : . #

Patch Set 2 : . #

Patch Set 3 : . #

Patch Set 4 : . #

Patch Set 5 : . #

Patch Set 6 : . #

Patch Set 7 : . #

Patch Set 8 : . #

Patch Set 9 : . #

Unified diffs Side-by-side diffs Delta from patch set Stats (+34 lines, -7 lines) Patch
M chrome/app/mash/mash_runner.cc View 1 2 3 4 5 1 chunk +8 lines, -0 lines 0 comments Download
M chrome/test/base/mojo_test_connector.cc View 1 2 3 4 5 8 1 chunk +8 lines, -0 lines 0 comments Download
M components/filesystem/manifest.json View 1 2 3 4 5 1 chunk +2 lines, -1 line 0 comments Download
M components/font_service/manifest.json View 1 2 3 4 5 1 chunk +2 lines, -1 line 0 comments Download
M components/leveldb/manifest.json View 1 2 3 4 5 1 chunk +2 lines, -1 line 0 comments Download
M services/shell/service_manager.cc View 1 2 3 4 5 3 chunks +5 lines, -3 lines 0 comments Download
M services/ui/manifest.json View 1 2 3 4 5 1 chunk +7 lines, -1 line 0 comments Download
Trybot results:  linux_chromium_asan_rel_ng   win_clang   win_chromium_rel_ng   win_chromium_x64_rel_ng   mac_chromium_compile_dbg_ng   ios-device   android_arm64_dbg_recipe   ios-simulator   android_n5x_swarming_rel   android_compile_dbg   android_clang_dbg_recipe   cast_shell_android   win_chromium_compile_dbg_ng   linux_chromium_chromeos_compile_dbg_ng   linux_chromium_rel_ng   chromeos_x86-generic_chromium_compile_only_ng   chromium_presubmit   linux_chromium_compile_dbg_ng   chromeos_amd64-generic_chromium_compile_only_ng   cast_shell_linux   linux_chromium_chromeos_ozone_rel_ng   chromeos_daisy_chromium_compile_only_ng   linux_chromium_clobber_rel_ng   mac_chromium_rel_ng   linux_chromium_chromeos_rel_ng   chromium_presubmit   linux_android_rel_ng   linux_chromium_chromeos_rel_ng   win_clang   win_chromium_x64_rel_ng   win_chromium_compile_dbg_ng   win_chromium_rel_ng   ios-device   mac_chromium_compile_dbg_ng   ios-simulator   linux_android_rel_ng   mac_chromium_rel_ng   android_n5x_swarming_rel   android_clang_dbg_recipe   android_arm64_dbg_recipe   android_compile_dbg   cast_shell_android   linux_chromium_asan_rel_ng   linux_chromium_chromeos_compile_dbg_ng   linux_chromium_rel_ng   chromeos_x86-generic_chromium_compile_only_ng   chromeos_amd64-generic_chromium_compile_only_ng   chromium_presubmit   linux_chromium_compile_dbg_ng   cast_shell_linux   chromeos_daisy_chromium_compile_only_ng   linux_chromium_chromeos_ozone_rel_ng   linux_chromium_chromeos_rel_ng   linux_chromium_clobber_rel_ng 

Dependent Patchsets:

Messages

Total messages: 60 (45 generated)
sadrul
Hello! Does this look like a reasonable approach for dealing with sandboxing issues for now? ...
1 year, 2 months ago (2016-09-14 15:18:42 UTC) #20
Ken Rockot(use gerrit already)
On 2016/09/14 at 15:18:42, sadrul wrote: > Hello! Does this look like a reasonable approach ...
1 year, 2 months ago (2016-09-14 15:40:12 UTC) #21
Tom Sepez
Can we use a more specific term than Privileged since it really means "no-sandbox", e.g. ...
1 year, 2 months ago (2016-09-14 16:04:14 UTC) #22
Tom Sepez
On 2016/09/14 16:04:14, Tom Sepez wrote: > Can we use a more specific term than ...
1 year, 2 months ago (2016-09-14 16:06:29 UTC) #23
sadrul
On 2016/09/14 15:40:12, Ken Rockot wrote: > On 2016/09/14 at 15:18:42, sadrul wrote: > > ...
1 year, 2 months ago (2016-09-15 04:26:54 UTC) #26
Ken Rockot(use gerrit already)
On 2016/09/15 at 04:26:54, sadrul wrote: > On 2016/09/14 15:40:12, Ken Rockot wrote: > > ...
1 year, 2 months ago (2016-09-15 06:26:39 UTC) #29
Tom Sepez
lgtm
1 year, 2 months ago (2016-09-15 16:54:10 UTC) #34
sadrul
ben@: ping for the manifest changes.
1 year, 2 months ago (2016-09-16 16:48:44 UTC) #39
Ben Goodger (Google)
lgtm
1 year, 2 months ago (2016-09-20 21:37:03 UTC) #49
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2338793003/180001
1 year, 2 months ago (2016-09-20 22:26:11 UTC) #52
commit-bot: I haz the power
Committed patchset #9 (id:180001)
1 year, 2 months ago (2016-09-20 23:14:03 UTC) #54
commit-bot: I haz the power
Patchset 9 (id:??) landed as https://crrev.com/43aa4f706d6020c93f11fa952d7f1d7a7337c570 Cr-Commit-Position: refs/heads/master@{#419891}
1 year, 2 months ago (2016-09-20 23:17:15 UTC) #56
loyso (OOO)
I suspect that this CL causes reliable ChromeOS failures in mash_browser_tests: https://build.chromium.org/p/chromium.chromiumos/builders/Linux%20ChromiumOS%20Tests%20%281%29/builds/26525 https://build.chromium.org/p/chromium.chromiumos/builders/Linux%20ChromiumOS%20Tests%20%281%29/builds/26526 https://build.chromium.org/p/chromium.chromiumos/builders/Linux%20ChromiumOS%20Tests%20%281%29/builds/26527 Speculatively ...
1 year, 2 months ago (2016-09-21 01:05:46 UTC) #57
loyso (OOO)
A revert of this CL (patchset #9 id:180001) has been created in https://codereview.chromium.org/2353783004/ by loyso@chromium.org. ...
1 year, 2 months ago (2016-09-21 01:06:45 UTC) #58
sandum732
2 months, 2 weeks ago (2017-09-28 20:56:10 UTC) #60
On 2016/09/21 01:06:45, loyso (OOO) wrote:
> A revert of this CL (patchset #9 id:180001) has been created in
> https://codereview.chromium.org/2353783004/ by mailto:loyso@chromium.org.
> 
> The reason for reverting is: Causes a timeout on mash_browser_tests..

Ě

Powered by Google App Engine
This is Rietveld 0eb02b776