Chromium enable seccomp by default

[admin-assword]

Please enable the seccomp-bpf flag by default on the pre-built images. As of right now, chromium is just utilizing the uid sandboxing, and not using seccomp (AFAIK/understand). It appears as though the kernel supports this feature, but it isn't used with chromium.

When this is enabled though, I'm not sure if it will help or hinder security (will this create an environment that will act as a sandbox inside of a sandbox - helping malicious content to break out of the sandbox? See https://en.m.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Deny_double-chroots)

One can enable this feature via
chrome://flags/#enable-seccomp-sandbox-android

Here is Chromium's bug info that this pertains to
https://bugs.chromium.org/p/chromium/issues/detail?id=166704#c33

[thestinger]

I can't enable an experimental feature like this without knowing that they're testing it upstream. We don't have the time to debug and develop this for them until it's ready. The only way this would be enabled early here is if the reason for it not being enabled upstream is related to Android fragmentation and it works fine on Nexus devices. Those issues aren't active enough to know why they haven't enabled it yet.

[thestinger]

I can't enable an experimental feature like this without knowing that they're testing it upstream. We don't have the time to debug and develop this for them until it's ready. The only way this would be enabled early here is if the reason for it not being enabled upstream is related to Android fragmentation and it works fine on Nexus devices. Those issues aren't active enough to know why they haven't enabled it yet.

[thestinger]

Chromium on Android also doesn't use the namespace-based sandbox, it uses isolatedProcess which is an OS feature primarily based on SELinux. It's a stronger sandbox than namespaces provide and it already reduces kernel attack surface to a large extent, just not to the same level that their seccomp-bpf filter does.

[thestinger]

Chromium on Android also doesn't use the namespace-based sandbox, it uses isolatedProcess which is an OS feature primarily based on SELinux. It's a stronger sandbox than namespaces provide and it already reduces kernel attack surface to a large extent, just not to the same level that their seccomp-bpf filter does.

[admin-assword]

OK thank you, that makes sense. I'll close this bug.

[admin-assword]

OK thank you, that makes sense. I'll close this bug.