git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #163484 from mweinelt/firefox-rlbox

firefox: enable RLBox sandboxing

commit4cb1ebb5a059a6f476d7dff3d6203b91b53c0753 authorJörg Thalheim <Mic92@users.noreply.github.com> dateMon 14 Mar 2022, 06:02 (5 years ago) parentb11029f1530477
3 files changed+43−12
compare with master
unifiedsplit
pkgs/applications/networking/browsers/firefox/common.nix+18−2 pkgs/development/libraries/wasilibc/default.nix+24−9 pkgs/top-level/all-packages.nix+1−1
pkgs/applications/networking/browsers/firefox/common.nix+18−2
@@ -15,7 +15,9 @@
1515, rust-cbindgen, nodejs, nasm, fetchpatch
1616, gnum4
1717, gtk3, wrapGAppsHook
18+, pkgsCross
1819, debugBuild ? false
20+, runCommand
1921
2022### optionals
2123
@@ -121,6 +123,15 @@ let
121123 })
122124 else stdenv;
123125
126+ # Compile the wasm32 sysroot to build the RLBox Sandbox
127+ # https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/
128+ # We only link c++ libs here, our compiler wrapper can find wasi libc and crt itself.
129+ wasiSysRoot = runCommand "wasi-sysroot" {} ''
130+ mkdir -p $out/lib/wasm32-wasi
131+ for lib in ${pkgsCross.wasi32.llvmPackages.libcxx}/lib/* ${pkgsCross.wasi32.llvmPackages.libcxxabi}/lib/*; do
132+ ln -s $lib $out/lib/wasm32-wasi
133+ done
134+ '';
124135in
125136
126137buildStdenv.mkDerivation ({
@@ -213,7 +224,11 @@ buildStdenv.mkDerivation ({
213224 configureScript="$(realpath ./mach) configure"
214225 export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
215226
216− '' + (lib.optionalString googleAPISupport ''
227+ '' + (lib.optionalString (lib.versionAtLeast version "95.0") ''
228+ # RBox WASM Sandboxing
229+ export WASM_CC=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}cc
230+ export WASM_CXX=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}c++
231+ '') + (lib.optionalString googleAPISupport ''
217232 # Google API key used by Chromium and Firefox.
218233 # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
219234 # please get your own set of keys.
@@ -258,6 +273,7 @@ buildStdenv.mkDerivation ({
258273 ++ lib.optional ltoSupport "--enable-lto=cross" # Cross-language LTO.
259274 ++ lib.optional (ltoSupport && (buildStdenv.isAarch32 || buildStdenv.isi686 || buildStdenv.isx86_64)) "--disable-elf-hack"
260275 ++ lib.optional (ltoSupport && !buildStdenv.isDarwin) "--enable-linker=lld"
276+ ++ lib.optional (lib.versionAtLeast version "95") "--with-wasi-sysroot=${wasiSysRoot}"
261277
262278 ++ flag alsaSupport "alsa"
263279 ++ flag pulseaudioSupport "pulseaudio"
@@ -277,7 +293,6 @@ buildStdenv.mkDerivation ({
277293 ++ lib.optionals enableDebugSymbols [ "--disable-strip" "--disable-install-strip" ]
278294
279295 ++ lib.optional enableOfficialBranding "--enable-official-branding"
280− ++ lib.optional (lib.versionAtLeast version "95") "--without-wasm-sandboxed-libraries"
281296 ++ extraConfigureFlags;
282297
283298 postConfigure = ''
@@ -356,6 +371,7 @@ buildStdenv.mkDerivation ({
356371 inherit applicationName;
357372 inherit tests;
358373 inherit gtk3;
374+ inherit wasiSysRoot;
359375 } // extraPassthru;
360376
361377 hardeningDisable = [ "format" ]; # -Werror=format-security
pkgs/development/libraries/wasilibc/default.nix+24−9
@@ -1,14 +1,27 @@
1−{ stdenv, fetchFromGitHub, lib }:
1+{ stdenv, buildPackages, fetchFromGitHub, lib }:
22
33stdenv.mkDerivation {
44 pname = "wasilibc";
5− version = "20190712";
6− src = fetchFromGitHub {
7− owner = "CraneStation";
5+ version = "unstable-2021-09-23";
6+
7+ src = buildPackages.fetchFromGitHub {
8+ owner = "WebAssembly";
89 repo = "wasi-libc";
9− rev = "8df0d4cd6a559b58d4a34b738a5a766b567448cf";
10− sha256 = "1n4gvgzacpagar2mx8g9950q0brnhwz7jg2q44sa5mnjmlnkiqhh";
10+ rev = "ad5133410f66b93a2381db5b542aad5e0964db96";
11+ hash = "sha256-RiIClVXrb18jF9qCt+5iALHPCZKYcnad7JsILHBV0pA=";
12+ fetchSubmodules = true;
1113 };
14+
15+ # clang-13: error: argument unused during compilation: '-rtlib=compiler-rt' [-Werror,-Wunused-command-line-argument]
16+ postPatch = ''
17+ substituteInPlace Makefile \
18+ --replace "-Werror" ""
19+ '';
20+
21+ preBuild = ''
22+ export NIX_CFLAGS_COMPILE="-I$(pwd)/sysroot/include $NIX_CFLAGS_COMPILE"
23+ '';
24+
1225 makeFlags = [
1326 "WASM_CC=${stdenv.cc.targetPrefix}cc"
1427 "WASM_NM=${stdenv.cc.targetPrefix}nm"
@@ -16,6 +29,8 @@ stdenv.mkDerivation {
1629 "INSTALL_DIR=${placeholder "out"}"
1730 ];
1831
32+ enableParallelBuilding = true;
33+
1934 postInstall = ''
2035 mv $out/lib/*/* $out/lib
2136 ln -s $out/share/wasm32-wasi/undefined-symbols.txt $out/lib/wasi.imports
@@ -23,9 +38,9 @@ stdenv.mkDerivation {
2338
2439 meta = with lib; {
2540 description = "WASI libc implementation for WebAssembly";
26− homepage = "https://wasi.dev";
27− platforms = platforms.wasi;
28− maintainers = [ maintainers.matthewbauer ];
41+ homepage = "https://wasi.dev";
42+ platforms = platforms.wasi;
43+ maintainers = with maintainers; [ matthewbauer ];
2944 license = with licenses; [ asl20 mit llvm-exception ];
3045 };
3146}
pkgs/top-level/all-packages.nix+1−1
@@ -12908,7 +12908,7 @@ with pkgs;
1290812908 else if platform.isFreeBSD then 7
1290912909 else if platform.isAndroid then 12
1291012910 else if platform.isLinux then 11
12911− else if platform.isWasm then 8
12911+ else if platform.isWasm then 12
1291212912 else latest_version;
1291312913 # We take the "max of the mins". Why? Since those are lower bounds of the
1291412914 # supported version set, this is like intersecting those sets and then