Commit a8224879 authored by Yannis Juglaret's avatar Yannis Juglaret
Browse files

Bug 1936749 - Disable ACG if we detect MpDetours.dll injection. a=dmeehan 

Original Revision: https://phabricator.services.mozilla.com/D236890

Differential Revision: https://phabricator.services.mozilla.com/D238183
parent 29dc8d27

security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp

+13 −0
Changes for security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp: 13 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -299,6 +299,19 @@ Result<Ok, mozilla::ipc::LaunchError> SandboxBroker::LaunchApp( 
        "Setting the reduced set of flags should always succeed");

  }



  // Bug 1936749: MpDetours.dll injection is incompatible with ACG.

  constexpr sandbox::MitigationFlags kDynamicCodeFlags =

      sandbox::MITIGATION_DYNAMIC_CODE_DISABLE |

      sandbox::MITIGATION_DYNAMIC_CODE_DISABLE_WITH_OPT_OUT;

  sandbox::MitigationFlags delayedMitigations =

      mPolicy->GetDelayedProcessMitigations();

  if ((delayedMitigations & kDynamicCodeFlags) &&

      ::GetModuleHandleW(L"MpDetours.dll")) {

    delayedMitigations &= ~kDynamicCodeFlags;

    SANDBOX_SUCCEED_OR_CRASH(

        mPolicy->SetDelayedProcessMitigations(delayedMitigations));

  }



  // If logging enabled, set up the policy.

  if (aEnableLogging) {

    ApplyLoggingPolicy();