Necko: Sandboxing TCP/UDP socket in a separate process

Objectives

Move all the network and socket operations to an isolated process.

Goals

• For security
  • Sandboxing network access into a separate process, preventing chrome process from opening socket
  • Preventing protocol security hole to be used to control the entire browser
• For stability
  • Allow recovering network layer without rebooting firefox, if crash/assertion is detected in the socket process
• For performance
  • No major regression found for start-up performance and network throughput

Requirements

Sandboxing

• Chrome process is still the only secure zone. Every IPC interface received at Chrome process should be audited
• IPC to content process or socket process should at least do sanity check in the receiver side
• Better not providing interface to create arbitrary TCP/UDP connection

TODOs

• hook ProcessHangMonitor
• hook CrashReporter
• hook MemoryPresure
• hook MemoryReporter
• ensure Telemetry works
• ensure MOZ_LOG works
• remove XPCOM and support only C++ implementation