1354674 - Introduce a (not-yet-enabled) level 3 Mac content sandbox with home directory read access disabled

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Haik Aftandilian [:haik]]

As a precursor to Bug 1332190, the intent with this bug is to add support for setting security.sandbox.content.level=3 on Mac, while leaving the Nightly default level at 2. This will make it a bit easier to start testing read access restrictions before we're ready to enable it.

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1354674 - Introduce, but don't enable, a level 3 Mac content sandbox with home directory read access disabled

Review commit: https://reviewboard.mozilla.org/r/128010/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/128010/

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8856064 [details]
Bug 1354674 - Introduce, but don't enable, a level 3 Mac content sandbox with home directory read access disabled

https://reviewboard.mozilla.org/r/128010/#review130896

::: security/sandbox/test/browser_content_sandbox_utils.js:68
(Diff revision 1)
>  }
>  
> +function GetHomeDir() {
> +  // get home directory
> +  let homeDir = Services.dirsvc.get("Home", Ci.nsILocalFile);
> +  return (homeDir);

Question: are the parens around the return value a local convention I should know about?

Comment 3

[Haik Aftandilian [:haik]]

Comment on attachment 8856064 [details]
Bug 1354674 - Introduce, but don't enable, a level 3 Mac content sandbox with home directory read access disabled

https://reviewboard.mozilla.org/r/128010/#review130922

::: security/sandbox/test/browser_content_sandbox_utils.js:68
(Diff revision 1)
>  }
>  
> +function GetHomeDir() {
> +  // get home directory
> +  let homeDir = Services.dirsvc.get("Home", Ci.nsILocalFile);
> +  return (homeDir);

No, it's just that I used parens when I first wrote this file out of habit from previous years using another convention.

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8856064 [details]
Bug 1354674 - Introduce, but don't enable, a level 3 Mac content sandbox with home directory read access disabled

https://reviewboard.mozilla.org/r/128010/#review130924

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/34006a1fee90
Introduce, but don't enable, a level 3 Mac content sandbox with home directory read access disabled r=Alex_Gaynor

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/34006a1fee90