1307573 - Remove unused system.sb mach-lookups from OS X content sandbox

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Haik Aftandilian [:haik]]

The following rules mach-lookup rules don't appear to be needed. These rules are part of /System/Library/Sandbox/Profiles/system.sb which used to be included in the content sandbox rules via an import. Bug 1272772 moved these rules inline. A try run with the allow's removed from the content sandbox didn't turn up any issues.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=69fc687a610ed43a0361cd1cbfd1a61e3798573b

I'm also testing by browsing with the allow's removed and monitoring the system logs for sandbox rejections this might cause.

  (allow mach-lookup
       (global-name "com.apple.appsleep")
       (global-name "com.apple.bsd.dirhelper")
       (global-name "com.apple.cfprefsd.agent")
       (global-name "com.apple.cfprefsd.daemon")
       (global-name "com.apple.diagnosticd")
       (global-name "com.apple.espd")
       (global-name "com.apple.secinitd")
       (global-name "com.apple.system.DirectoryService.libinfo_v1")
       (global-name "com.apple.system.logger")
       (global-name "com.apple.system.notification_center")
       (global-name "com.apple.system.opendirectoryd.libinfo")
       (global-name "com.apple.system.opendirectoryd.membership")
       (global-name "com.apple.trustd")
       (global-name "com.apple.trustd.agent")
       (global-name "com.apple.xpc.activity.unmanaged")
       (global-name "com.apple.xpcd")
       (local-name "com.apple.cfprefsd.agent"))

com.apple.appsleep may be related to a power saving feature, but so far I'm yet to see the firefox or plugin-containers attempt to perform the mach-lookup.

Comment 1

[Haik Aftandilian [:haik]]

With these removed, I've seen the following log entries show up in the OS X console app running El Capitan (10.11), but not on Sierra (10.12).

  plugin-container(68774) deny mach-lookup com.apple.system.opendirectoryd.membership
  plugin-container(68774) deny mach-lookup com.apple.bsd.dirhelper

I haven't seen new debug messages or errors on the command line.

Comment 2

[Haik Aftandilian [:haik]]

Attachment: Bug 1307573 - Remove unused system.sb mach-lookups from OS X content sandbox;

Review commit: https://reviewboard.mozilla.org/r/84344/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84344/

Comment 3

[Jim Mathies [:jimm]]

Comment on attachment 8799054 [details]
Bug 1307573 - Remove unused system.sb mach-lookups from OS X content sandbox;

https://reviewboard.mozilla.org/r/84344/#review83194

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f6b04b718e50
Remove unused system.sb mach-lookups from OS X content sandbox; r=jimm

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f6b04b718e50