1314056 - Enable Mac content sandbox level 1 in 52

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Haik Aftandilian [:haik]]

This bug covers enabling the Mac content sandbox with level 1 (security.sandbox.content.level=1) in 52. Level 1 removes filesystem write access permission to the majority of the filesystem including the user's home directory. At present, Nightly uses the Mac level 2 sandbox which includes these write access limits.

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1314056 - Enable Mac content sandbox level 1 in 52;

Review commit: https://reviewboard.mozilla.org/r/93610/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/93610/

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8811532 [details]
Bug 1314056 - Enable Mac content sandbox level 1 in 52;

https://reviewboard.mozilla.org/r/93610/#review93876

Comment 3

[Haik Aftandilian [:haik]]

Adding needinfo? to glandium for the old-configure.in change.

Comment 4

[Mike Hommey [:glandium]]

Comment on attachment 8811532 [details]
Bug 1314056 - Enable Mac content sandbox level 1 in 52;

https://reviewboard.mozilla.org/r/93610/#review94144

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bce473db20d7
Enable Mac content sandbox level 1 in 52; r=gcp,glandium

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/bce473db20d7

Comment 7

[Haik Aftandilian [:haik]]

Comment on attachment 8811532 [details]
Bug 1314056 - Enable Mac content sandbox level 1 in 52;

Approval Request Comment
[Feature/regressing bug #]: Mac content sandbox level 1 (improved security)

[User impact if declined]: Users won't have a content sandbox on Mac in build 52. This first iteration of the Mac sandbox blocks web content processes from writing to most filesystem locations.

[Describe test coverage new/current, TreeHerder]: Enabled on central since early October via bug 1306508.

[Risks and why]: Regresses printing or some unforeseen reason the content process is dependent on writing to filesystem locations that are blocked.

[String/UUID change made/needed]: None

Comment 8

[Julien Cristau [:jcristau]]

Comment on attachment 8811532 [details]
Bug 1314056 - Enable Mac content sandbox level 1 in 52;

mac content sandbox, take in aurora52 (together with bug 1317801)

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/97862b6aff39