1357758 - [mac] remove the blacklisting from the content sandbox policy and use whitelisting exclusively

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Alex Gaynor [:Alex_Gaynor]]

Right now we have a teeny tiny bit of blacklisting in our content sandbox policy: https://dxr.mozilla.org/mozilla-central/source/security/sandbox/mac/SandboxPolicies.h#289-297

We should move away from "blacklist the home directory" to whitelisting whatever is needed. This reduces the possibility for regressions, and makes it easier to audit what we allow and prune the list.

This will require figuring out what reads are implicitly allowed by the blacklist that we use and adding those to the whitelist.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1357758 - Replace the file-read blacklist in the macOS sandbox policy with a whitelist of the allowed paths;

This makes the policy easier to audit, harder to regress, and easier to further prune the content processes's permissions.

Review commit: https://reviewboard.mozilla.org/r/132506/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/132506/

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Not worth reviewing yet, as there's still some breakages to work through, but figured I'd attach the patch for visibility.

Comment 3

[Alex Gaynor [:Alex_Gaynor]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9b63488894624e29aabc051de3615f9291e316f0&group_state=expanded example try run from a few days ago

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8860502 [details]
Bug 1357758 - Replace the file-read blacklist in the macOS sandbox policy with a whitelist of the allowed paths;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/132506/diff/1-2/

Comment 5

[Alex Gaynor [:Alex_Gaynor]]

All green! https://treeherder.mozilla.org/#/jobs?repo=try&revision=ed0a090e297125887c8bbe7cbdcc9657a3f955ed&group_state=expanded

Comment 6

[Haik Aftandilian [:haik]]

Comment on attachment 8860502 [details]
Bug 1357758 - Replace the file-read blacklist in the macOS sandbox policy with a whitelist of the allowed paths;

https://reviewboard.mozilla.org/r/132506/#review159136

Just plain awesome! Please manually test printing and print-to-file with level 3 set.

Comment 7

[Alex Gaynor [:Alex_Gaynor]]

Printing looks good! (+/- all the unrelated bugs I hit while testing it :-/)

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59555f5a60be
Replace the file-read blacklist in the macOS sandbox policy with a whitelist of the allowed paths; r=haik

Comment 9

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/59555f5a60be