1359566 - [mac] remove device-microphone permissions from content process

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Alex Gaynor [:Alex_Gaynor]]

https://dxr.mozilla.org/mozilla-central/source/security/sandbox/mac/SandboxPolicies.h#234-236

There's a blocker for this issue (removing microphone support) but for life of me I can't find the bug.

Comment 1

[Gian-Carlo Pascutto [:gcp]]

Probably bug 1104619.

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

Review commit: https://reviewboard.mozilla.org/r/209074/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/209074/

Comment 3

[Alex Gaynor [:Alex_Gaynor]]

Simple patch that removes all the relevant-looking permissions. Shouldn't be landed until it's had time to bake and the media team is confident (per https://bugzilla.mozilla.org/show_bug.cgi?id=1425788#c4).

I did some light testing: playing a youtube video, recording audio via WebRTC, and then playing that audio back (as an ogg file I believe). Everything worked ok! There was a sandbox error in the console that |com.apple.audio.SandboxHelper| wasn't allowed, but we've never allowed that, so I'm not sure if that error has always been there (new in 10.13 maybe?) or if it's caused by not being able to access these other services. In any event, I couldn't find anything broken as a result.

Comment 4

[Haik Aftandilian [:haik]]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

https://reviewboard.mozilla.org/r/209074/#review214940

r+ Noting that we'll hold off on landing this for now.

Would be nice to have a test for this, but I know we don't have good infra for that. I hope we can add that in Bug 1330785 "Extend 1309394 content sandbox tests to run native test libraries in content."

Comment 6

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/209074/diff/1-2/

Comment 7

[Alex Gaynor [:Alex_Gaynor]]

Would it make sense for us to dynamically allow/disallow these properties based on whether the audio-remoting pref was set? (With the goal of eventually removing the branching once audio remoting is always on.)

Comment 8

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/209074/diff/2-3/

Comment 9

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

Resetting to r? since the patch changed substantially.

Comment 10

[Haik Aftandilian [:haik]]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

https://reviewboard.mozilla.org/r/209074/#review222786

Looks good. I would let the people working on audio remoting know about how setting media.cubeb.sandbox now also triggers the content sandbox changes on Mac.

Comment 11

[Ralph Giles (:rillian)]

Comment on attachment 8938361 [details]
Bug 1359566 - remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled;

Thanks for the heads up. Tying the mic permission to "media.cubeb.sandbox" means it should be ready to work either way. Is there a test plan for this?

Comment 12

[Alex Gaynor [:Alex_Gaynor]]

I performed local testing in both configurations as described in https://bugzilla.mozilla.org/show_bug.cgi?id=1359566#c3

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/26b03e4d37d3
remove permissions related to audio from the macOS content process sandbox when cubeb remoting is enabled; r=haik

Comment 14

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/26b03e4d37d3