1363179 - [mac] blacklist read access to /Volumes at level 3

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Alex Gaynor [:Alex_Gaynor]]

I don't think this can be used to access `/Users` or anything, since `/Volumes/Macintosh HD` is a symlink to `/`, but it could be used to access anything on an external HDD or USB drive.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1363179 - do not allow content processes to read from /Volumes on macOS

Review commit: https://reviewboard.mozilla.org/r/138860/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/138860/

Comment 2

[Haik Aftandilian [:haik]]

Comment on attachment 8867339 [details]
Bug 1363179 - do not allow content processes to read from /Volumes on macOS

https://reviewboard.mozilla.org/r/138860/#review142206

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/02f1025c91f8
do not allow content processes to read from /Volumes on macOS r=haik

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/02f1025c91f8