1369764 - dom/crypto/test/test_WebCrypto.html fails on macOS with sandbox level 3 and blacklistng removed

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Alex Gaynor [:Alex_Gaynor]]

With my WIP patch for bug 1357758, dom/crypto/test/test_WebCrypto.html fails.

This is because the sandbox currently allows reads to |.app/Content/Resources|, but webcrypto relies on loading |.app/Contents/MacOS/libsoftokn3.dylib|.

While long term, we might want to remove access to the |MacOS/| subdirectory, in the short term allowing it lets us remove access to the rest of the filesystem, so it's a clear win.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1369764 - in the macOS sandbox, allow reads from .app/Contents/;

This permits NSS to load libsoftokn3.dylib, even when the rest of the file
system's access is removed (as is the goal for the content sandbox level 3).
This is needed for WebCrypto.

Review commit: https://reviewboard.mozilla.org/r/145278/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/145278/

Comment 2

[Haik Aftandilian [:haik]]

Comment on attachment 8873880 [details]
Bug 1369764 - in the macOS sandbox, allow reads from .app/Contents/;

https://reviewboard.mozilla.org/r/145278/#review149444

Typo in the bug subject. s/Content/Contents.

Comment 3

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8873880 [details]
Bug 1369764 - in the macOS sandbox, allow reads from .app/Contents/;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/145278/diff/1-2/

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e2114d7578be
in the macOS sandbox, allow reads from .app/Contents/; r=haik

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e2114d7578be