1379182 - restrict file-write* sandbox rules to more specific permissions

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Alex Gaynor [:Alex_Gaynor]]

We currently use |file-write*| rules in two places in our sandbox policies. |file-write*| encompasses more permissions than we really need. Specifically, based on |strings /usr/lib/libsandbox.dylib | grep file-write| it appears to contain the following:


file-write-acl
file-write-create
file-write-data
file-write-flags
file-write-mode
file-write-owner
file-write-setugid
file-write-times
file-write-unlink
file-write-xattr
(define file-unlink file-write-unlink)
(define file-write-mount file-mount)
(define file-write-unmount file-unmount)
(define file-write-umount file-unmount)


I'm pretty sure that for both of these callsites we only actually need |file-write-create| and |file-write-data|. I don't think there's any particular security concern with these extra rules (and indeed some of these are probably useless without root), so the narrower rule is primarily about reducing the kernel surface exposed.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=bb68a37950baa5cf250fddf2c82cd27ebd46f375&selectedJob=112577127

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1379182 - Remove some unnecessary file-write permissions types from the content process on macOS;

On macOS, the file-write* permission type contains numerous sub-permissions (see
bug for full listing). Restrict the ones we allow to only the two we need:
file-write-create and file-write-data. This primarily reduces kernel attack
surface, I'm not aware of any bad things that could be done directly with the
removed permissions.

Review commit: https://reviewboard.mozilla.org/r/155720/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/155720/

Comment 3

[Haik Aftandilian [:haik]]

Comment on attachment 8884829 [details]
Bug 1379182 - Remove some unnecessary file-write permissions types from the content process on macOS;

https://reviewboard.mozilla.org/r/155720/#review160782

Looks good. Please sanity check printing and print-to-file for this one too.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1ba3f4c9ef45
Remove some unnecessary file-write permissions types from the content process on macOS; r=haik

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1ba3f4c9ef45