1383818 - [mac] remove mach-lookup permissions for com.apple.ocspd

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement)

Description

[Alex Gaynor [:Alex_Gaynor]]

We don't use the system trust APIs for anything, so this is purely extra attack surface.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1383818 - Disallow content processes for using the com.apple.ocspd mach service;

It is not used, so this is an attack surface reduction.

Review commit: https://reviewboard.mozilla.org/r/160544/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/160544/

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=216d5f92b426c695bde2aced41d26d740400d99e&group_state=expanded

Comment 3

[Haik Aftandilian [:haik]]

Comment on attachment 8889519 [details]
Bug 1383818 - Disallow content processes for using the com.apple.ocspd mach service;

https://reviewboard.mozilla.org/r/160544/#review165822

r+ Does this generate any sandbox violations logged to Console.app? If so, could you document that on the bug?

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Nope, no logging -- genuinely unused across the board :-)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6fc6a92ad62e
Disallow content processes for using the com.apple.ocspd mach service; r=haik

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6fc6a92ad62e