1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Haik Aftandilian [:haik]]

Testing with the removal of com.apple.coreservices.appleevents from the Mac content sandbox is clean on try and doesn't cause any problems I've noticed in browsing. I'd like to investigate the impacts of removing this from content a bit more and land this after the 56 merge to Beta.

As a side effect, this prevents the browser from triggering appleeventsd sandbox violations on startup when run from the home directory. For example,

  sandboxd - SandboxViolation: appleeventsd(64) deny file-read-data /Users/me/r/mozilla-central/obj-opt.noindex/dist/Nightly.app/Contents/MacOS/plugin-container.app

The daemon, documented as "appleeventsd(8) -- System-wide daemon which coordinates AppleEvents activity on the system", tries to read files from the .app bundle which results in sandbox violations because the daemon runs under a sandbox profile that does not allow access to the home directory. See /System/Library/Sandbox/Profiles/com.apple.coreservices.appleevents.appleeventsd.sb.

Removing access to the service generates a Console.app log entry that is visible if logging is enabled with security.sandbox.logging.enabled=true or env variable MOZ_SANDBOX_LOGGING:

  SandboxViolation: plugin-container(75246) deny(1) mach-lookup com.apple.coreservices.appleevents

Try run:

  https://treeherder.mozilla.org/#/jobs?repo=try&revision=091cc5a7a99027a6de6d2627a2784a3416eefec8

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox.

Review commit: https://reviewboard.mozilla.org/r/161026/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/161026/

Comment 2

[Haik Aftandilian [:haik]]

AppleEvents are for scripting applications with AppleScript. We shouldn't need to (and wouldn't want to) let AppleScript apply to content processes.

Comment 3

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8889977 [details]
Bug 1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox.

https://reviewboard.mozilla.org/r/161026/#review169338

::: security/sandbox/mac/SandboxPolicies.h:190
(Diff revision 1)
>    (allow job-creation (literal "/Library/CoreMediaIO/Plug-Ins/DAL"))
>    (allow iokit-set-properties (iokit-property "IOAudioControlValue"))
>  
>    (allow mach-lookup
>        (global-name "com.apple.coreservices.launchservicesd")
> -      (global-name "com.apple.coreservices.appleevents")
> +;     (global-name "com.apple.coreservices.appleevents")

Please delete the line, rather than just commenting it out.

Comment 4

[Haik Aftandilian [:haik]]

Comment on attachment 8889977 [details]
Bug 1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/161026/diff/1-2/

Comment 5

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8889977 [details]
Bug 1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox.

https://reviewboard.mozilla.org/r/161026/#review169340

Comment 6

[Haik Aftandilian [:haik]]

Comment on attachment 8889977 [details]
Bug 1384209 - [Mac] Remove com.apple.coreservices.appleevents from the content process sandbox.

https://reviewboard.mozilla.org/r/161026/#review169338

> Please delete the line, rather than just commenting it out.

Fixed!

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1d77aa067204
[Mac] Remove com.apple.coreservices.appleevents from the content process sandbox. r=Alex_Gaynor

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1d77aa067204