1386161 - [Mac] Remove IOAudioControl Rules

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Haik Aftandilian [:haik]]

With some minimal testing, sound playing and WebRTC continue to work with these rules removed. These seem to be for interacting directly with audio drivers and may not be needed.

  (allow iokit-set-properties (iokit-property "IOAudioControlValue"))
  (allow iokit-open (iokit-user-client-class "IOAudioControlUserClient"))

Comment 1

[Haik Aftandilian [:haik]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5cdf7d0335642e3e30c2f67da884684e43f73f0f

Comment 2

[Haik Aftandilian [:haik]]

My local testing and try testing hasn't turned up any issues with these changes so I'm going to move forward with the changes. These lines were introduced in bug 1083344 when Steven first landed most of the rules.

Comment 3

[Haik Aftandilian [:haik]]

Attachment: Bug 1386161 - [Mac] Remove IOAudioControl Rules.

Review commit: https://reviewboard.mozilla.org/r/164664/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/164664/

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8893589 [details]
Bug 1386161 - [Mac] Remove IOAudioControl Rules.

https://reviewboard.mozilla.org/r/164664/#review170286

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/989cea1f3820
[Mac] Remove IOAudioControl Rules. r=Alex_Gaynor

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/989cea1f3820

Comment 7

[Haik Aftandilian [:haik]]

Attachment: IOAudioControlUserClient.log.txt

With the fix for this, when sandbox logging is enabled[1], we log a sandbox violation: "plugin-container(1666) deny iokit-open IOAudioControlUserClient" when watching a video on YouTube (and probably in other cases too). Attachment is the Console report collected on 10.11 and the stack shows cubeb_init() is triggering it. See attachment for the full stack.

1. security.sandbox.logging.enabled=true or env var MOZ_SANDBOX_LOGGING is set

Comment 8

[Haik Aftandilian [:haik]]

(In reply to Haik Aftandilian [:haik] from comment #7)
> ...
> Attachment is the Console report collected on 10.11 and the stack shows
> cubeb_init() is triggering it. See attachment for the full stack.
> ...

We have bug 1362220 to move audio out of the content process.