1388360 - Remove access to com.apple.iconservices from content processes

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Alex Gaynor [:Alex_Gaynor]]

This permission gives access to the daemon "responsible for generateing icon images from the resources provided in application bundles and by the system."

I'm almost certain we don't need this, since such tasks should be performed by the parent process. Manual testing and a try run will be done to confirm.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=70aba61b45295e02450e7c047b5deffa243b3b90&group_state=expanded

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1388360 - remove access to the com.apple.iconservices mach service from content processes;

Review commit: https://reviewboard.mozilla.org/r/166182/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/166182/

Comment 3

[Haik Aftandilian [:haik]]

Comment on attachment 8895055 [details]
Bug 1388360 - remove access to the com.apple.iconservices mach service from content processes;

https://reviewboard.mozilla.org/r/166182/#review171464

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8895055 [details]
Bug 1388360 - remove access to the com.apple.iconservices mach service from content processes;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/166182/diff/1-2/

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/adb084e7646d
remove access to the com.apple.iconservices mach service from content processes; r=haik

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/adb084e7646d