1401756 - [Mac] Remove unneeded mach-lookups from plugin sandbox rules

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Haik Aftandilian [:haik]]

The Mac plugin sandbox allows access to some services that are probably no longer needed given that content processes work without them.

  (allow mach-lookup
      (global-name "com.apple.cfprefsd.agent")
      (global-name "com.apple.cfprefsd.daemon")
      (global-name "com.apple.system.opendirectoryd.libinfo")
      (global-name "com.apple.system.logger")
      (global-name "com.apple.ls.boxd"))

Local browsing tests on macOS 10.12 without these allowances, testing Netflix, YouTube, Amazon, and other streaming video sites, appeared to work as normal.

Comment 1

[Haik Aftandilian [:haik]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ae6a8083d96da8bae157359f5101078f3072dc77

Comment 2

[Haik Aftandilian [:haik]]

On 10.12, I haven't found any references to opendirectoryd.libinfo, ls.boxd, or the cfprefsd.{agent,daemon}. com.apple.system.logger appears to be a mach interface to syslogd:

  $ plutil -p /System/Library/LaunchDaemons/com.apple.syslogd.plist
  {
  ...
    "MachServices" => {
      "com.apple.system.logger" => {
        "ResetAtClose" => 1
      }
    }
  ...
  }

Needs testing on earlier OS X versions.

Comment 3

[Haik Aftandilian [:haik]]

Attachment: Bug 1401756 - [Mac] Remove unneeded mach-lookups from plugin sandbox rules.

Review commit: https://reviewboard.mozilla.org/r/183662/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/183662/

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 8912335 [details]
Bug 1401756 - [Mac] Remove unneeded mach-lookups from plugin sandbox rules.

https://reviewboard.mozilla.org/r/183662/#review188892

Comment 5

[Haik Aftandilian [:haik]]

I did some manual tests on 10.9 and didn't encounter any problems.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a327ade4032c
[Mac] Remove unneeded mach-lookups from plugin sandbox rules. r=Alex_Gaynor

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a327ade4032c