1403210 - Remove iokit AppleSNBFBUserClient access

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P2)

Description

[Alex Gaynor [:Alex_Gaynor]]

This was originally added to ensure we had hardware OpenGL support, but I'm unable to trigger on any hardware accelerated workloads (WebGL, streaming video). I also confirmed that WebKit _used_ to have it, but removed it at some point.

I'll do a full try run to confirm.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=92547275d396bcdfcf3a41931274cf3e06153c22

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Attachment: Bug 1403210 - Remove unused access to AppleSNBFBUserClient iokit from content process;

Review commit: https://reviewboard.mozilla.org/r/183658/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/183658/

Comment 3

[Haik Aftandilian [:haik]]

Comment on attachment 8912327 [details]
Bug 1403210 - Remove unused access to AppleSNBFBUserClient iokit from content process;

https://reviewboard.mozilla.org/r/183658/#review188852

r+. Regarding how WebKit no longer uses this, do you know if the latest Safari is supported on 10.9? I need to test bug 1401756 on 10.9 and could test this too (later today or tomorrow.)

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

From researching it, 10.9 hasn't gotten a new Safari in about a year; I'm not sure when Safari removed this permission -- I'll do a full clone of webkit and check.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4a9a6475bf7d
Remove unused access to AppleSNBFBUserClient iokit from content process; r=haik

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4a9a6475bf7d