1483058 - [Mac] Camera not accessible by Adobe Flash applets

Status: VERIFIED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Haik Aftandilian [:haik]]

A contact at Adobe testing the Flash sandbox on Mac has reported that the Mac Flash sandbox (currently enabled in Nightly and Beta planning to ship in 62) is preventing Flash applets and the Flash settings pane from detecting the camera.

As a workaround, set dom.ipc.plugins.sandbox-level.flash=0 in about:config and restart the browser.

Comment 1

[Haik Aftandilian [:haik]]

[Tracking Requested - why for this release]:
We will want this fix in 62 for the Mac Flash sandbox.

Comment 2

[Haik Aftandilian [:haik]]

We include the camera rule in our Flash sandbox to allow access to the camera from the Flash plugin process, but access to some additional services appears to be needed for the Flash plugin. I'm testing a fix with some additional services added. Those were found by debugging with Console.app (with environment variable MOZ_SANDBOX_MAC_FLASH_LOGGING=1) and looking for services in the macOS included profiles that might be camera related.

Comment 3

[Haik Aftandilian [:haik]]

Attachment: Bug 1483058 - [Mac] Camera not accessible by Adobe Flash applets r?Alex_Gaynor

Allow access to services needed for the Flash plugin to access cameras.

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 9000028 [details]
Bug 1483058 - [Mac] Camera not accessible by Adobe Flash applets r?Alex_Gaynor

Alex Gaynor [:Alex_Gaynor] has approved the revision.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7395257233f2
[Mac] Camera not accessible by Adobe Flash applets r=Alex_Gaynor

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/7395257233f2

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Seems like something we'd want QA to verify before we consider uplifting.

Comment 8

[Haik Aftandilian [:haik]]

Comment on attachment 9000028 [details]
Bug 1483058 - [Mac] Camera not accessible by Adobe Flash applets r?Alex_Gaynor

Approval Request Comment
[Feature/Bug causing the regression]:
The Mac Flash sandbox, enabled in Beta/62 and planned to ship in 62.

[User impact if declined]:
For sites with Flash applets that use the camera from within Flash, the camera will not be detected by Flash and will not be usable.

[Is this code covered by automated tests?]:
No

[Has the fix been verified in Nightly?]:
I manually verified the fix on the following Mac OS versions
10.14 Beta and 10.11 on a MacBook Air (11-inch Early 2015)
10.13 on a MacBook Pro (Retina, 15-inch, Mid 2015)
10.10 and 10.9 on a MacBOok (Aluminum, 13-inch, Late 2008)
Covering all supported versions except 10.12.
Also tested an attached USB camera on 10.13.

[Needs manual test from QE? If yes, steps to reproduce]:
Yes, per RyanVM's recommendation.
 
[List of other uplifts needed for the feature/fix]:
None

[Is the change risky?]:
No

[Why is the change risky/not risky?]:
The fix only touches Mac sandbox rules and only for the Flash plugin process.
Unlikely to cause regressions because the changes make the Flash sandbox more permissive, not less.

[String changes made/needed]:
None

Comment 9

[Haik Aftandilian [:haik]]

(In reply to Haik Aftandilian [:haik] from comment #8)
> [Needs manual test from QE? If yes, steps to reproduce]:
> Yes, per RyanVM's recommendation.

Means to reproduce and verify the fix:

A. Confirm that the camera is detected within the Flash settings dialog. See attached screenshots provided by out Adobe contact for reference.

   1. Visit a Flash site where the Flash applet is large enough to display the Flash settings, accessible by right-clicking in the Flash applet and selecting "Settings...".
   2. Choose the camera settings tab.
   3. Confirm that with the fix, the camera is detected and a preview image is displayed.
      Without the fix, a message such as "Cannot find camera" will be displayed.

B. Visit a site that uses the camera from within Flash such as https://www.puffinbrowser.com/whats-new/demo/flash-camera-test/ (found via internet search) and verify the camera appears to be working.

Comment 10

[Haik Aftandilian [:haik]]

Attachment: Flash settings pane showing camera detected/not detected

To help with verifying the fix, these screenshots show what the Flash settings camera tab looks like when the camera is not detected and when it is properly detected.

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Andrei, sounds like haik has done some pretty thorough verification already but can your team take a look on Monday? We could still potentially get this patch into Monday's beta 19 build.

Comment 12

[Abe - QA (:Abe_LV)]

I tested this on OSX 10.13 with Firefox Nightly. In nightly build without the fix, the message "Cannot find camera" is displayed. 
But with this fix, the camera is detected and when access is allowed, it shows image preview. 

So this verified as fixed.

Test environment:
Version 	63.0a1
Build ID 	20180817100105
Update Channel 	nightly
User Agent 	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:63.0) Gecko/20100101 Firefox/63.0

Comment 13

[Andrei Vaida [:avaida]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #11)
> Andrei, sounds like haik has done some pretty thorough verification already
> but can your team take a look on Monday? We could still potentially get this
> patch into Monday's beta 19 build.

Looks like Abe has already taken care of the verification for this, thanks! Clearing ni?.

Comment 14

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9000028 [details]
Bug 1483058 - [Mac] Camera not accessible by Adobe Flash applets r?Alex_Gaynor

Fix verified in nightly, let's take this patch for beta 19.

Comment 15

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/b0d9337da7cf

Comment 16

[Abe - QA (:Abe_LV)]

It is tested on beta 62.0b20 and the camera is detected and image preview is displayed.
With older beta (e.g. 62.0b8) camera is not detected. 
So this is verified as fixed on latest beta.

Test environment:
Version 	62.0b20
Build ID 	20180823143155
Update Channel 	beta
User Agent 	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0