1484380 - [Mac] Default the Mac Flash sandbox to level 1

Status: VERIFIED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Haik Aftandilian [:haik]]

Level 2 of the Mac Flash sandbox only allows file-read access after file dialog activity is triggered. However, this doesn't work reliably on older macOS versions (10.12 and earlier) and may turn out to be brittle on the OS versions it works on. This bug is to change the default to level 1.

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1484380 - [Mac] Default the Mac Flash sandbox to level 1 r?Alex_Gaynor

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

Comment on attachment 9002147 [details]
Bug 1484380 - [Mac] Default the Mac Flash sandbox to level 1 r?Alex_Gaynor

Alex Gaynor [:Alex_Gaynor] has approved the revision.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9c1fc2ff3a2f
[Mac] Default the Mac Flash sandbox to level 1 r=Alex_Gaynor

Comment 4

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/9c1fc2ff3a2f

Comment 5

[Haik Aftandilian [:haik]]

Comment on attachment 9002147 [details]
Bug 1484380 - [Mac] Default the Mac Flash sandbox to level 1 r?Alex_Gaynor

Approval Request Comment
[Feature/Bug causing the regression]:
Bug 1474375 "[Mac] Let Sandboxing for the Flash NPAPI plugin process ride the trains"

[User impact if declined]:
With the fix for bug 1484051, Mac Flash applet file dialogs appear buggy and users won't be able to select some files.

[Is this code covered by automated tests?]:
No

[Has the fix been verified in Nightly?]:
Yes

[Needs manual test from QE? If yes, steps to reproduce]: 
No (covered by bug 1484051)

[List of other uplifts needed for the feature/fix]:
None, but this is needed by bug 1484051.

[Is the change risky?]:
No

[Why is the change risky/not risky?]:
It makes the Mac Flash sandbox less restrictive so it is unlikely to cause problems.

[String changes made/needed]:
None

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9002147 [details]
Bug 1484380 - [Mac] Default the Mac Flash sandbox to level 1 r?Alex_Gaynor

Needed for the Mac Flash sandbox shipping in 62. Approved for 62.0b20.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/ba304f0a35dc

Comment 8

[Bogdan Maris, Desktop Test Engineering]

Verified that Firefox 62.0b20 and latest Nightly 63.0a1 come with both 'dom.ipc.plugins.sandbox-level.flash' and 'dom.ipc.plugins.sandbox-level.default' set to value 1 after manually downloading it and after updating across various mac versions (10.12, 10.11, 10.10, also verified 10.13 and 10.14 18A371a).