1611288 - Add macOS sandboxing to socket process

Status: RESOLVED FIXED

(Core :: Networking, enhancement, P2)

Description

[Michael Froman [:mjf]]

The socket process needs macOS sandboxing.

Comment 1

[Michael Froman [:mjf]]

Attachment: Bug 1611288 - add macOS sandboxing to socket process. r?haik!

Comment 2

[Michael Froman [:mjf]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=78d80461ba0bba295cbdb2203dcf718cb48be25a&selectedJob=286385008

Comment 3

[Michael Froman [:mjf]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=389318e4f4884b7dadd90bbcb4219454a0ef599f

Comment 4

[Michael Froman [:mjf]]

Haik, the macOS sandbox for the socket process is causing calls to PR_Bind to fail here[1]. Do you know what I should change to allow that call or will this require a different sandbox than MacSandboxType_Utility?

[1] https://searchfox.org/mozilla-central/source/media/mtransport/nr_socket_prsock.cpp#679

Comment 5

[Michael Froman [:mjf]]

An example test that fails:
./mach mochitest --keep-open=false dom/media/tests/mochitest/identity/test_peerConnection_asymmetricIsolation.html

It passes with:
MOZ_DISABLE_SOCKET_PROCESS_SANDBOX=1 ./mach mochitest --keep-open=false dom/media/tests/mochitest/identity/test_peerConnection_asymmetricIsolation.html

Comment 6

[Haik Aftandilian [:haik]]

(In reply to Michael Froman [:mjf] from comment #4)

Haik, the macOS sandbox for the socket process is causing calls to PR_Bind to fail here[1]. Do you know what I should change to allow that call or will this require a different sandbox than MacSandboxType_Utility?

[1] https://searchfox.org/mozilla-central/source/media/mtransport/nr_socket_prsock.cpp#679

We don't want to add any networking allowances to the utility sandbox, so I suspect we would want to create a new sandbox type. We need to learn more about the requirements for the socket process first. Either way, I can help with that. I'll start look into the requirements.

Comment 7

[Haik Aftandilian [:haik]]

To clarify the status of this bug: since the initial r+ code review, it was determined that we need a new sandbox profile that allows networking access as well as additional file system access for any files needed for DNS resolution and certificates. I'll be working on a new Mac sandbox profile for the socket process and then :mjf's changes should only need small changes to use the new networking sandbox profile.

Comment 8

[Michael Froman [:mjf]]

Haik, do you have a bug number for the new profile work?

Comment 9

[Haik Aftandilian [:haik]]

(In reply to Michael Froman [:mjf] from comment #8)

Haik, do you have a bug number for the new profile work?

Bug 1614983. I should have something to test with by next week.

Comment 10

[Michael Froman [:mjf]]

(In reply to Haik Aftandilian [:haik] from comment #9)

(In reply to Michael Froman [:mjf] from comment #8)

Haik, do you have a bug number for the new profile work?

Bug 1614983. I should have something to test with by next week.

Thank you!

Comment 11

[Michael Froman [:mjf]]

Here is my final try run that looks good:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=503fa4cb3597267017a1f1191e2d96507f0d67b4&selectedJob=292966460

The sy-d test is failing on the parent push:
https://treeherder.mozilla.org/#/jobs?repo=mozilla-central&revision=ffd615bf92ddb28a01b881d14126fc139ebf7880&selectedJob=293051883

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c1ca51edaa44
add macOS sandboxing to socket process. r=haik

Comment 13

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/c1ca51edaa44