1638387 - nsOSXSystemProxySettings::Init() is failed in socket process when sandbox is enabled

Status: RESOLVED WONTFIX

(Core :: Security: Process Sandboxing, task, P1)

Description

[Kershaw Chang [:kershaw]]

STR:

1. Manually add some code to use nsOSXSystemProxySettings in socket process.
2. SCDynamicStoreCreate returns NULL.
3. Turning off sandbox is able to fix this.

Comment 1

[Kershaw Chang [:kershaw]]

Not sure if it's possible to fix this by adjusting sandbox settings.
Haik, what do you think?

Comment 2

[Haik Aftandilian [:haik]]

(In reply to Kershaw Chang [:kershaw] from comment #1)

Not sure if it's possible to fix this by adjusting sandbox settings.
Haik, what do you think?

I'll take a look. Could you post the sample code you're using? Or send it via chat.

Comment 3

[Kershaw Chang [:kershaw]]

Attachment: Invoke system proxy settings

This is just a test code that tries to use nsISystemProxySettings in socket process.
To execute this code path, please go to about:memory and than click measure button.

Comment 4

[Haik Aftandilian [:haik]]

Attachment: Test patch to allow access to com.apple.SystemConfiguration.configd from the socket process

This patch allows the test code to work, but we need to spend some time to understand the security impact of allowing the new service com.apple.SystemConfiguration.configd. It is allowed in the profile used for most Mac applications and several other Mac services so I suspect it is low risk. I'll look into this more.

Comment 5

[Kershaw Chang [:kershaw]]

(In reply to Haik Aftandilian [:haik] from comment #4)

Created attachment 9149518 [details] [diff] [review]
Test patch to allow access to com.apple.SystemConfiguration.configd from the socket process

This patch allows the test code to work, but we need to spend some time to understand the security impact of allowing the new service com.apple.SystemConfiguration.configd. It is allowed in the profile used for most Mac applications and several other Mac services so I suspect it is low risk. I'll look into this more.

Thanks for the patch! The socket process is able to read the system configuration now.
However, I also found the callback registered for monitoring proxy changes is not invoked in socket process at all. I am not sure if this is also related to sandboxing. I'll also try to figure this out.

Comment 6

[Haik Aftandilian [:haik]]

Kershaw, it would be better if we did not allow access to the configuration service and instead had the parent process read the configuration and pass it down to the socket process. Do we just need to read a few configuration properties?

After looking into this some more, allowing access to the service would also allow a compromised socket process to modify system configuration. Additionally, the macOS process that implements com.apple.SystemConfiguration.configd is provided by the /usr/libexec/configd daemon which runs unsandboxed as root.

Comment 7

[Kershaw Chang [:kershaw]]

(In reply to Haik Aftandilian [:haik] from comment #6)

Kershaw, it would be better if we did not allow access to the configuration service and instead had the parent process read the configuration and pass it down to the socket process. Do we just need to read a few configuration properties?

After looking into this some more, allowing access to the service would also allow a compromised socket process to modify system configuration. Additionally, the macOS process that implements com.apple.SystemConfiguration.configd is provided by the /usr/libexec/configd daemon which runs unsandboxed as root.

Thanks for looking into this.
I'll discuss this with our team members and then decide the next step.

Comment 8

[Kershaw Chang [:kershaw]]

We'll keep proxy resolution in parent process, so this bug is WONTFIX.