1772952 - Port bug 1562756: Drop the com.apple.security.cs.allow-dyld-environment-variables

Status: RESOLVED FIXED

(Thunderbird :: Upstream Synchronization, task)

Comment 1

[Rob Lemley [:rjl]]

Attachment: Bug 1772952 - Port bug 1562756: [macOS] Disable allow-dyld-environment-variables entitlement. r=#thunderbird-reviewers

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/e86e4b46473a
Port bug 1562756: [macOS] Disable allow-dyld-environment-variables entitlement. r=#thunderbird-reviewers,mkmelin

Comment 3

[Rob Lemley [:rjl]]

Comment on attachment 9279960 [details]
Bug 1772952 - Port bug 1562756: [macOS] Disable allow-dyld-environment-variables entitlement. r=#thunderbird-reviewers

[Approval Request Comment]
The fix provides a security improvement preventing Thunderbird from loading third-party and possibly malicious dylibs via DYLD environment variables.
Firefox is uplifting bug 1562756 to FF 102.1esr, Thunderbird should do so as well.

Regression caused by (bug #): N/A
User impact if declined: No user-visible impact. Thunderbird will continue to allow loading of third-party and possibly malicious dylibs.
Testing completed (on c-c, etc.): Landed in milestone 103, so has gone through most of a beta cycle
Risk to taking this patch (and alternatives if risky): The change is only to Thunderbird entitlement files and blocks use of DYLD environment variables which we don't use on production builds.

Comment 4

[Wayne Mery (:wsmwk)]

Comment on attachment 9279960 [details]
Bug 1772952 - Port bug 1562756: [macOS] Disable allow-dyld-environment-variables entitlement. r=#thunderbird-reviewers

[Triage Comment]
Approved for esr102

Comment 5

[Rob Lemley [:rjl]]

Thunderbird 102.1.0:
https://hg.mozilla.org/releases/comm-esr102/rev/0c253000133a