1779816 - Entitlement file cleanup - remove defaults

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P1)

Description

[Haik Aftandilian [:haik]]

Cleanup entitlement files by removing entitlements that use the default setting of false.

From Apple's online docs, "the default value of these Boolean entitlements is false. When Xcode signs your code, it includes an entitlement only if the value is true. If you’re manually signing code, follow this convention to ensure maximum compatibility. Don’t include an entitlement if the value is false."

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1779816 - Don't specify entitlements that use the default setting of false r?#mac-reviewers

Cleanup our entitlement files by removing entitlements that use the default setting of false.

production.entitlements.xml and developer.entitlements.xml are used today.

The browser and plugin-container entitlement lists will be used when we enable using different entitlements for parent and child processes.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6052317fac9c
Don't specify entitlements that use the default setting of false r=mac-reviewers,bradwerth

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/6052317fac9c