Bug 1295700 - Don't allow content processes to access the weave director on macOS draft
authorAlex Gaynor <agaynor@mozilla.com>
Thu, 06 Apr 2017 15:20:23 -0400
changeset 557422 44f91c24308c67c69d166bc118be629576ceca50
parent 557282 facaf90aeaaf6d7cf5e2966f9f918319536bddea
child 623051 25164b94d8826fe12eb0b677c7dc886e80671da2
push id52715
push userbmo:agaynor@mozilla.com
push dateThu, 06 Apr 2017 19:40:14 +0000
bugs1295700
milestone55.0a1
Bug 1295700 - Don't allow content processes to access the weave director on macOS These directories contain sensitive content, and access is not necessary now that we have file content processes. r=haik MozReview-Commit-ID: FiRJkMnlYUx
security/sandbox/mac/Sandbox.mm
--- a/security/sandbox/mac/Sandbox.mm
+++ b/security/sandbox/mac/Sandbox.mm
@@ -365,31 +365,30 @@ static const char contentSandboxRules[] 
   "; global file-read* permission should be removed from each level.\n"
   "\n"
   "; level 1: global read access permitted, no global write access\n"
   "  (if (string=? sandbox-level-1 \"TRUE\") (allow file-read*))\n"
   "\n"
   "; level 2: global read access permitted, no global write access,\n"
   ";          no read/write access to ~/Library,\n"
   ";          no read/write access to $PROFILE,\n"
-  ";          read access permitted to $PROFILE/{extensions,weave,chrome}\n"
+  ";          read access permitted to $PROFILE/{extensions,chrome}\n"
   "  (if (string=? sandbox-level-2 \"TRUE\")\n"
   "    (if (string=? hasFilePrivileges \"TRUE\")\n"
   "      ; This process has blanket file read privileges\n"
   "      (allow file-read*)\n"
   "      ; This process does not have blanket file read privileges\n"
   "      (if (string=? hasProfileDir \"TRUE\")\n"
   "        ; we have a profile dir\n"
   "        (begin\n"
   "          (allow file-read* (require-all\n"
   "              (require-not (home-subpath \"/Library\"))\n"
   "              (require-not (subpath profileDir))))\n"
   "          (allow file-read*\n"
   "              (profile-subpath \"/extensions\")\n"
-  "              (profile-subpath \"/weave\")\n"
   "              (profile-subpath \"/chrome\")))\n"
   "        ; we don't have a profile dir\n"
   "        (allow file-read* (require-not (home-subpath \"/Library\"))))))\n"
   "\n"
   "; accelerated graphics\n"
   "  (allow-shared-preferences-read \"com.apple.opengl\")\n"
   "  (allow-shared-preferences-read \"com.nvidia.OpenGL\")\n"
   "  (allow mach-lookup\n"