Bug 1295700 - Don't allow content processes to access the weave director on macOS
These directories contain sensitive content, and access is not necessary now that we have file content processes.
r=haik
MozReview-Commit-ID: FiRJkMnlYUx
--- a/security/sandbox/mac/Sandbox.mm
+++ b/security/sandbox/mac/Sandbox.mm
@@ -365,31 +365,30 @@ static const char contentSandboxRules[]
"; global file-read* permission should be removed from each level.\n"
"\n"
"; level 1: global read access permitted, no global write access\n"
" (if (string=? sandbox-level-1 \"TRUE\") (allow file-read*))\n"
"\n"
"; level 2: global read access permitted, no global write access,\n"
"; no read/write access to ~/Library,\n"
"; no read/write access to $PROFILE,\n"
- "; read access permitted to $PROFILE/{extensions,weave,chrome}\n"
+ "; read access permitted to $PROFILE/{extensions,chrome}\n"
" (if (string=? sandbox-level-2 \"TRUE\")\n"
" (if (string=? hasFilePrivileges \"TRUE\")\n"
" ; This process has blanket file read privileges\n"
" (allow file-read*)\n"
" ; This process does not have blanket file read privileges\n"
" (if (string=? hasProfileDir \"TRUE\")\n"
" ; we have a profile dir\n"
" (begin\n"
" (allow file-read* (require-all\n"
" (require-not (home-subpath \"/Library\"))\n"
" (require-not (subpath profileDir))))\n"
" (allow file-read*\n"
" (profile-subpath \"/extensions\")\n"
- " (profile-subpath \"/weave\")\n"
" (profile-subpath \"/chrome\")))\n"
" ; we don't have a profile dir\n"
" (allow file-read* (require-not (home-subpath \"/Library\"))))))\n"
"\n"
"; accelerated graphics\n"
" (allow-shared-preferences-read \"com.apple.opengl\")\n"
" (allow-shared-preferences-read \"com.nvidia.OpenGL\")\n"
" (allow mach-lookup\n"