Bug 1332190 - [Mac] Enable level 3 Mac content sandbox, removing filesystem read access. r=Alex_Gaynor draft
authorHaik Aftandilian <haftandilian@mozilla.com>
Tue, 27 Jun 2017 13:00:20 -0700
changeset 604579 2910f903abfcb0f4200313e200f84d5fe232f005
parent 604578 db74b8878baeb22c75e44fc894bd00cada93c777
child 636240 14e2a339257b7d3bad90466a54529902d3da532c
push id67129
push userhaftandilian@mozilla.com
push dateThu, 06 Jul 2017 04:49:50 +0000
reviewersAlex_Gaynor
bugs1332190
milestone56.0a1
Bug 1332190 - [Mac] Enable level 3 Mac content sandbox, removing filesystem read access. r=Alex_Gaynor MozReview-Commit-ID: JR624YV4Cns
browser/app/profile/firefox.js
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1069,17 +1069,17 @@ pref("security.sandbox.gpu.level", 0);
 //       to ~/Library and profile directories are prevented (excluding
 //       $PROFILE/{extensions,chrome})"
 // 3 -> "no global read/write access, read access permitted to
 //       $PROFILE/{extensions,chrome}"
 // This setting is read when the content process is started. On Mac the content
 // process is killed when all windows are closed, so a change will take effect
 // when the 1st window is opened.
 #if defined(NIGHTLY_BUILD)
-pref("security.sandbox.content.level", 2);
+pref("security.sandbox.content.level", 3);
 #else
 pref("security.sandbox.content.level", 1);
 #endif
 #endif
 
 #if defined(XP_LINUX) && defined(MOZ_SANDBOX) && defined(MOZ_CONTENT_SANDBOX)
 // This pref is introduced as part of bug 742434, the naming is inspired from
 // its Windows/Mac counterpart, but on Linux it's an integer which means: