Bug 1384941 - removed access to mach services which are used for cameras in the content process; r?haik draft
authorAlex Gaynor <agaynor@mozilla.com>
Tue, 25 Jul 2017 11:51:03 -0400
changeset 616805 b429a52977a17b88584e6fd36c46448a7b2218f9
parent 616724 658cba6a971257e2ba39715ec938256dfc414776
child 639600 ba3f60c0f45d971d60e0990e82ec8a2d9124cf7c
push id70818
push userbmo:agaynor@mozilla.com
push dateThu, 27 Jul 2017 14:36:09 +0000
reviewershaik
bugs1384941
milestone56.0a1
Bug 1384941 - removed access to mach services which are used for cameras in the content process; r?haik MozReview-Commit-ID: Ir6KgLM34bu
security/sandbox/mac/SandboxPolicies.h
--- a/security/sandbox/mac/SandboxPolicies.h
+++ b/security/sandbox/mac/SandboxPolicies.h
@@ -177,35 +177,32 @@ static const char contentSandboxRules[] 
            (home-regex (string-append "/Library/Preferences/" (regex-quote domain)))))
 
   (allow ipc-posix-shm
       (ipc-posix-name-regex "^/tmp/com.apple.csseed:")
       (ipc-posix-name-regex "^CFPBS:")
       (ipc-posix-name-regex "^AudioIO"))
 
   (allow signal (target self))
-  (allow job-creation (literal "/Library/CoreMediaIO/Plug-Ins/DAL"))
   (allow iokit-set-properties (iokit-property "IOAudioControlValue"))
 
   (allow mach-lookup
       (global-name "com.apple.coreservices.launchservicesd")
       (global-name "com.apple.coreservices.appleevents")
       (global-name "com.apple.pasteboard.1")
       (global-name "com.apple.window_proxies")
       (global-name "com.apple.windowserver.active")
       (global-name "com.apple.audio.coreaudiod")
       (global-name "com.apple.audio.audiohald")
       (global-name "com.apple.PowerManagement.control")
-      (global-name "com.apple.cmio.VDCAssistant")
       (global-name "com.apple.SystemConfiguration.configd")
       (global-name "com.apple.iconservices")
       (global-name "com.apple.cache_delete")
       (global-name "com.apple.pluginkit.pkd")
       (global-name "com.apple.bird")
-      (global-name "com.apple.cmio.AppleCameraAssistant")
       (global-name "com.apple.DesktopServicesHelper"))
 
 ; bug 1376163
   (if (string=? macosMinorVersion-min13 "TRUE")
     (allow mach-lookup (global-name "com.apple.audio.AudioComponentRegistrar")))
 
 ; bug 1312273
   (if (string=? macosMinorVersion-9 "TRUE")
@@ -219,31 +216,28 @@ static const char contentSandboxRules[] 
       (iokit-user-client-class "nvDevice")
       (iokit-user-client-class "nvSharedUserClient")
       (iokit-user-client-class "nvFermiGLContext")
       (iokit-user-client-class "IGAccelGLContext")
       (iokit-user-client-class "IGAccelSharedUserClient")
       (iokit-user-client-class "IGAccelVideoContextMain")
       (iokit-user-client-class "IGAccelVideoContextMedia")
       (iokit-user-client-class "IGAccelVideoContextVEBox")
-      (iokit-user-client-class "RootDomainUserClient")
-      (iokit-user-client-class "IOUSBDeviceUserClientV2")
-      (iokit-user-client-class "IOUSBInterfaceUserClientV2"))
+      (iokit-user-client-class "RootDomainUserClient"))
 
 ; depending on systems, the 1st, 2nd or both rules are necessary
   (allow-shared-preferences-read "com.apple.HIToolbox")
   (allow file-read-data (literal "/Library/Preferences/com.apple.HIToolbox.plist"))
 
   (allow-shared-preferences-read "com.apple.ATS")
   (allow file-read-data (literal "/Library/Preferences/.GlobalPreferences.plist"))
 
   (allow file-read*
       (subpath "/Library/Fonts")
       (subpath "/Library/Audio/Plug-Ins")
-      (subpath "/Library/CoreMediaIO/Plug-Ins/DAL")
       (subpath "/Library/Spelling")
       (literal "/")
       (literal "/private/tmp")
       (literal "/private/var/tmp")
 
       (home-literal "/.CFUserTextEncoding")
       (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
       (home-subpath "/Library/Colors")