Bug 1384941 - removed access to mach services which are used for cameras in the content process; r?haik
MozReview-Commit-ID: Ir6KgLM34bu
--- a/security/sandbox/mac/SandboxPolicies.h
+++ b/security/sandbox/mac/SandboxPolicies.h
@@ -177,35 +177,32 @@ static const char contentSandboxRules[]
(home-regex (string-append "/Library/Preferences/" (regex-quote domain)))))
(allow ipc-posix-shm
(ipc-posix-name-regex "^/tmp/com.apple.csseed:")
(ipc-posix-name-regex "^CFPBS:")
(ipc-posix-name-regex "^AudioIO"))
(allow signal (target self))
- (allow job-creation (literal "/Library/CoreMediaIO/Plug-Ins/DAL"))
(allow iokit-set-properties (iokit-property "IOAudioControlValue"))
(allow mach-lookup
(global-name "com.apple.coreservices.launchservicesd")
(global-name "com.apple.coreservices.appleevents")
(global-name "com.apple.pasteboard.1")
(global-name "com.apple.window_proxies")
(global-name "com.apple.windowserver.active")
(global-name "com.apple.audio.coreaudiod")
(global-name "com.apple.audio.audiohald")
(global-name "com.apple.PowerManagement.control")
- (global-name "com.apple.cmio.VDCAssistant")
(global-name "com.apple.SystemConfiguration.configd")
(global-name "com.apple.iconservices")
(global-name "com.apple.cache_delete")
(global-name "com.apple.pluginkit.pkd")
(global-name "com.apple.bird")
- (global-name "com.apple.cmio.AppleCameraAssistant")
(global-name "com.apple.DesktopServicesHelper"))
; bug 1376163
(if (string=? macosMinorVersion-min13 "TRUE")
(allow mach-lookup (global-name "com.apple.audio.AudioComponentRegistrar")))
; bug 1312273
(if (string=? macosMinorVersion-9 "TRUE")
@@ -219,31 +216,28 @@ static const char contentSandboxRules[]
(iokit-user-client-class "nvDevice")
(iokit-user-client-class "nvSharedUserClient")
(iokit-user-client-class "nvFermiGLContext")
(iokit-user-client-class "IGAccelGLContext")
(iokit-user-client-class "IGAccelSharedUserClient")
(iokit-user-client-class "IGAccelVideoContextMain")
(iokit-user-client-class "IGAccelVideoContextMedia")
(iokit-user-client-class "IGAccelVideoContextVEBox")
- (iokit-user-client-class "RootDomainUserClient")
- (iokit-user-client-class "IOUSBDeviceUserClientV2")
- (iokit-user-client-class "IOUSBInterfaceUserClientV2"))
+ (iokit-user-client-class "RootDomainUserClient"))
; depending on systems, the 1st, 2nd or both rules are necessary
(allow-shared-preferences-read "com.apple.HIToolbox")
(allow file-read-data (literal "/Library/Preferences/com.apple.HIToolbox.plist"))
(allow-shared-preferences-read "com.apple.ATS")
(allow file-read-data (literal "/Library/Preferences/.GlobalPreferences.plist"))
(allow file-read*
(subpath "/Library/Fonts")
(subpath "/Library/Audio/Plug-Ins")
- (subpath "/Library/CoreMediaIO/Plug-Ins/DAL")
(subpath "/Library/Spelling")
(literal "/")
(literal "/private/tmp")
(literal "/private/var/tmp")
(home-literal "/.CFUserTextEncoding")
(home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
(home-subpath "/Library/Colors")