Fix sandbox profile for MacOS 10.9 Mavericks.

Fix sandbox profile for MacOS 10.9 Mavericks.

This fixes the sandbox profile to be backwards compatible on MacOS
10.9, without affecting the security or operation of MacOS 10.10+.

BUG=689306
Review-Url: https://codereview.chromium.org/2973453002
Cr-Commit-Position: refs/heads/master@{#484746}
Committed: https://chromium.googlesource.com/chromium/src/+/b2464355416823fb43fc861f51a3ea0135c32932

[Greg K, 2017-07-03 21:34:30]

The CQ bit was checked by kerrnel@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-07-03 21:34:41]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-07-03 21:56:23]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-07-03 21:56:27]

Dry run: This issue passed the CQ dry run.

[Greg K, 2017-07-03 22:49:52]

kerrnel@chromium.org changed reviewers:
+ rsesek@chromium.org

[Greg K, 2017-07-03 22:49:53]

PTAL.

Thanks,

Greg

[Robert Sesek, 2017-07-06 20:02:23]

https://codereview.chromium.org/2973453002/diff/20001/content/browser/OWNERS
File content/browser/OWNERS (right):

https://codereview.chromium.org/2973453002/diff/20001/content/browser/OWNERS#...
content/browser/OWNERS:17: per-file
sandbox_parameters_mac.*=rsesek@chromium.org,kerrnel@chromium.org
I don't think , works. I think you need to duplicate the line.

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
File content/renderer/renderer_v2.sb (left):

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:50: (allow process-exec* (path (param
executable-path)))
I'm not quite sure what this change means...

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
File content/renderer/renderer_v2.sb (right):

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:19: (define is-mavericks "IS_MAVERICKS")
Something cute I saw in the Firefox profiles was defining the macOS version as
numeric (e.g. 1009, 1013) and then using inequalities agains that. Maybe
consider that in a follow-up if you like it?

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:127: (if (param-true? is-mavericks)
Comment. Why is this different from "com.apple.fonts" ?

[Greg K, 2017-07-06 20:58:58]

The CQ bit was checked by kerrnel@chromium.org to run a CQ dry run

[Greg K, 2017-07-06 20:59:07]

https://codereview.chromium.org/2973453002/diff/20001/content/browser/OWNERS
File content/browser/OWNERS (right):

https://codereview.chromium.org/2973453002/diff/20001/content/browser/OWNERS#...
content/browser/OWNERS:17: per-file
sandbox_parameters_mac.*=rsesek@chromium.org,kerrnel@chromium.org
On 2017/07/06 20:02:23, Robert Sesek wrote:
> I don't think , works. I think you need to duplicate the line.

Done.

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
File content/renderer/renderer_v2.sb (left):

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:50: (allow process-exec* (path (param
executable-path)))
On 2017/07/06 20:02:23, Robert Sesek wrote:
> I'm not quite sure what this change means...

It means nothing actually. 10.9 only had "process-exec" and then if we look at
the strings in libsandbox.dylib on 10.12:
(define process-exec process-exec*)

So it's just a name change, that still resolves to process-exec*.

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
File content/renderer/renderer_v2.sb (right):

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:19: (define is-mavericks "IS_MAVERICKS")
On 2017/07/06 20:02:23, Robert Sesek wrote:
> Something cute I saw in the Firefox profiles was defining the macOS version as
> numeric (e.g. 1009, 1013) and then using inequalities agains that. Maybe
> consider that in a follow-up if you like it?

Yeah, that isn't a bad idea. If I start making 10.13 specific changes I'll
follow up with a numeric version that's always present.

https://codereview.chromium.org/2973453002/diff/20001/content/renderer/render...
content/renderer/renderer_v2.sb:127: (if (param-true? is-mavericks)
On 2017/07/06 20:02:23, Robert Sesek wrote:
> Comment. Why is this different from "com.apple.fonts" ?

Done.

[commit-bot: I haz the power, 2017-07-06 20:59:14]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Robert Sesek, 2017-07-06 21:12:45]

LGTM

[Greg K, 2017-07-06 21:15:51]

kerrnel@chromium.org changed reviewers:
+ avi@chromium.org

[Greg K, 2017-07-06 21:15:52]

avi@chromium.org: Please review changes in 

content/browser/*

In particular I added Robert and myself to sandbox_parameters_mac.mm since the
whole file pertains to the MacOS sandbox.

[Avi (use Gerrit), 2017-07-06 21:18:28]

lgtm

[commit-bot: I haz the power, 2017-07-06 21:28:47]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-07-06 21:28:47]

Dry run: This issue passed the CQ dry run.

[Greg K, 2017-07-06 21:29:37]

The CQ bit was checked by kerrnel@chromium.org

[commit-bot: I haz the power, 2017-07-06 21:29:51]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-07-06 21:34:01]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1499376577377690,
"parent_rev": "43346fbbcf8132e6eba96218d97f0b8b56d03eda", "commit_rev":
"b2464355416823fb43fc861f51a3ea0135c32932"}

[commit-bot: I haz the power, 2017-07-06 21:34:13]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1499376577377690,
"parent_rev": "43346fbbcf8132e6eba96218d97f0b8b56d03eda", "commit_rev":
"b2464355416823fb43fc861f51a3ea0135c32932"}

[commit-bot: I haz the power, 2017-07-06 21:34:27]

Description was changed from

==========
Fix sandbox profile for MacOS 10.9 Mavericks.

This fixes the sandbox profile to be backwards compatible on MacOS
10.9, without affecting the security or operation of MacOS 10.10+.

BUG=689306
==========

to

==========
Fix sandbox profile for MacOS 10.9 Mavericks.

This fixes the sandbox profile to be backwards compatible on MacOS
10.9, without affecting the security or operation of MacOS 10.10+.

BUG=689306

Review-Url: https://codereview.chromium.org/2973453002
Cr-Commit-Position: refs/heads/master@{#484746}
Committed:
https://chromium.googlesource.com/chromium/src/+/b2464355416823fb43fc861f51a3...
==========

[commit-bot: I haz the power, 2017-07-06 21:34:28]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/chromium/src/+/b2464355416823fb43fc861f51a3...