New issue
Advanced search Search tips

Issue 880886 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Oct 12
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Remove WindowServer access from renderer proceses

Project Member Reported by rsesek@chromium.org, Sep 5

Issue description

We should attempt to remove access to the WindowServer from renderer processes. Now that we've shipped the v2 sandbox, this should just be a matter of removing the sandbox allow rule, rather than changing any warmup code.

 
Project Member

Comment 1 by bugdroid1@chromium.org, Sep 6

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/07d2373cfd34f756d7e23b8fd31108b4b8b92fd0

commit 07d2373cfd34f756d7e23b8fd31108b4b8b92fd0
Author: Robert Sesek <rsesek@chromium.org>
Date: Thu Sep 06 16:45:12 2018

Remove Mach com.apple.windowserver.active access from renderer_v2.sb.

Bug:  880886 
Change-Id: Ie13ab55b4b35ffe24e0cbbbaf75a9796db132631
Reviewed-on: https://chromium-review.googlesource.com/1184221
Reviewed-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589192}
[modify] https://crrev.com/07d2373cfd34f756d7e23b8fd31108b4b8b92fd0/services/service_manager/sandbox/mac/renderer_v2.sb

Project Member

Comment 2 by bugdroid1@chromium.org, Sep 14

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0a50aa030d7ba3ba6714263aaef7ce24daca6918

commit 0a50aa030d7ba3ba6714263aaef7ce24daca6918
Author: Alex Gaynor <agaynor@mozilla.com>
Date: Fri Sep 14 21:12:04 2018

Verify that there are no open connections to the macOS WindowServer

A disassembly of CGSSetDenyWindowServerConnections indicates that it only
actually does anything when there are no currently open WindowServer
connections. There should be no open connections, so we call it and verify
that we succeeded.

Bug:  880886 
Change-Id: I59bce619d1e684da1fc9356a89c129f990c8e91c
Reviewed-on: https://chromium-review.googlesource.com/1150668
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#591473}
[modify] https://crrev.com/0a50aa030d7ba3ba6714263aaef7ce24daca6918/content/renderer/renderer_main_platform_delegate_mac.mm

Labels: M-71
Status: Fixed (was: Assigned)

Sign in to add a comment