Restrict sysctl access in macOS sandbox
Open
Nobody has claimed this yet.
A-security
P-mac
- Dominant language
- Rust
- Stars
- 38k
- Forks
- 3.8k
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 465
Description
The current servo macOS sandbox policy allows the process to read/write arbitrary sysctl values: https://github.com/servo/servo/blob/master/etc/servo.sb#L24-L25
These can be restricted by name or by regex like so:
(allow sysctl-read
(sysctl-name "kern.osversion")
(sysctl-name-regex #"^hw\."))
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in etc/servo.sb at lines 24-25 and inspect the current sysctl permissions. Determine which named or regex-based permissions are needed, replace the arbitrary access, and verify that the macOS sandbox still permits the required Servo behavior while rejecting unrelated sysctl values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100