Changeset 228419 in webkit

Timestamp:

Feb 13, 2018 8:51:10 AM (6 years ago)

Author:

Brent Fulgham

Message:

[iOS] whitelist iokit-get-properties
​https://bugs.webkit.org/show_bug.cgi?id=182722
<rdar://problem/30929165>

Reviewed by Eric Carlson.

Update the iOS sandbox to block access to IOKit properties that are not needed for
legitimate WebContent process use. This brings the iOS sandbox in line with the
work done under macOS.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-02-13  Brent Fulgham  <bfulgham@apple.com>
+
+        [iOS] whitelist iokit-get-properties
+        https://bugs.webkit.org/show_bug.cgi?id=182722
+        <rdar://problem/30929165>
+
+        Reviewed by Eric Carlson.
+
+        Update the iOS sandbox to block access to IOKit properties that are not needed for
+        legitimate WebContent process use. This brings the iOS sandbox in line with the
+        work done under macOS.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2018-02-12  John Wilander  <wilander@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -312 +312 @@
         "vm.footprint_suspend"))
 
+(deny iokit-get-properties (with partial-symbolication))
+(allow iokit-get-properties
+    (iokit-property-regex #"^AAPL,(DisplayPipe|OpenCLdisabled|IOGraphics_LER(|_RegTag_1|_RegTag_0|_Busy_2)|alias-policy|boot-display|display-alias|mux-switch-state|ndrv-dev|primary-display|slot-name)")
+    (iokit-property-regex #"^AppleJPEG(NumCores|Supports(AppleInterchangeFormats|MissingEOI))")
+    (iokit-property "BaseAddressAlignmentRequirement")
+    (iokit-property-regex #"^DisplayPipe(PlaneBaseAlignment|StrideRequirements)")
+    (iokit-property-regex #"^IOGL(|ES(|Metal))BundleName")
+    (iokit-property "IOGLESDefaultUseMetal")
+    (iokit-property "IOSurfaceAcceleratorCapabilitiesDict")
+    (iokit-property-regex #"^MetalPlugin(Name|ClassName)")
+    (iokit-property "emu")
+    (iokit-property "hdcp-hoover-protocol")
+    (iokit-property "iommu-present")
+    (iokit-property "product-id")
+    (iokit-property "software-behavior")
+)
+
 ;; Read-only preferences and data
 (mobile-preferences-read