Changeset 229345 in webkit

Timestamp:

Mar 6, 2018 3:19:56 PM (6 years ago)

Author:

Kocsen Chung

Message:

Revert r229093. rdar://problem/38197270

Location:

tags/Safari-606.1.7/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (2 diffs)
• WebProcess/com.apple.WebProcess.sb.in (modified) (6 diffs)

tags/Safari-606.1.7/Source/WebKit/ChangeLog

@@ +1 @@
+2018-03-06  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Revert r229093. rdar://problem/38197270
+
 2018-03-02  Brian Burg  <bburg@apple.com>
 

tags/Safari-606.1.7/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -230 +230 @@
     (home-literal "/Library/Caches/com.apple.DictionaryServices"))
 
+(allow-network-common)
+
 ; <rdar://problem/8548856> Sub-TLF: Sandbox change for apps for read-only access to the dictionary directory/data
 (allow file-read*
@@ -381 +383 @@
 (awd-log-directory "com.apple.WebKit.WebContent")
 
+(network-client (remote tcp) (remote udp))
+
 ;; Allow ManagedPreference access
 (allow file-read* (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist"))

tags/Safari-606.1.7/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -1 @@
-; Copyright (C) 2010-2018 Apple Inc. All rights reserved.
+; Copyright (C) 2010-2017 Apple Inc. All rights reserved.
 ;
 ; Redistribution and use in source and binary forms, with or without
@@ -79 +79 @@
     (literal "/dev/dtracehelper"))
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
 (allow network-outbound
     (literal "/private/var/run/asl_input")
     (literal "/private/var/run/syslog"))
-#endif
+
 
 ;;; Allow creation of core dumps.
@@ -141 +140 @@
         (iokit-property "ggcs")
         (iokit-property "bgcs")))))
+
+
+;;; (system-network) - Allow access to the network.
+(define (system-network)
+    (allow file-read*
+        (literal "/Library/Preferences/com.apple.networkd.plist"))
+    (allow mach-lookup
+        (global-name "com.apple.SystemConfiguration.PPPController")
+        (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
+        (global-name "com.apple.nehelper")
+        (global-name "com.apple.networkd")
+        (global-name "com.apple.nsurlstorage-cache")
+        (global-name "com.apple.symptomsd")
+        (global-name "com.apple.usymptomsd"))
+    (allow network-outbound
+        (control-name "com.apple.netsrc")
+        (control-name "com.apple.network.statistics"))
+    (allow system-socket
+        (require-all (socket-domain AF_SYSTEM)
+        (socket-protocol 2)) ; SYSPROTO_CONTROL
+    (socket-domain AF_ROUTE)))
 
 ;;;
@@ -627 +647 @@
 
 ;; Networking
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
 (system-network)
 (allow network-outbound
@@ -633 +652 @@
        (literal "/private/var/run/mDNSResponder")
        (remote tcp))
-#endif
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
@@ -646 +664 @@
        (global-name "com.apple.system.logger")
        (global-name "com.apple.system.notification_center"))
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
 (allow network-outbound
        (remote udp))
-#endif
 (allow user-preference-read
     (preference-domain