Changeset 243267 in webkit

Timestamp:

Mar 20, 2019, 5:36:06 PM (7 years ago)

Author:

jiewen_tan@apple.com

Message:

Extend Networking Process sandbox for some system frameworks
​https://bugs.webkit.org/show_bug.cgi?id=196036
<rdar://problem/47594150>

Reviewed by Brent Fulgham.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (2 diffs)
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-20  Jiewen Tan  <jiewen_tan@apple.com>
+
+        Extend Networking Process sandbox for some system frameworks
+        https://bugs.webkit.org/show_bug.cgi?id=196036
+        <rdar://problem/47594150>
+
+        Reviewed by Brent Fulgham.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+
 2019-03-20  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -143 +143 @@
     (ipc-posix-name "FNetwork.defaultStorageSession")
     (ipc-posix-name-regex #"\.PrivateBrowsing-")
-    (ipc-posix-name-regex #"^WebKit Test-"))
+    (ipc-posix-name-regex #"^WebKit Test-")
+    (ipc-posix-name "/com.apple.AppSSO.version")
+)
 
 ;; Various services required by CFNetwork and other frameworks
@@ -160 +162 @@
     (global-name "com.apple.nesessionmanager.flow-divert-token")
     (global-name "com.apple.nesessionmanager.content-filter") ;; <rdar://problem/47598758>
+    (global-name "com.apple.AppSSO.service-xpc")
 )
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

@@ -96 +96 @@
 (allow mach-lookup
     (global-name "com.apple.lsd.mapdb")
-    (global-name "com.apple.analyticsd"))
+    (global-name "com.apple.analyticsd")
+    (global-name "com.apple.AppSSO.service-xpc"))
 
 ;; For reporting progress for active downloads <rdar://problem/44405661>
@@ -105 +106 @@
 (allow mach-lookup
     (global-name "com.apple.nesessionmanager.content-filter"))
+
+;; Various shared memory accesses required by system frameworks
+(allow ipc-posix-shm-read-data
+    (ipc-posix-name "/com.apple.AppSSO.version"))