Changeset 243692 in webkit

Timestamp:

Apr 1, 2019, 6:02:39 AM (7 years ago)

Author:

commit-queue@webkit.org

Message:

[GTK][WPE] Fix seccomp rule for blacklisting TIOCSTI
​https://bugs.webkit.org/show_bug.cgi?id=196297

Patch by Patrick Griffis <Patrick Griffis> on 2019-04-01
Reviewed by Michael Catanzaro.

More information can be found here: ​https://www.exploit-db.com/exploits/46594

Note that this sandbox never made it into production so does not
warrant any CVE specific to WebKit.

• UIProcess/Launcher/glib/BubblewrapLauncher.cpp:

(WebKit::setupSeccomp):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/Launcher/glib/BubblewrapLauncher.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-01  Patrick Griffis  <pgriffis@igalia.com>
+
+        [GTK][WPE] Fix seccomp rule for blacklisting TIOCSTI
+        https://bugs.webkit.org/show_bug.cgi?id=196297
+
+        Reviewed by Michael Catanzaro.
+
+        More information can be found here: https://www.exploit-db.com/exploits/46594
+
+        Note that this sandbox never made it into production so does not
+        warrant any CVE specific to WebKit.
+
+        * UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
+        (WebKit::setupSeccomp):
+
 2019-03-31  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

@@ -556 +556 @@
     //    in src/setup-seccomp.c
     struct scmp_arg_cmp cloneArg = SCMP_A0(SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER);
-    struct scmp_arg_cmp ttyArg = SCMP_A1(SCMP_CMP_EQ, static_cast<scmp_datum_t>(TIOCSTI), static_cast<scmp_datum_t>(0));
+    struct scmp_arg_cmp ttyArg = SCMP_A1(SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, TIOCSTI);
     struct {
         int scall;