Changeset 245247 in webkit

Timestamp:

May 13, 2019, 1:10:43 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r245246. rdar://problem/50727815

Correct the sandbox to allow loading libraries from /Library/Apple
​https://bugs.webkit.org/show_bug.cgi?id=197844

Reviewed by Per Arne Vollan.

Grant access to '/Library/Apple' as an appropriate place to load
system frameworks.

• WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245246 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-608.1.24-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (2 diffs)

branches/safari-608.1.24-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2019-05-13  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r245246. rdar://problem/50727815
+
+    Correct the sandbox to allow loading libraries from /Library/Apple
+    https://bugs.webkit.org/show_bug.cgi?id=197844
+    
+    Reviewed by Per Arne Vollan.
+    
+    Grant access to '/Library/Apple' as an appropriate place to load
+    system frameworks.
+    
+    * WebProcess/com.apple.WebProcess.sb.in:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245246 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-13  Brent Fulgham  <bfulgham@apple.com>
+
+            Correct the sandbox to allow loading libraries from /Library/Apple
+            https://bugs.webkit.org/show_bug.cgi?id=197844
+
+            Reviewed by Per Arne Vollan.
+
+            Grant access to '/Library/Apple' as an appropriate place to load
+            system frameworks.
+
+            * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-05-12  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-608.1.24-branch/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -41 +41 @@
     (require-all (file-mode #o0004)
     (require-any (subpath "/Library/Filesystems/NetFSPlugins")
+    (subpath "/Library/Apple/System")
     (subpath "/Library/Preferences/Logging")      ; Logging Rethink
     (subpath "/System")
@@ -53 +54 @@
     (subpath "/AppleInternal/Library/Preferences/Logging")
     (system-attribute apple-internal)))
+
+;;; Allow mapping of system frameworks + dylibs
+(allow file-map-executable
+    (subpath "/Library/Apple/System/Library/Frameworks")
+    (subpath "/Library/Apple/System/Library/PrivateFrameworks")
+    (subpath "/System/Library/Frameworks")
+    (subpath "/System/Library/PrivateFrameworks")
+    (subpath "/usr/lib")
+    (literal "/usr/local/lib/sanitizers"))
 
 (allow file-read-metadata