Changeset 245817 in webkit

Timestamp:

May 28, 2019, 10:33:58 AM (7 years ago)

Author:

Brent Fulgham

Message:

Update sandbox rules for more News use cases
​https://bugs.webkit.org/show_bug.cgi?id=198236
<rdar://problem/50054027>

Reviewed by Alexey Proskuryakov.

Update the WebContent and Network process sandboxes so that News has the same set of allowed
service access as regular WebKit views.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (4 diffs)
• WebProcess/com.apple.WebProcess.sb.in (modified) (4 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-05-28  Brent Fulgham  <bfulgham@apple.com>
+
+        Update sandbox rules for more News use cases
+        https://bugs.webkit.org/show_bug.cgi?id=198236
+        <rdar://problem/50054027>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update the WebContent and Network process sandboxes so that News has the same set of allowed
+        service access as regular WebKit views.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-05-27  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -1 @@
-; Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+; Copyright (C) 2013-2019 Apple Inc. All rights reserved.
 ;
 ; Redistribution and use in source and binary forms, with or without
@@ -44 +44 @@
 (deny iokit-get-properties)
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
 (deny mach-lookup (xpc-service-name-prefix ""))
 #endif
@@ -58 +58 @@
     (literal (string-append (param "HOME_DIR") home-relative-literal)))
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
 ;; CFNetwork
 (allow file-read-data (path "/private/var/db/nsurlstoraged/dafsaData.bin"))
@@ -153 +153 @@
     (global-name "com.apple.PowerManagement.control")
     (global-name "com.apple.SystemConfiguration.configd")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
     (global-name "com.apple.analyticsd")
 #endif

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -1 @@
-; Copyright (C) 2010-2018 Apple Inc. All rights reserved.
+; Copyright (C) 2010-2019 Apple Inc. All rights reserved.
 ;
 ; Redistribution and use in source and binary forms, with or without
@@ -115 +115 @@
     (allow mach-lookup
         (global-name "com.apple.cvmsServ"))
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(IOSMAC)
     (allow file-read*
         (prefix "/private/var/db/CVMS/cvmsCodeSignObj"))
@@ -637 +637 @@
        (global-name "com.apple.tccd.system")
        (global-name "com.apple.trustd.agent")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(IOSMAC)
        (global-name "com.apple.CARenderServer") ; Needed for [CAContext remoteContextWithOptions]
 #else
@@ -649 +649 @@
 #endif
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(IOSMAC)
 (deny mach-lookup (with no-log)
     (global-name "com.apple.ViewBridgeAuxiliary")