Changeset 245822 in webkit

Timestamp:

May 28, 2019, 12:29:25 PM (7 years ago)

Author:

Brent Fulgham

Message:

Remove dead code from sandboxes
​https://bugs.webkit.org/show_bug.cgi?id=198300

Reviewed by Alexey Proskuryakov.

SSIA.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (3 diffs)
• PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in (modified) (4 diffs)
• WebProcess/com.apple.WebProcess.sb.in (modified) (10 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-05-28  Brent Fulgham  <bfulgham@apple.com>
+
+        Remove dead code from sandboxes
+        https://bugs.webkit.org/show_bug.cgi?id=198300
+
+        Reviewed by Alexey Proskuryakov.
+
+        SSIA.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-05-28  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -44 +44 @@
 (deny iokit-get-properties)
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
 (deny mach-lookup (xpc-service-name-prefix ""))
-#endif
 
 ;; Utility functions for home directory relative path filters
@@ -58 +56 @@
     (literal (string-append (param "HOME_DIR") home-relative-literal)))
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
 ;; CFNetwork
 (allow file-read-data (path "/private/var/db/nsurlstoraged/dafsaData.bin"))
-#endif
 
 ;; Remove when <rdar://problem/29646094> is fixed.
@@ -153 +149 @@
     (global-name "com.apple.PowerManagement.control")
     (global-name "com.apple.SystemConfiguration.configd")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 || PLATFORM(IOSMAC)
     (global-name "com.apple.analyticsd")
-#endif
     (global-name "com.apple.cookied")
     (global-name "com.apple.cfnetwork.AuthBrokerAgent")

trunk/Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in

@@ -152 +152 @@
 )
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
 (deny mach-lookup (xpc-service-name-prefix ""))
 (allow mach-lookup
@@ -166 +165 @@
     (xpc-service-name "com.apple.print.normalizerd")
 )
-#endif
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400
@@ -343 +341 @@
     (home-literal "/Library/Preferences/com.apple.lookup.shared.plist"))
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
-;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
-;; Restrict AppSandboxed processes from creating /Library/Keychains, but allow access to the contents of /Library/Keychains:
-(allow file-read-data file-read-metadata file-write-data
-    (subpath "/Library/Keychains"))
-
-;; Do permit creating per-user keychains
-(allow file-read* file-write*
-    (home-library-subpath "/Keychains"))
-
-;; Except deny access to new-style iOS Keychain folders which are UUIDs.
-(deny file-read* file-write*
-    (regex (string-append "/Library/Keychains/" (uuid-regex-string) "(/|$)"))
-    (home-library-regex (string-append "/Keychains/" (uuid-regex-string) "(/|$)")))
-#endif
-
 ;; Security framework
 (allow mach-lookup (global-name "com.apple.ocspd"))
@@ -391 +373 @@
     (global-name "com.apple.SystemConfiguration.configd")
     (global-name "com.apple.UNCUserNotification")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
     (global-name "com.apple.analyticsd")
-#endif
     (global-name "com.apple.audio.audiohald")
     (global-name "com.apple.audio.coreaudiod")

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -26 +26 @@
 (allow system-audit file-read-metadata)
 
-#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
-(import "system.sb")
-#else
 ;;;
 ;;; The following rules were originally contained in 'system.sb'. We are duplicating them here so we can
@@ -89 +86 @@
     (literal "/dev/dtracehelper"))
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
-(allow network-outbound
-    (literal "/private/var/run/asl_input")
-    (literal "/private/var/run/syslog"))
-#endif
-
 ;;; Allow creation of core dumps.
 (allow file-write-create
     (require-all (prefix "/cores/")
         (vnode-type REGULAR-FILE)))
-
 
 ;;; Allow IPC to standard system agents.
@@ -156 +146 @@
 ;;; End rules originally copied from 'system.sb'
 ;;;
-#endif
 
 ;;; process-info* defaults to allow; deny it and then allow operations we actually need.
@@ -400 +389 @@
 )
 
-#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
 (deny mach-lookup (xpc-service-name-prefix ""))
 (allow mach-lookup
@@ -412 +400 @@
     (xpc-service-name "com.apple.print.normalizerd")
 )
-#endif
 
 ;; Utility functions for home directory relative path filters
@@ -609 +596 @@
        (global-name "com.apple.PowerManagement.control")
        (global-name "com.apple.SystemConfiguration.configd")
-#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
        (global-name "com.apple.analyticsd")
        (global-name "com.apple.audio.AudioComponentRegistrar")
-#endif
        (global-name "com.apple.assertiond.processassertionconnection")
        (global-name "com.apple.audio.SystemSoundServer-OSX")
@@ -688 +673 @@
 
 ;; Networking
-#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
-(system-network)
-#endif
 (allow network-outbound
        ;; Local mDNSResponder for DNS, arbitrary outbound TCP
@@ -700 +682 @@
        (remote tcp))
 
-#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
 ;; CFNetwork
 (allow file-read-data (path "/private/var/db/nsurlstoraged/dafsaData.bin"))
-#endif
 
 ;; Network Extensions / VPN helper.
@@ -715 +695 @@
        (global-name "com.apple.system.logger")
        (global-name "com.apple.system.notification_center"))
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
-(allow network-outbound
-       (remote udp))
-#endif
 #endif
 
@@ -761 +737 @@
     ; <rdar://problem/35509194>
     (global-name "com.apple.coremedia.endpointremotecontrolsession.xpc")
-#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300
     (global-name "com.apple.coremedia.routediscoverer.xpc")
     (global-name "com.apple.coremedia.routingcontext.xpc")
     (global-name "com.apple.coremedia.volumecontroller.xpc")
-#endif
 )