Changeset 274231 in webkit

Timestamp:

Mar 10, 2021, 1:07:06 PM (6 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Add additional telemetry to WebContent sandbox
​https://bugs.webkit.org/show_bug.cgi?id=223035
<rdar://75275161>

Reviewed by Geoffrey Garen.

Add additional telemetry to WebContent sandbox on iOS.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (11 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-10  Per Arne  <pvollan@apple.com>
+
+        [iOS] Add additional telemetry to WebContent sandbox 
+        https://bugs.webkit.org/show_bug.cgi?id=223035
+        <rdar://75275161>
+
+        Reviewed by Geoffrey Garen.
+
+        Add additional telemetry to WebContent sandbox on iOS.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2021-03-10  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -501 +501 @@
     (mobile-preferences-read "kCFPreferencesAnyApplication")
     (allow file-read*
-           (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist"))
+           (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist")
+           (front-user-home-literal "/Library/Preferences/.GlobalPreferences_m.plist"))
 
     (allow file-read*
@@ -581 +582 @@
     (literal "/"))
 
+(deny file-read* (with no-report)
+      (literal "/private/etc/passwd"))
+
 (allow file-read*
        (subpath "/private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs"))
@@ -602 +606 @@
        (ipc-posix-name-prefix "apple.cfprefs."))
  
-(deny mach-lookup
-    (global-name "com.apple.lsd.mapdb"))
+(deny mach-lookup (with no-report)
+    (global-name "com.apple.lsd.mapdb")) 
 
 ;; <rdar://problem/12413942>
@@ -696 +700 @@
 (allow process-info-dirtycontrol (target self))
 (allow process-info-rusage (target self))
-(allow process-info-codesignature (target self))
 
 ;;;
@@ -1167 +1170 @@
         (syscall-number SYS_sigprocmask)
         (syscall-number SYS_sigaltstack)
-        (syscall-number SYS_ioctl)
+        (syscall-number SYS_ioctl) ;; needed by tcgetattr (TIOCGETA) - debugging
         (syscall-number SYS_readlink)
         (syscall-number SYS_umask)
@@ -1183 +1186 @@
         (syscall-number SYS_gettimeofday)
         (syscall-number SYS_getrusage)
-        (syscall-number SYS_getsockopt)
+        (syscall-number SYS_getsockopt) ;; used by libwebrtc
         (syscall-number SYS_writev)
         (syscall-number SYS_fchmod)
@@ -1195 +1198 @@
         (syscall-number SYS_pread)
         (syscall-number SYS_pwrite)
-        (syscall-number SYS_csops)
-        (syscall-number SYS_csops_audittoken)
+        (syscall-number SYS_csops) ;; used by Corefoundation initialization
+        (syscall-number SYS_csops_audittoken) ;; used by WK to get entitlments
         (syscall-number SYS_kdebug_trace64)
         (syscall-number SYS_kdebug_trace)
@@ -1209 +1212 @@
         (syscall-number SYS_mlock)
         (syscall-number SYS_munlock)
-        (syscall-number SYS_getattrlist)
+        (syscall-number SYS_getattrlist) ;; xpc_realpath and directory enumeration
         (syscall-number SYS_getxattr)
         (syscall-number SYS_fgetxattr)
@@ -1265 +1268 @@
         (syscall-number SYS_proc_rlimit_control)
         (syscall-number SYS_connectx)
-        (syscall-number SYS_getattrlistbulk)
+        (syscall-number SYS_getattrlistbulk) ;; xpc_realpath and directory enumeration
         (syscall-number SYS_openat)
         (syscall-number SYS_openat_nocancel)
@@ -1289 +1292 @@
         (syscall-number SYS_sem_open)
         (syscall-number SYS_sem_close)
-        (syscall-number SYS_fsetattrlist)
+        (syscall-number SYS_fsetattrlist) ;; MTLCompilerFSCache::openSync
         (syscall-number SYS_guarded_open_dprotected_np) ; <rdar://problem/48166729>
         (syscall-number SYS_mremap_encrypted)
@@ -1314 +1317 @@
     (if (defined? 'SYS_objc_bp_assist_cfg_np)
         (allow syscall-unix (syscall-number SYS_objc_bp_assist_cfg_np)))
+)
+
+(when (defined? 'file-ioctl)
+    (allow file-ioctl (with telemetry))
+    ;; restrict to the two ioctl's /dev/aes_0 needs
+    (allow file-ioctl (with telemetry)
+       (ioctl-command (_IO "T" 101)) ;; IOAES_GET_INFO
+       (ioctl-command (_IO "T" 102))) ;; IOAES_ENCRYPT_DECRYPT
+)
+
+(when (defined? 'socket-ioctl)
+    (allow socket-ioctl (with telemetry))
+)
+
+(when (defined? 'system-fcntl)
+    (allow system-fcntl (with telemetry))
+    (allow system-fcntl
+        (fcntl-command F_GETPATH) ;; used by dyld4 and CGFontURLCreate, getcwd (at least)
+        (fcntl-command F_ADDFILESIGS_RETURN) ;; ImageLoaderMachO::loadCodeSignature
+        (fcntl-command F_CHECK_LV) ;; ImageLoaderMachO::loadCodeSignature
+        (fcntl-command F_SPECULATIVE_READ) ;; ImageLoaderMachO::mapSegments
+        (fcntl-command F_SETFD) ;; libwebrtc.dylib (no backtrace)
+        (fcntl-command F_GETFD) ;; libwebrtc.dylib (no backtrace)
+
+        (fcntl-command F_SETFL) ;; CMCapture uses when camera is enabled
+        (fcntl-command F_SETNOSIGPIPE)) ;; CMCapture uses when camera is enabled
+
+    (allow system-fcntl
+        (fcntl-command F_GETPROTECTIONCLASS))
+)
+
+(when (defined? 'process-codesigning*)
+    ;; csops/csops_audittoken
+    (allow process-codesigning-status-set (with telemetry))
+    (allow process-codesigning-text-offset-get (with telemetry))
+    (allow process-codesigning-cdhash-get (with telemetry))
+    (allow process-codesigning-blob-get (with telemetry))
+    (allow process-codesigning-teamid-get (with telemetry))
+    (allow process-codesigning-identity-get (with telemetry)) ;; codeSigningIdentifierForCurrentProcess
+    (allow process-codesigning-entitlements-blob-get) ;; WK reading entitlments via SecTaskCopyValueForEntitlement and _getSelfParsedEntitlements (accessibility)
+    (allow process-codesigning-status-get) ;; _xpc_get_entitlements
+    (deny process-info-codesignature (with no-report)) ;; SecTaskCopyValueForEntitlement - granting this grants all the process-codesign-* checks
+)
+
+(when (not (defined? 'process-codesigning*))
+    (allow process-info-codesignature (target self))
+)
+
+(when (defined? 'socket-option-get)
+    ;; getsockopt
+    (allow socket-option-get (with telemetry))
+    (allow socket-option-get
+        (socket-option-level SOL_SOCKET)
+            (socket-option-name SO_ERROR)) ;; libwebrtc; physical_socket_server.cc, ProcessEvents.  Called with fd=-1, so it fails.  Not technically needed, but the code needs changing
+)
+
+(when (defined? 'socket-option-set)
+    ;; setsockopt
+    (allow socket-option-set (with telemetry))
 )