Changeset 274266 in webkit

Timestamp:

Mar 10, 2021, 7:48:55 PM (6 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r274231. rdar://problem/75290553

[iOS] Add additional telemetry to WebContent sandbox
​https://bugs.webkit.org/show_bug.cgi?id=223035
<rdar://75275161>

Reviewed by Geoffrey Garen.

Add additional telemetry to WebContent sandbox on iOS.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@274231 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-611.1.21.1-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (11 diffs)

branches/safari-611.1.21.1-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-10  Russell Epstein  <repstein@apple.com>
+
+        Cherry-pick r274231. rdar://problem/75290553
+
+    [iOS] Add additional telemetry to WebContent sandbox 
+    https://bugs.webkit.org/show_bug.cgi?id=223035
+    <rdar://75275161>
+    
+    Reviewed by Geoffrey Garen.
+    
+    Add additional telemetry to WebContent sandbox on iOS.
+    
+    * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@274231 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-03-10  Per Arne  <pvollan@apple.com>
+
+            [iOS] Add additional telemetry to WebContent sandbox
+            https://bugs.webkit.org/show_bug.cgi?id=223035
+            <rdar://75275161>
+
+            Reviewed by Geoffrey Garen.
+
+            Add additional telemetry to WebContent sandbox on iOS.
+
+            * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2021-03-08  Russell Epstein  <repstein@apple.com>
 

branches/safari-611.1.21.1-branch/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -504 +504 @@
     (mobile-preferences-read "kCFPreferencesAnyApplication")
     (allow file-read*
-           (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist"))
+           (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist")
+           (front-user-home-literal "/Library/Preferences/.GlobalPreferences_m.plist"))
 
     (allow file-read*
@@ -582 +583 @@
     (literal "/"))
 
+(deny file-read* (with no-report)
+      (literal "/private/etc/passwd"))
+
 (allow file-read*
        (subpath "/private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs"))
@@ -603 +607 @@
        (ipc-posix-name-prefix "apple.cfprefs."))
  
-(deny mach-lookup
-    (global-name "com.apple.lsd.mapdb"))
+(deny mach-lookup (with no-report)
+    (global-name "com.apple.lsd.mapdb")) 
 
 ;; <rdar://problem/12413942>
@@ -670 +674 @@
 (allow process-info-dirtycontrol (target self))
 (allow process-info-rusage (target self))
-(allow process-info-codesignature (target self))
 
 ;;;
@@ -1127 +1130 @@
         (syscall-number SYS_sigprocmask)
         (syscall-number SYS_sigaltstack)
-        (syscall-number SYS_ioctl)
+        (syscall-number SYS_ioctl) ;; needed by tcgetattr (TIOCGETA) - debugging
         (syscall-number SYS_readlink)
         (syscall-number SYS_umask)
@@ -1143 +1146 @@
         (syscall-number SYS_gettimeofday)
         (syscall-number SYS_getrusage)
-        (syscall-number SYS_getsockopt)
+        (syscall-number SYS_getsockopt) ;; used by libwebrtc
         (syscall-number SYS_writev)
         (syscall-number SYS_fchmod)
@@ -1155 +1158 @@
         (syscall-number SYS_pread)
         (syscall-number SYS_pwrite)
-        (syscall-number SYS_csops)
-        (syscall-number SYS_csops_audittoken)
+        (syscall-number SYS_csops) ;; used by Corefoundation initialization
+        (syscall-number SYS_csops_audittoken) ;; used by WK to get entitlments
         (syscall-number SYS_kdebug_trace64)
         (syscall-number SYS_kdebug_trace)
@@ -1169 +1172 @@
         (syscall-number SYS_mlock)
         (syscall-number SYS_munlock)
-        (syscall-number SYS_getattrlist)
+        (syscall-number SYS_getattrlist) ;; xpc_realpath and directory enumeration
         (syscall-number SYS_getxattr)
         (syscall-number SYS_fgetxattr)
@@ -1225 +1228 @@
         (syscall-number SYS_proc_rlimit_control)
         (syscall-number SYS_connectx)
-        (syscall-number SYS_getattrlistbulk)
+        (syscall-number SYS_getattrlistbulk) ;; xpc_realpath and directory enumeration
         (syscall-number SYS_openat)
         (syscall-number SYS_openat_nocancel)
@@ -1249 +1252 @@
         (syscall-number SYS_sem_open)
         (syscall-number SYS_sem_close)
-        (syscall-number SYS_fsetattrlist)
+        (syscall-number SYS_fsetattrlist) ;; MTLCompilerFSCache::openSync
         (syscall-number SYS_guarded_open_dprotected_np) ; <rdar://problem/48166729>
         (syscall-number SYS_mremap_encrypted)
@@ -1274 +1277 @@
     (if (defined? 'SYS_objc_bp_assist_cfg_np)
         (allow syscall-unix (syscall-number SYS_objc_bp_assist_cfg_np)))
+)
+
+(when (defined? 'file-ioctl)
+    (allow file-ioctl (with telemetry))
+    ;; restrict to the two ioctl's /dev/aes_0 needs
+    (allow file-ioctl (with telemetry)
+       (ioctl-command (_IO "T" 101)) ;; IOAES_GET_INFO
+       (ioctl-command (_IO "T" 102))) ;; IOAES_ENCRYPT_DECRYPT
+)
+
+(when (defined? 'socket-ioctl)
+    (allow socket-ioctl (with telemetry))
+)
+
+(when (defined? 'system-fcntl)
+    (allow system-fcntl (with telemetry))
+    (allow system-fcntl
+        (fcntl-command F_GETPATH) ;; used by dyld4 and CGFontURLCreate, getcwd (at least)
+        (fcntl-command F_ADDFILESIGS_RETURN) ;; ImageLoaderMachO::loadCodeSignature
+        (fcntl-command F_CHECK_LV) ;; ImageLoaderMachO::loadCodeSignature
+        (fcntl-command F_SPECULATIVE_READ) ;; ImageLoaderMachO::mapSegments
+        (fcntl-command F_SETFD) ;; libwebrtc.dylib (no backtrace)
+        (fcntl-command F_GETFD) ;; libwebrtc.dylib (no backtrace)
+
+        (fcntl-command F_SETFL) ;; CMCapture uses when camera is enabled
+        (fcntl-command F_SETNOSIGPIPE)) ;; CMCapture uses when camera is enabled
+
+    (allow system-fcntl
+        (fcntl-command F_GETPROTECTIONCLASS))
+)
+
+(when (defined? 'process-codesigning*)
+    ;; csops/csops_audittoken
+    (allow process-codesigning-status-set (with telemetry))
+    (allow process-codesigning-text-offset-get (with telemetry))
+    (allow process-codesigning-cdhash-get (with telemetry))
+    (allow process-codesigning-blob-get (with telemetry))
+    (allow process-codesigning-teamid-get (with telemetry))
+    (allow process-codesigning-identity-get (with telemetry)) ;; codeSigningIdentifierForCurrentProcess
+    (allow process-codesigning-entitlements-blob-get) ;; WK reading entitlments via SecTaskCopyValueForEntitlement and _getSelfParsedEntitlements (accessibility)
+    (allow process-codesigning-status-get) ;; _xpc_get_entitlements
+    (deny process-info-codesignature (with no-report)) ;; SecTaskCopyValueForEntitlement - granting this grants all the process-codesign-* checks
+)
+
+(when (not (defined? 'process-codesigning*))
+    (allow process-info-codesignature (target self))
+)
+
+(when (defined? 'socket-option-get)
+    ;; getsockopt
+    (allow socket-option-get (with telemetry))
+    (allow socket-option-get
+        (socket-option-level SOL_SOCKET)
+            (socket-option-name SO_ERROR)) ;; libwebrtc; physical_socket_server.cc, ProcessEvents.  Called with fd=-1, so it fails.  Not technically needed, but the code needs changing
+)
+
+(when (defined? 'socket-option-set)
+    ;; setsockopt
+    (allow socket-option-set (with telemetry))
 )