Changeset 276515 in webkit

Timestamp:

Apr 23, 2021, 1:11:39 PM (5 years ago)

Author:

Brent Fulgham

Message:

[iOS] GPU Process sandbox lacks IOMobileFramebufferUserClient method filter
​https://bugs.webkit.org/show_bug.cgi?id=224956
<rdar://problem/68227590>

Reviewed by Per Arne Vollan.

This patch updates the GPU process sandbox to match the method filter used in the WebContent process
so that we will retain consistent protections when activating the GPU Process. These are the same rules
governing access to this resource when the GPU process is disabled, so should not create a change in behavior.

We also remove unneeded telemetry to reduce messaging burden and avoid performance issues.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-04-23  Brent Fulgham  <bfulgham@apple.com>
+
+        [iOS] GPU Process sandbox lacks IOMobileFramebufferUserClient method filter
+        https://bugs.webkit.org/show_bug.cgi?id=224956
+        <rdar://problem/68227590>
+
+        Reviewed by Per Arne Vollan.
+
+        This patch updates the GPU process sandbox to match the method filter used in the WebContent process
+        so that we will retain consistent protections when activating the GPU Process. These are the same rules
+        governing access to this resource when the GPU process is disabled, so should not create a change in behavior.
+
+        We also remove unneeded telemetry to reduce messaging burden and avoid performance issues.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2021-04-23  BJ Burg  <bburg@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb

@@ -88 +88 @@
 (define-once (framebuffer-access)
     (allow iokit-open
-           (iokit-user-client-class "IOMobileFramebufferUserClient"))
+           (iokit-user-client-class "IOMobileFramebufferUserClient")
+           (when (defined? 'iokit-external-method)
+               (apply-message-filter
+                   (deny (with telemetry)
+                       iokit-async-external-method
+                       iokit-external-trap)
+                   (allow
+                       iokit-external-method)
+               )
+           )
+    )
     (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily"))
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -97 +97 @@
                     iokit-async-external-method
                     iokit-external-trap)
-                (allow (with telemetry) (with message "IOMobileFramebufferUserClient")
+                (allow
                     iokit-external-method)
             )