⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 277400 in webkit


Ignore:
Timestamp:
May 12, 2021, 3:59:16 PM (5 years ago)
Author:
Brent Fulgham
Message:

[Cocoa] Silence uninteresting sandbox reports
​https://bugs.webkit.org/show_bug.cgi?id=225713
<rdar://problem/77483132>

Reviewed by Per Arne Vollan.

Telemetry from the recently released iOS and macOS updates show a set of uninteresting sandbox violations. Most of
these are harmless, but all of them involve some runtime cost and may prevent code from making the best use of
available hardware and should be permitted.

These changes also bring the various sandboxes into better alignment, as many of these items had previously been
added to one of the other sandboxes.

  • GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
  • NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
  • Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
  • Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
  • Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
  • Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
  • WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:
  • WebProcess/com.apple.WebProcess.sb.in:
Location:
trunk/Source/WebKit
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r277389 r277400  
     12021-05-12  Brent Fulgham  <bfulgham@apple.com>
     2
     3        [Cocoa] Silence uninteresting sandbox reports
     4        https://bugs.webkit.org/show_bug.cgi?id=225713
     5        <rdar://problem/77483132>
     6
     7        Reviewed by Per Arne Vollan.
     8
     9        Telemetry from the recently released iOS and macOS updates show a set of uninteresting sandbox violations. Most of
     10        these are harmless, but all of them involve some runtime cost and may prevent code from making the best use of
     11        available hardware and should be permitted.
     12
     13        These changes also bring the various sandboxes into better alignment, as many of these items had previously been
     14        added to one of the other sandboxes.
     15
     16        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
     17        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
     18        * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
     19        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
     20        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
     21        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
     22        * WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:
     23        * WebProcess/com.apple.WebProcess.sb.in:
     24
    1252021-05-12  Wenson Hsieh  <wenson_hsieh@apple.com>
    226

  • trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

    r277217 r277400  
    153153;;; process-info* defaults to allow; deny it and then allow operations we actually need.
    154154(deny process-info*)
     155(allow process-info-dirtycontrol (target self))
    155156(allow process-info-pidinfo)
    156157(allow process-info-setcontrol (target self))
    … …  
    162163        "hw.byteorder"
    163164        "hw.busfrequency_max"
     165        "hw.cputhreadtype"
    164166        "hw.cputype"
    165167        "hw.machine"
    … …  
    373375    (iokit-property "graphic-options")
    374376    (iokit-property "hda-gfx")
     377    (iokit-property "housing-color")
    375378    (iokit-property-regex #"^id(Product|Vendor)")
    376379    (iokit-property "iofb_version")

  • trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

    r277309 r277400  
    166166;;; process-info* defaults to allow; deny it and then allow operations we actually need.
    167167(deny process-info*)
     168(allow process-info-dirtycontrol (target self))
    168169(allow process-info-pidinfo)
    169170(allow process-info-setcontrol (target self))
    … …  
    173174    (sysctl-name
    174175        "hw.availcpu"
     176        "hw.cputhreadtype"
    175177        "hw.ncpu"
    176178        "hw.memsize"
    … …  
    182184        "kern.osversion" ;; Needed by WebKit and ASL logging.
    183185        "kern.tcsm_available" ;; Needed for IndexedDB support.
     186        "kern.tcsm_enable"
    184187        "kern.ostype"
    185188        "kern.version"
    … …  
    190193)
    191194
     195(allow sysctl-write
     196    (sysctl-name
     197        "kern.tcsm_enable"))
     198
    192199(deny iokit-get-properties)
    193200(allow iokit-get-properties
    … …  
    196203        "IOClassNameOverride"
    197204        "IOMediaIcon"
     205        "IOServiceDEXTEntitlements"
     206        "No-idle-support"
    198207        "Product Identification"
    199208        "Protocol Characteristics"
    200209        "Removable"
     210        "acpi-pmcap-offset"
     211        "driver-child-bundle"
     212        "iommu-selection"
    201213    )
    202214)

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb

    r277208 r277400  
    800800        "hw.availcpu"
    801801        "hw.cachelinesize"
     802        "hw.cputhreadtype"
    802803        "hw.cputype"
    803804        "hw.l2cachesize"

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

    r277309 r277400  
    432432    (sysctl-name "hw.cpufrequency_max")
    433433    (sysctl-name "hw.cpusubtype")
     434    (sysctl-name "hw.cputhreadtype")
    434435    (sysctl-name "hw.cputype")
    435436    (sysctl-name "hw.l1dcachesize")

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb

    r277032 r277400  
    478478        "hw.availcpu"
    479479        "hw.cachelinesize"
     480        "hw.cputhreadtype"
    480481        "hw.cputype"
    481482        "hw.l2cachesize"

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

    r277218 r277400  
    926926        "hw.cachelinesize_compat"
    927927        "hw.cpufamily" ;; <rdar://problem/58416475>
     928        "hw.cputhreadtype"
    928929        "hw.cputype"
    929930        "hw.l2cachesize"

  • trunk/Source/WebKit/WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in

    r277331 r277400  
    103103;;; process-info* defaults to allow; deny it and then allow operations we actually need.
    104104(deny process-info*)
     105(allow process-info-dirtycontrol (target self))
    105106(allow process-info-pidinfo)
    106107(allow process-info-setcontrol (target self))
    … …  
    112113        "hw.byteorder"
    113114        "hw.busfrequency_max"
     115        "hw.cputhreadtype"
    114116        "hw.cputype"
    115117        "hw.machine"

  • trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

    r277331 r277400  
    779779    (iokit-property "graphic-options")
    780780    (iokit-property "hda-gfx")
     781    (iokit-property "housing-color")
    781782    (iokit-property-regex #"^id(Product|Vendor)")
    782783    (iokit-property "iofb_version")
Note: See TracChangeset for help on using the changeset viewer.