Changeset 283323 in webkit

Timestamp:

Sep 30, 2021, 12:53:27 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[macOS] Reduce sandbox telemetry
​https://bugs.webkit.org/show_bug.cgi?id=231026
<rdar://83694937>

Reviewed by Brent Fulgham.

Remove sandbox telemetry for resources that we already see are in use.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (11 diffs)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-09-30  Per Arne  <pvollan@apple.com>
+
+        [macOS] Reduce sandbox telemetry
+        https://bugs.webkit.org/show_bug.cgi?id=231026
+        <rdar://83694937>
+
+        Reviewed by Brent Fulgham.
+
+        Remove sandbox telemetry for resources that we already see are in use.
+
+        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+
 2021-09-30  Eddy Wong  <eddy_wong@apple.com>
 

trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -26 +26 @@
 (deny nvram*)
 (deny system-privilege)
-(allow system-audit file-read-metadata (with telemetry))
+(allow system-audit file-read-metadata)
 
 ;; Silence spurious logging due to rdar://20117923 and rdar://72366475
@@ -42 +42 @@
 
 ;;; Allow read access to standard system paths.
+(allow file-read*
+    (require-all
+        (file-mode #o0004)
+        (subpath "/System")))
+
 (allow file-read* (with telemetry)
     (require-all (file-mode #o0004)
@@ -47 +52 @@
     (subpath "/Library/Apple/System")
     (subpath "/Library/Preferences/Logging")      ; Logging Rethink
-    (subpath "/System")
     (subpath "/private/var/db/dyld")
     (subpath "/private/var/db/timezone")
@@ -69 +73 @@
 )
 
+(allow file-read-metadata
+    (literal "/var"))
 (allow file-read-metadata (with telemetry)
     (literal "/etc")
     (literal "/tmp")
-    (literal "/var")
     (literal "/private/etc/localtime"))
 
@@ -90 +95 @@
 
 (allow file-read*
-       file-write-data
+    (literal "/dev/dtracehelper"))
+(allow file-write-data
        file-ioctl (with telemetry)
     (literal "/dev/dtracehelper"))
@@ -512 +518 @@
     (if path
         (begin
-            (allow file-read* (with telemetry) (subpath path))
+            (allow file-read* (subpath path))
             (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") (subpath path))))))
 
@@ -662 +668 @@
     (ipc-posix-name-regex #"^AudioIO"))
 
+(allow mach-lookup
+    (global-name "com.apple.audio.AudioComponentRegistrar"))
+
+#if !ENABLE(CFPREFS_DIRECT_MODE)
 (allow mach-lookup (with telemetry)
-    (global-name "com.apple.audio.AudioComponentRegistrar")
-#if !ENABLE(CFPREFS_DIRECT_MODE)
     (global-name "com.apple.cfprefsd.agent")
-#endif
-)
+)
+#endif
 
 (with-filter (system-attribute apple-internal)
@@ -681 +689 @@
 
 ;; Various services required by AppKit and other frameworks
+(allow mach-lookup
+       (global-name "com.apple.audio.audiohald")
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(MACCATALYST)
+       (global-name "com.apple.CARenderServer") ; Needed for [CAContext remoteContextWithOptions]
+#else
+       (global-name "com.apple.windowserver.active")
+#endif
+       (global-name "com.apple.lsd.mapdb")
+       (global-name "com.apple.fonts")
+       (global-name "com.apple.PowerManagement.control")
+       (global-name "com.apple.trustd.agent")
+       (global-name "com.apple.logd.events"))
+
 (allow mach-lookup (with telemetry)
 #if __MAC_OS_X_VERSION_MIN_REQUIRED < 101400
        (global-name "com.apple.FontObjectsServer")
 #endif
-       (global-name "com.apple.PowerManagement.control")
        (global-name "com.apple.SystemConfiguration.configd")
        (global-name "com.apple.assertiond.processassertionconnection")
        (global-name "com.apple.audio.toolbox.reporting.service")
        (global-name "com.apple.audio.SystemSoundServer-OSX")
-       (global-name "com.apple.audio.audiohald")
 #if !ENABLE(CFPREFS_DIRECT_MODE)
        (global-name "com.apple.cfprefsd.daemon")
 #endif
        (global-name "com.apple.coreservices.launchservicesd")
-       (global-name "com.apple.fonts")
        (global-name "com.apple.mediaremoted.xpc")
        (global-name "com.apple.logd")
-       (global-name "com.apple.logd.events")
-       (global-name "com.apple.lsd.mapdb")
        (global-name "com.apple.lskdd") ;; <rdar://problem/49123855>
        (global-name "com.apple.tccd")
        (global-name "com.apple.tccd.system")
-       (global-name "com.apple.trustd.agent")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(MACCATALYST)
-       (global-name "com.apple.CARenderServer") ; Needed for [CAContext remoteContextWithOptions]
-#else
-       (global-name "com.apple.windowserver.active")
-#endif
 )
 
@@ -779 +789 @@
 #if PLATFORM(MAC)
 ;; FIXME should be removed when <rdar://problem/9347205> + related radar in Safari is fixed
+(allow mach-lookup
+       (global-name "com.apple.system.logger"))
 (allow mach-lookup (with telemetry)
-       (global-name "com.apple.system.logger")
        (global-name "com.apple.system.notification_center"))
 #endif
@@ -818 +829 @@
 
 ;; AirPlay
+(allow mach-lookup
+    (global-name "com.apple.coremedia.routingcontext.xpc"))
 (allow mach-lookup (with telemetry)
     (global-name "com.apple.coremedia.endpoint.xpc")
@@ -826 +839 @@
     (global-name "com.apple.coremedia.endpointremotecontrolsession.xpc")
     (global-name "com.apple.coremedia.routediscoverer.xpc")
-    (global-name "com.apple.coremedia.routingcontext.xpc")
     (global-name "com.apple.coremedia.volumecontroller.xpc")
 )

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -63 +63 @@
 )
 
+(allow file-read-metadata
+       (literal "/var"))
 (allow file-read-metadata (with telemetry)
        (literal "/etc")
        (literal "/tmp")
-       (literal "/var")
        (literal "/private/etc/localtime"))
 
 (allow file-read-metadata (with telemetry) (path-ancestors "/System/Volumes/Data/private"))
 
-(allow file-read* (with telemetry) (literal "/"))
+(allow file-read* (literal "/"))
+
+(allow file-read*
+       (subpath "/System"))
 
 (allow file-read* (with telemetry)
@@ -77 +81 @@
        (subpath "/Library/Filesystems/NetFSPlugins")
        (subpath "/Library/Preferences/Logging")      ; Logging Rethink
-       (subpath "/System")
        (subpath "/private/var/db/dyld")
        (subpath "/private/var/db/timezone")