Changeset 285722 in webkit

Timestamp:

Nov 12, 2021, 8:32:32 AM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS][GPU] Remove access to IOKit classes
​https://bugs.webkit.org/show_bug.cgi?id=232344
<rdar://problem/84684751>

Reviewed by Darin Adler.

Based on telemetry, remove access to unused IOKit classes in the GPU process' sandbox on iOS.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb (modified) (5 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-12  Per Arne Vollan <pvollan@apple.com>
+
+        [iOS][GPU] Remove access to IOKit classes
+        https://bugs.webkit.org/show_bug.cgi?id=232344
+        <rdar://problem/84684751>
+
+        Reviewed by Darin Adler.
+
+        Based on telemetry, remove access to unused IOKit classes in the GPU process' sandbox on iOS.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
+
 2021-11-12  Per Arne  <pvollan@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb

@@ -65 +65 @@
                 (home-literal (string-append "/Library/Preferences/" domain ".plist")))))
         domains))
-
-(define-once (framebuffer-access)
-    (allow iokit-open (with telemetry)
-           (iokit-user-client-class "IOMobileFramebufferUserClient")
-           (when (defined? 'iokit-external-method)
-               (apply-message-filter
-                   (deny (with telemetry)
-                       iokit-async-external-method
-                       iokit-external-trap)
-                   (allow
-                       iokit-external-method)
-               )
-           )
-    )
-    (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily"))
 
 (define-once (asset-access . options)
@@ -208 +193 @@
 ;;;
 (define-once (opengl)
-    ;; Items not seen in testing
-    (deny iokit-open (with telemetry)
-           (iokit-connection "IOGPU")
-           (iokit-user-client-class
-                "AGXCommandQueue"
-                "AGXDevice"
-                "AGXSharedUserClient"
-                "IOAccelContext"
-                "IOAccelDevice"
-                "IOAccelSharedUserClient"
-                "IOAccelSubmitter2"
-                "IOAccelContext2"
-                "IOAccelDevice2"
-                "IOAccelSharedUserClient2"))
-
     (allow iokit-open (with telemetry)
            (iokit-connection "IOGPU")
@@ -306 +276 @@
     (allow iokit-open (with telemetry)
         (iokit-user-client-class "IOSurfaceAcceleratorClient")
-        (iokit-user-client-class "IOSurfaceSendRight")
         ;; Requires by UIView -> UITextMagnifierRenderer -> UIWindow
         (iokit-user-client-class "IOSurfaceRootUserClient"))
@@ -535 +504 @@
     (home-literal "/Library/Caches/DateFormats.plist")
     (with no-log))
-
-(framebuffer-access)
 
 ; <rdar://problem/7595408> , <rdar://problem/7643881>
@@ -689 +656 @@
 (deny file-write-create (vnode-type SYMLINK))
 (deny file-read-xattr file-write-xattr (xattr-prefix "com.apple.security.private."))
-
-(allow iokit-open (with telemetry)
-    (require-all
-        (extension "com.apple.webkit.extension.iokit")
-        (iokit-user-client-class
-            "AGXCommandQueue"
-            "AGXDevice"
-            "AGXSharedUserClient"
-            "IOAccelContext"
-            "IOAccelDevice"
-            "IOAccelSharedUserClient"
-            "IOAccelSubmitter2"
-            "IOAccelContext2"
-            "IOAccelDevice2"
-            "IOAccelSharedUserClient2"
-        )
-    )
-)
 
 (deny mach-lookup (with no-log)