Changeset 285735 in webkit

Timestamp:

Nov 12, 2021, 12:09:11 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[macOS][GPUP] Block access to mach register
​https://bugs.webkit.org/show_bug.cgi?id=232259
<rdar://problem/84624488>

Reviewed by Brent Fulgham.

Based on telemetry, block access to mach register in the GPU process on macOS.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-12  Per Arne  <pvollan@apple.com>
+
+        [macOS][GPUP] Block access to mach register
+        https://bugs.webkit.org/show_bug.cgi?id=232259
+        <rdar://problem/84624488>
+
+        Reviewed by Brent Fulgham.
+
+        Based on telemetry, block access to mach register in the GPU process on macOS.
+
+        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+
 2021-11-12  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -37 +37 @@
 ;;; remove unneeded sandbox extensions.
 ;;;
-
-;;; Allow registration of per-pid services.
-(allow mach-register (with telemetry) (local-name-prefix ""))
 
 ;;; Allow read access to standard system paths.
@@ -603 +600 @@
 
 ;; Allow the OpenGL Profiler to attach.
-(allow mach-register (with telemetry) (global-name-regex #"^_oglprof_attach_<[0-9]+>$"))
+(with-filter (system-attribute apple-internal)
+    (allow mach-register (with telemetry) (global-name-regex #"^_oglprof_attach_<[0-9]+>$")))
 
 (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))