Changeset 285812 in webkit

Timestamp:

Nov 15, 2021, 10:49:06 AM (5 years ago)

Author:

pvollan@apple.com

Message:

[macOS][GPUP] Add telemetry for syscalls
​https://bugs.webkit.org/show_bug.cgi?id=232888
<rdar://problem/85207011>

Reviewed by Brent Fulgham.

Add more telemetry for syscalls in the GPU process' sandbox on macOS. Also add entitlement for the GPU
process to use message filtering.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• Scripts/process-entitlements.sh:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (1 diff)
• Scripts/process-entitlements.sh (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-15  Per Arne Vollan <pvollan@apple.com>
+
+        [macOS][GPUP] Add telemetry for syscalls
+        https://bugs.webkit.org/show_bug.cgi?id=232888
+        <rdar://problem/85207011>
+
+        Reviewed by Brent Fulgham.
+
+        Add more telemetry for syscalls in the GPU process' sandbox on macOS. Also add entitlement for the GPU
+        process to use message filtering.
+
+        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+        * Scripts/process-entitlements.sh:
+
 2021-11-15  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -857 +857 @@
 )
 
+(when (defined? 'mach-kernel-endpoint)
+    (allow mach-kernel-endpoint
+        (apply-message-filter
+            (allow mach-message-send (with telemetry)))))
+            
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
+    (allow syscall-mach (with telemetry))
+    (allow syscall-mach (machtrap-number
+        MSC__kernelrpc_mach_port_allocate_trap
+        MSC__kernelrpc_mach_port_construct_trap
+        MSC__kernelrpc_mach_port_deallocate_trap
+        MSC__kernelrpc_mach_port_destruct_trap
+        MSC__kernelrpc_mach_port_extract_member_trap
+        MSC__kernelrpc_mach_port_guard_trap
+        MSC__kernelrpc_mach_port_insert_member_trap
+        MSC__kernelrpc_mach_port_insert_right_trap
+        MSC__kernelrpc_mach_port_mod_refs_trap
+        MSC__kernelrpc_mach_port_request_notification_trap
+        MSC__kernelrpc_mach_port_type_trap
+        MSC__kernelrpc_mach_vm_allocate_trap
+        MSC__kernelrpc_mach_vm_deallocate_trap
+        MSC__kernelrpc_mach_vm_map_trap
+        MSC__kernelrpc_mach_vm_protect_trap
+        MSC_host_create_mach_voucher_trap
+        MSC_host_self_trap
+        MSC_mach_msg_trap
+        MSC_mach_reply_port
+        MSC_mach_voucher_extract_attr_recipe_trap
+        MSC_pid_for_task
+        MSC_semaphore_signal_trap
+        MSC_semaphore_wait_trap
+        MSC_swtch_pri
+        MSC_syscall_thread_switch
+        MSC_thread_get_special_reply_port)))
+
 (when (defined? 'syscall-unix)
     (allow syscall-unix (with telemetry))

trunk/Source/WebKit/Scripts/process-entitlements.sh

@@ -58 +58 @@
         if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
         then
+            plistbuddy Add :com.apple.private.security.message-filter bool YES
             plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
         fi