Changeset 285886 in webkit

Timestamp:

Nov 16, 2021, 2:46:04 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Limit graphics related IOKit method filtering
​https://bugs.webkit.org/show_bug.cgi?id=233209
<rdar://problem/85473581>

Reviewed by Brent Fulgham.

Limit graphics related IOKit method filtering based on OS version. This patch also adds an entitlement which
will enable a replacement for the disabled filtering.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• Scripts/process-entitlements.sh:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (2 diffs)
• Scripts/process-entitlements.sh (modified) (4 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-16  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Limit graphics related IOKit method filtering
+        https://bugs.webkit.org/show_bug.cgi?id=233209
+        <rdar://problem/85473581>
+
+        Reviewed by Brent Fulgham.
+
+        Limit graphics related IOKit method filtering based on OS version. This patch also adds an entitlement which
+        will enable a replacement for the disabled filtering.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
+        * Scripts/process-entitlements.sh:
+
 2021-11-16  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -262 +262 @@
                 )
                 (allow iokit-async-external-method
-#if PLATFORM(IOS)
+#if PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED < 160000
                     (iokit-method-number
                         43
@@ -270 +270 @@
                 )
                 (allow iokit-external-method
-#if PLATFORM(IOS)
+#if PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED < 160000
                     (iokit-method-number
                         0

trunk/Source/WebKit/Scripts/process-entitlements.sh

@@ -33 +33 @@
             plistbuddy add :com.apple.coreaudio.allow-vorbis-decode bool YES
         fi
+        if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 130000 ))
+        then
+            plistbuddy Add :com.apple.private.gpu-restricted bool YES
+        fi
     fi
 
@@ -60 +64 @@
             plistbuddy Add :com.apple.private.security.message-filter bool YES
             plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
+        fi
+
+        if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 130000 ))
+        then
+            plistbuddy Add :com.apple.private.gpu-restricted bool YES
         fi
 
@@ -281 +290 @@
     plistbuddy Add :com.apple.private.coremedia.extensions.audiorecording.allow bool YES
     plistbuddy Add :com.apple.private.coremedia.pidinheritance.allow bool YES
+    plistbuddy Add :com.apple.private.gpu-restricted bool YES
     plistbuddy Add :com.apple.private.memorystatus bool YES
     plistbuddy Add :com.apple.private.network.socket-delegate bool YES
@@ -309 +319 @@
     plistbuddy Add :com.apple.private.allow-explicit-graphics-priority bool YES
     plistbuddy Add :com.apple.private.coremedia.extensions.audiorecording.allow bool YES
+    plistbuddy Add :com.apple.private.gpu-restricted bool YES
     plistbuddy Add :com.apple.private.mediaexperience.startrecordinginthebackground.allow bool YES
     plistbuddy Add :com.apple.private.mediaexperience.processassertionaudittokens.allow bool YES