Changeset 285969 in webkit

Timestamp:

Nov 17, 2021, 6:29:44 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r285869. rdar://problem/85529891

[macOS][GPUP] Add telemetry for syscalls
​https://bugs.webkit.org/show_bug.cgi?id=232888
<rdar://problem/85207011>

Reviewed by Brent Fulgham.

Add more telemetry for syscalls in the GPU process' sandbox on macOS. Also add entitlement for the GPU
process to use message filtering.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• Scripts/process-entitlements.sh:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@285869 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-613.1.9-branch/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (1 diff)
• Scripts/process-entitlements.sh (modified) (1 diff)

branches/safari-613.1.9-branch/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-17  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r285869. rdar://problem/85529891
+
+    [macOS][GPUP] Add telemetry for syscalls
+    https://bugs.webkit.org/show_bug.cgi?id=232888
+    <rdar://problem/85207011>
+    
+    Reviewed by Brent Fulgham.
+    
+    Add more telemetry for syscalls in the GPU process' sandbox on macOS. Also add entitlement for the GPU
+    process to use message filtering.
+    
+    * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+    * Scripts/process-entitlements.sh:
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@285869 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-11-16  Per Arne Vollan <pvollan@apple.com>
+
+            [macOS][GPUP] Add telemetry for syscalls
+            https://bugs.webkit.org/show_bug.cgi?id=232888
+            <rdar://problem/85207011>
+
+            Reviewed by Brent Fulgham.
+
+            Add more telemetry for syscalls in the GPU process' sandbox on macOS. Also add entitlement for the GPU
+            process to use message filtering.
+
+            * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+            * Scripts/process-entitlements.sh:
+
 2021-11-17  Alan Coon  <alancoon@apple.com>
 

branches/safari-613.1.9-branch/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -857 +857 @@
 )
 
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'mach-kernel-endpoint))
+    (allow mach-kernel-endpoint
+        (apply-message-filter
+            (allow mach-message-send (with telemetry)))))
+            
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
+    (allow syscall-mach (with telemetry))
+    (allow syscall-mach (machtrap-number
+        MSC__kernelrpc_mach_port_allocate_trap
+        MSC__kernelrpc_mach_port_construct_trap
+        MSC__kernelrpc_mach_port_deallocate_trap
+        MSC__kernelrpc_mach_port_destruct_trap
+        MSC__kernelrpc_mach_port_extract_member_trap
+        MSC__kernelrpc_mach_port_guard_trap
+        MSC__kernelrpc_mach_port_insert_member_trap
+        MSC__kernelrpc_mach_port_insert_right_trap
+        MSC__kernelrpc_mach_port_mod_refs_trap
+        MSC__kernelrpc_mach_port_request_notification_trap
+        MSC__kernelrpc_mach_port_type_trap
+        MSC__kernelrpc_mach_vm_allocate_trap
+        MSC__kernelrpc_mach_vm_deallocate_trap
+        MSC__kernelrpc_mach_vm_map_trap
+        MSC__kernelrpc_mach_vm_protect_trap
+        MSC_host_create_mach_voucher_trap
+        MSC_host_self_trap
+        MSC_mach_msg_trap
+        MSC_mach_reply_port
+        MSC_mach_voucher_extract_attr_recipe_trap
+        MSC_pid_for_task
+        MSC_semaphore_signal_trap
+        MSC_semaphore_wait_trap
+        MSC_swtch_pri
+        MSC_syscall_thread_switch
+        MSC_thread_get_special_reply_port)))
+
 (when (defined? 'syscall-unix)
     (allow syscall-unix (with telemetry))

branches/safari-613.1.9-branch/Source/WebKit/Scripts/process-entitlements.sh

@@ -62 +62 @@
         if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
         then
+            plistbuddy Add :com.apple.private.security.message-filter bool YES
             plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
         fi