Changeset 286032 in webkit

Timestamp:

Nov 18, 2021, 3:01:57 PM (5 years ago)

Author:

pvollan@apple.com

Message:

Add syscall telemetry in the Networking process
​https://bugs.webkit.org/show_bug.cgi?id=233203
<rdar://problem/85504351>

Reviewed by Brent Fulgham.

Add syscall telemetry in the Networking process on macOS and iOS.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Scripts/process-entitlements.sh:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (modified) (1 diff)
• Scripts/process-entitlements.sh (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-18  Per Arne Vollan  <pvollan@apple.com>
+
+        Add syscall telemetry in the Networking process
+        https://bugs.webkit.org/show_bug.cgi?id=233203
+        <rdar://problem/85504351>
+
+        Reviewed by Brent Fulgham.
+
+        Add syscall telemetry in the Networking process on macOS and iOS.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+        * Scripts/process-entitlements.sh:
+
 2021-11-18  Per Arne  <pvollan@apple.com>
 

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -570 +570 @@
         SYS_ulock_wake
         SYS_workq_kernreturn)))
+
+#if HAVE(SANDBOX_MESSAGE_FILTERING)
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'mach-kernel-endpoint))
+    (allow mach-kernel-endpoint
+        (apply-message-filter
+            (allow mach-message-send (with telemetry)))))
+            
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
+    (allow syscall-mach (with report) (with telemetry))
+    (allow syscall-mach
+        (machtrap-number
+            MSC__kernelrpc_mach_port_allocate_trap
+            MSC__kernelrpc_mach_port_construct_trap
+            MSC__kernelrpc_mach_port_deallocate_trap
+            MSC__kernelrpc_mach_port_destruct_trap
+            MSC__kernelrpc_mach_port_extract_member_trap
+            MSC__kernelrpc_mach_port_guard_trap
+            MSC__kernelrpc_mach_port_insert_member_trap
+            MSC__kernelrpc_mach_port_mod_refs_trap
+            MSC__kernelrpc_mach_port_request_notification_trap
+            MSC__kernelrpc_mach_port_type_trap
+            MSC__kernelrpc_mach_port_unguard_trap
+            MSC__kernelrpc_mach_vm_allocate_trap
+            MSC__kernelrpc_mach_vm_deallocate_trap
+            MSC__kernelrpc_mach_vm_map_trap
+            MSC__kernelrpc_mach_vm_protect_trap
+            MSC__kernelrpc_mach_vm_purgable_control_trap
+            MSC_host_create_mach_voucher_trap
+            MSC_host_self_trap
+            MSC_mach_generate_activity_id
+            MSC_mach_msg_trap
+            MSC_mach_reply_port
+            MSC_mach_voucher_extract_attr_recipe_trap
+            MSC_mk_timer_arm
+            MSC_mk_timer_cancel
+            MSC_mk_timer_create
+            MSC_semaphore_signal_trap
+            MSC_semaphore_wait_trap
+            MSC_swtch_pri
+            MSC_syscall_thread_switch
+            MSC_task_self_trap
+            MSC_thread_get_special_reply_port)))
+#endif // HAVE(SANDBOX_MESSAGE_FILTERING)

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

@@ -737 +737 @@
         SYS_write_nocancel
         SYS_writev)))
+
+(when (defined? 'syscall-mach)
+    (allow syscall-mach (with report) (with telemetry))
+    (allow syscall-mach
+        (machtrap-number
+            MSC__kernelrpc_mach_port_allocate_trap
+            MSC__kernelrpc_mach_port_construct_trap
+            MSC__kernelrpc_mach_port_deallocate_trap
+            MSC__kernelrpc_mach_port_destruct_trap
+            MSC__kernelrpc_mach_port_extract_member_trap
+            MSC__kernelrpc_mach_port_guard_trap
+            MSC__kernelrpc_mach_port_insert_member_trap
+            MSC__kernelrpc_mach_port_insert_right_trap
+            MSC__kernelrpc_mach_port_mod_refs_trap
+            MSC__kernelrpc_mach_port_request_notification_trap
+            MSC__kernelrpc_mach_port_type_trap
+            MSC__kernelrpc_mach_port_unguard_trap
+            MSC__kernelrpc_mach_vm_allocate_trap
+            MSC__kernelrpc_mach_vm_deallocate_trap
+            MSC__kernelrpc_mach_vm_map_trap
+            MSC__kernelrpc_mach_vm_protect_trap
+            MSC__kernelrpc_mach_vm_purgable_control_trap
+            MSC_host_create_mach_voucher_trap
+            MSC_host_self_trap
+            MSC_mach_generate_activity_id
+            MSC_mach_msg_trap
+            MSC_mach_reply_port
+            MSC_mach_timebase_info_trap
+            MSC_mach_voucher_extract_attr_recipe_trap
+            MSC_mk_timer_arm
+            MSC_mk_timer_cancel
+            MSC_mk_timer_create
+            MSC_mk_timer_destroy
+            MSC_semaphore_signal_trap
+            MSC_semaphore_wait_trap
+            MSC_syscall_thread_switch
+            MSC_task_self_trap
+            MSC_thread_get_special_reply_port)))
+
+(when (defined? 'mach-kernel-endpoint)
+    (allow mach-kernel-endpoint
+        (apply-message-filter
+            (allow mach-message-send (with report) (with telemetry)))))

trunk/Source/WebKit/Scripts/process-entitlements.sh

@@ -115 +115 @@
         if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
         then
+            plistbuddy Add :com.apple.private.security.message-filter bool YES
             plistbuddy Add :com.apple.private.tcc.manager.check-by-audit-token array
             plistbuddy Add :com.apple.private.tcc.manager.check-by-audit-token:0 string kTCCServiceWebKitIntelligentTrackingPrevention
@@ -326 +327 @@
     plistbuddy Add :com.apple.private.memory.ownership_transfer bool YES
     plistbuddy Add :com.apple.private.network.socket-delegate bool YES
+    plistbuddy Add :com.apple.private.security.message-filter bool YES
     plistbuddy Add :com.apple.private.webkit.use-xpc-endpoint bool YES
     plistbuddy Add :com.apple.runningboard.assertions.webkit bool YES
@@ -407 +409 @@
     plistbuddy Add :com.apple.private.network.socket-delegate bool YES
     plistbuddy Add :com.apple.private.webkit.use-xpc-endpoint bool YES
+    plistbuddy Add :com.apple.private.security.message-filter bool YES
     plistbuddy Add :com.apple.runningboard.assertions.webkit bool YES