Changeset 286557 in webkit

Timestamp:

Dec 6, 2021, 11:45:31 AM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS][WP] Block access to unused IOKit class
​https://bugs.webkit.org/show_bug.cgi?id=233866
<rdar://problem/86086475>

Reviewed by Brent Fulgham.

Block access to IOKit class IOMobileFramebufferUserClient in the WebContent process' sandbox on iOS,
which is unused according to telemetry.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• UIProcess/WebPageProxy.cpp:

(WebKit::gpuIOKitClasses):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-12-06  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS][WP] Block access to unused IOKit class
+        https://bugs.webkit.org/show_bug.cgi?id=233866
+        <rdar://problem/86086475>
+
+        Reviewed by Brent Fulgham.
+
+        Block access to IOKit class IOMobileFramebufferUserClient in the WebContent process' sandbox on iOS,
+        which is unused according to telemetry.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::gpuIOKitClasses):
+
 2021-12-06  Matt Gilligan  <matthew_gilligan@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -93 +93 @@
 
 (define-once (framebuffer-access)
-    (allow iokit-open
-        (require-all
-            (extension "com.apple.webkit.extension.iokit")
-            (iokit-user-client-class "IOMobileFramebufferUserClient")
-        )
-        (when (defined? 'iokit-external-method)
-            (apply-message-filter
-                (deny (with telemetry)
-                    iokit-async-external-method
-                    iokit-external-method
-                    iokit-external-trap)
-                (allow (with telemetry) iokit-external-method
-                    (iokit-method-number
-                        8
-                        28
-                    )
-                )
-            )
-        )
-    )
+    (deny iokit-open (with telemetry-backtrace)
+        (iokit-user-client-class "IOMobileFramebufferUserClient"))
 
     ; IOMobileFramebuffer
     (with-filter (iokit-registry-entry-class "IOMobileFramebuffer")
-        (allow iokit-get-properties
+        (allow iokit-get-properties (with telemetry)
                (iokit-property "AppleTV"
                                "DisplayPipePlaneBaseAlignment"

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -8053 +8053 @@
         "IOSurfaceRootUserClient"_s,
 #endif
-#if (PLATFORM(MAC) && CPU(ARM64)) || PLATFORM(IOS_FAMILY)
+#if PLATFORM(MAC) && CPU(ARM64)
         "IOMobileFramebufferUserClient"_s,
+#endif
+#if PLATFORM(MAC) && CPU(ARM64) || PLATFORM(IOS_FAMILY)
         "IOSurfaceAcceleratorClient"_s,
 #endif