Changeset 292146 in webkit

Timestamp:

Mar 31, 2022 1:40:01 AM (2 years ago)

Author:

pvollan@apple.com

Message:

Add runtime flag for blocking IOKit resources in the WebContent process' sandbox
​https://bugs.webkit.org/show_bug.cgi?id=238528

Reviewed by Simon Fraser.

Source/WebKit:

This flag will trigger a set of sandbox rules in the WebContent process which will block graphics
related IOKit classes and the Metal compiler service.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• WebProcess/WebPage/WebPage.cpp:

Source/WTF:

• Scripts/Preferences/WebPreferencesInternal.yaml:

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/Scripts/Preferences/WebPreferencesInternal.yaml (modified) (1 diff)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (3 diffs)
• WebKit/WebProcess/WebPage/WebPage.cpp (modified) (1 diff)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2022-03-31  Per Arne Vollan  <pvollan@apple.com>
+
+        Add runtime flag for blocking IOKit resources in the WebContent process' sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=238528
+
+        Reviewed by Simon Fraser.
+
+        * Scripts/Preferences/WebPreferencesInternal.yaml:
+
 2022-03-30  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WTF/Scripts/Preferences/WebPreferencesInternal.yaml

@@ -123 +123 @@
       default: false
 
+BlockIOKitInWebContentSandbox:
+  type: bool
+  humanReadableName: "IOKit blocking in the WebContent sandbox"
+  humanReadableDescription: "Block IOKit access in the WebContent sandbox"
+  webcoreBinding: none
+  exposed: [ WebKit ]
+  defaultValue:
+    WebKit:
+      default: false
+
 CSSDisplayContentsAXSupportEnabled:
   type: bool

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2022-03-31  Per Arne Vollan  <pvollan@apple.com>
+
+        Add runtime flag for blocking IOKit resources in the WebContent process' sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=238528
+
+        Reviewed by Simon Fraser.
+
+        This flag will trigger a set of sandbox rules in the WebContent process which will block graphics
+        related IOKit classes and the Metal compiler service.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
+        * WebProcess/WebPage/WebPage.cpp:
+
 2022-03-30  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -1043 +1043 @@
 )
 
-(allow iokit-open (with telemetry)
+(allow iokit-open (with telemetry-backtrace)
     (require-all
         (require-not (extension "com.apple.webkit.extension.iokit"))
@@ -1068 +1068 @@
 )
 
-(allow iokit-open (with report) (with telemetry)
+(allow iokit-open (with report) (with telemetry-backtrace)
     (require-all
         (require-not (extension "com.apple.webkit.extension.iokit"))
@@ -1074 +1074 @@
     )
 )
+
+#if HAVE(SANDBOX_STATE_FLAGS)
+;; This rule enables the WebContent process to enable the "BlockIOKitInWebContentSandbox" sandbox variable
+;; by reading a preference from the domain "com.apple.WebKit.WebContent.BlockIOKitInWebContentSandbox".
+(deny user-preference-read (with enable-state-flag "BlockIOKitInWebContentSandbox")
+    (preference-domain "com.apple.WebKit.WebContent.BlockIOKitInWebContentSandbox"))
+
+(with-filter (state-flag "BlockIOKitInWebContentSandbox")
+    (deny iokit-open (with telemetry-backtrace)
+        (require-all
+            (require-not (extension "com.apple.webkit.extension.iokit"))
+            (iokit-user-client-class "IOSurfaceRootUserClient")))
+    (deny iokit-open (with telemetry-backtrace)
+        (require-all
+            (require-not (extension "com.apple.webkit.extension.iokit"))
+            (iokit-connection "IOGPU")))
+    (deny mach-lookup (with telemetry-backtrace)
+        (require-all
+            (require-not (extension "com.apple.webkit.extension.mach"))
+            (xpc-service-name "com.apple.MTLCompilerService"))))
+#endif
 
 (with-filter (system-attribute apple-internal)

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -908 +908 @@
         CFPreferencesGetAppIntegerValue(CFSTR("key"), CFSTR("com.apple.WebKit.WebContent.AppCacheDisabled"), nullptr);
     }
+    if (parameters.store.getBoolValueForKey(WebPreferencesKey::blockIOKitInWebContentSandboxKey()))
+        CFPreferencesGetAppIntegerValue(CFSTR("key"), CFSTR("com.apple.WebKit.WebContent.BlockIOKitInWebContentSandbox"), nullptr);
 #endif