Changeset 292957 in webkit


Ignore:
Timestamp:
Apr 18, 2022 9:46:04 AM (2 years ago)
Author:
pvollan@apple.com
Message:

Block system calls in the Network process
​https://bugs.webkit.org/show_bug.cgi?id=238935
<rdar://47323426>

Reviewed by Geoffrey Garen.

Block unused system calls in the Network process on macOS and iOS. This is based on collected telemetry.

  • NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
  • Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb.in:
Location:
trunk/Source/WebKit
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r292956 r292957  
     12022-04-18  Per Arne Vollan  <pvollan@apple.com>
     2
     3        Block system calls in the Network process
     4        https://bugs.webkit.org/show_bug.cgi?id=238935
     5        <rdar://47323426>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        Block unused system calls in the Network process on macOS and iOS. This is based on collected telemetry.
     10
     11        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
     12        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb.in:
     13
    1142022-04-18  Wenson Hsieh  <wenson_hsieh@apple.com>
    215

  • trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

    r292928 r292957  
    475475
    476476(when (defined? 'syscall-unix)
    477     (allow syscall-unix (with telemetry))
     477    (deny syscall-unix (with telemetry))
    478478    (allow syscall-unix (syscall-number
    479479        SYS___channel_get_info
    … …  
    482482        SYS___disable_threadsignal
    483483        SYS___mac_syscall
     484        SYS___pthread_kill
    484485        SYS___pthread_sigmask
    485486        SYS___semwait_signal
     487        SYS___semwait_signal_nocancel
     488        SYS_abort_with_payload
    486489        SYS_access
    487490        SYS_bsdthread_create
    … …  
    489492        SYS_bsdthread_terminate
    490493        SYS_change_fdguard_np
     494        SYS_close
     495        SYS_close_nocancel
     496        SYS_csops_audittoken
    491497        SYS_csrctl
    492498        SYS_dup
    … …  
    494500        SYS_fcntl
    495501        SYS_fcntl_nocancel
     502        SYS_ffsctl
    496503        SYS_fgetattrlist
     504        SYS_fgetxattr
    497505        SYS_fileport_makeport
     506        SYS_flistxattr
    498507        SYS_flock
     508        SYS_fsetattrlist
    499509        SYS_fsgetpath
    500510        SYS_fstat
    501511        SYS_fstat64
     512        SYS_fstat64_extended
    502513        SYS_fstatat
    503514        SYS_fstatat64
    … …  
    507518        SYS_ftruncate
    508519        SYS_getattrlist
     520        SYS_getattrlistbulk
    509521        SYS_getaudit_addr
    510522        SYS_getdirentries
    … …  
    517529        SYS_getgid
    518530        SYS_getgroups
     531        SYS_gethostuuid
    519532        SYS_getpeername
    520533        SYS_getrlimit
    … …  
    531544        SYS_iopolicysys
    532545        SYS_issetugid
     546        SYS_kdebug_trace
    533547        SYS_kdebug_trace64
    534548        SYS_kdebug_trace_string
    … …  
    553567        SYS_necp_client_action
    554568        SYS_necp_open
     569        SYS_open
    555570        SYS_open_dprotected_np
     571        SYS_open_nocancel
     572        SYS_openat
     573        SYS_os_fault_with_payload
    556574        SYS_pathconf
    557575        SYS_pipe
    558576        SYS_pread
    559577        SYS_pread_nocancel
     578        SYS_proc_info
    560579        SYS_pselect
    561580        SYS_psynch_cvbroad
    … …  
    586605        SYS_setsockopt
    587606        SYS_shutdown
     607        SYS_sigaction
    588608        SYS_sigaltstack
     609        SYS_sigprocmask
     610        SYS_sigreturn
    589611        SYS_socketpair
    590612        SYS_stat
    … …  
    593615        SYS_statfs
    594616        SYS_statfs64
     617        SYS_sysctl
    595618        SYS_thread_selfid
    596619        SYS_ulock_wait
    597620        SYS_ulock_wake
    598         SYS_workq_kernreturn)))
     621        SYS_unlink
     622        SYS_workq_kernreturn
     623        SYS_write
     624        SYS_write_nocancel)))
    599625
    600626(when (defined? 'SYS__map_with_linking_np)
    … …  
    608634           
    609635(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
    610     (allow syscall-mach (with report) (with telemetry))
     636    (deny syscall-mach (with telemetry))
    611637    (allow syscall-mach
    612638        (machtrap-number
    … …  
    632658            MSC_mach_generate_activity_id
    633659            MSC_mach_msg_trap
     660            MSC_mach_msg2_trap
    634661            MSC_mach_reply_port
    635662            MSC_mach_voucher_extract_attr_recipe_trap
    … …  
    637664            MSC_mk_timer_cancel
    638665            MSC_mk_timer_create
     666            MSC_mk_timer_destroy
    639667            MSC_semaphore_signal_trap
     668            MSC_semaphore_timedwait_trap
    640669            MSC_semaphore_wait_trap
    641670            MSC_swtch_pri
    642671            MSC_syscall_thread_switch
     672            MSC_task_dyld_process_info_notify_get
    643673            MSC_task_self_trap
    644674            MSC_thread_get_special_reply_port)))

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb.in

    r292928 r292957  
    615615
    616616(when (defined? 'syscall-unix)
    617     (allow syscall-unix)
     617    (deny syscall-unix (with telemetry))
    618618    (allow syscall-unix (syscall-number
    619619        SYS___channel_get_info
    … …  
    622622        SYS___disable_threadsignal
    623623        SYS___mac_syscall
     624        SYS___pthread_kill
     625        SYS___pthread_sigmask
    624626        SYS___semwait_signal
    625627        SYS_abort_with_payload
    … …  
    639641        SYS_csops_audittoken
    640642        SYS_dup
     643        SYS_dup2
    641644        SYS_exit
    642645        SYS_fcntl
    643646        SYS_fcntl_nocancel
     647        SYS_ffsctl
     648        SYS_fileport_makefd
    644649        SYS_fsgetpath
    645650        SYS_fstat64
     651        SYS_fstat64_extended
    646652        SYS_fstatat64
    647653        SYS_fstatfs64
    … …  
    759765
    760766(when (defined? 'syscall-mach)
    761     (allow syscall-mach (with report))
     767    (deny syscall-mach (with telemetry))
    762768    (allow syscall-mach
    763769        (machtrap-number
Note: See TracChangeset for help on using the changeset viewer.