Changeset 294903 in webkit

Timestamp:

May 26, 2022, 3:34:25 PM (4 years ago)

Author:

pvollan@apple.com

Message:

[iOS][WP] Block access to file-ioctl commands
​https://bugs.webkit.org/show_bug.cgi?id=240977
<rdar://88334007>

Reviewed by Chris Dumez.

This is based on collected telemetry. This patch also adds telemetry to file read/write of /dev/aes_0
to determine if that can be removed as well.

• Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:

Canonical link: ​https://commits.webkit.org/251026@main

File:

• trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (2 diffs)

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -316 +316 @@
           (literal "/dev/urandom"))
 
-    (allow file-read* file-write-data
+    (allow file-read* file-write-data (with telemetry)
            (literal "/dev/aes_0")))
 
@@ -1240 +1240 @@
 (deny file-ioctl (with telemetry))
 
-;; restrict to the two ioctl's /dev/aes_0 needs
-(allow file-ioctl (with telemetry)
-    (require-all
-        (literal "/dev/aes_0")
-        (require-any
-            (ioctl-command (_IO "T" 101)) ;; IOAES_GET_INFO
-            (ioctl-command (_IO "T" 102)) ;; IOAES_ENCRYPT_DECRYPT
-)))
+(deny file-ioctl (with telemetry)
+    (literal "/dev/aes_0"))
 
 (deny socket-ioctl (with telemetry))