Changeset 295572 in webkit

Timestamp:

Jun 15, 2022 2:35:30 PM (2 years ago)

Author:

pvollan@apple.com

Message:

Block network extension system calls
​https://bugs.webkit.org/show_bug.cgi?id=241633
<rdar://73513138>

Reviewed by Sihui Liu.

After moving content filtering to the Network process and fixing an issue where Safari's injected bundle were
making network calls, network extension system calls can be blocked in the WebContent process.

• Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:

Canonical link: ​https://commits.webkit.org/251577@main

Location:

trunk/Source/WebKit

Files:

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -1198 +1198 @@
         SYS_getattrlistbulk ;; xpc_realpath and directory enumeration
         SYS_iopolicysys
+#if !ENABLE(CONTENT_FILTERING_IN_NETWORKING_PROCESS)
         SYS_necp_client_action
         SYS_necp_open
+#endif
         SYS_open_dprotected_np
         SYS_psynch_rw_wrlock

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -1988 +1988 @@
         SYS_mlock
         SYS_munlock
+#if !ENABLE(CONTENT_FILTERING_IN_NETWORKING_PROCESS)
         SYS_necp_client_action
         SYS_necp_open
+#endif
         SYS_openat_nocancel
         SYS_proc_rlimit_control