Changeset 261490 in webkit

Timestamp:

May 11, 2020, 12:45:37 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Update message filtering rules in the WebContent process' sandbox
​https://bugs.webkit.org/show_bug.cgi?id=211188
<rdar://problem/60922910>

Reviewed by Brent Fulgham.

Based on telemetry and local testing, update the message filtering rules in the WebContent process' sandbox on iOS.
Messages that have not been observed being in use, should be denied.

No new tests, covered by existing tests.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-05-11  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Update message filtering rules in the WebContent process' sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=211188
+        <rdar://problem/60922910>
+
+        Reviewed by Brent Fulgham.
+
+        Based on telemetry and local testing, update the message filtering rules in the WebContent process' sandbox on iOS.
+        Messages that have not been observed being in use, should be denied.
+
+        No new tests, covered by existing tests.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2020-05-11  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -1214 +1214 @@
 )
 
-(when (defined? 'mach_make_memory_entry)
 (when (defined? 'mach-kernel-endpoint)
     (allow mach-kernel-endpoint
         (apply-message-filter
-            (allow mach-message-send (with report) (with telemetry))
+            (deny mach-message-send (with telemetry))
             (allow mach-message-send (kernel-mig-routine
+                (when (defined? '_mach_make_memory_entry) _mach_make_memory_entry)
                 host_get_clock_service
                 host_get_io_master
@@ -1239 +1239 @@
                 io_service_get_matching_services_bin
                 io_service_open_extended
-                mach_make_memory_entry
+                mach_exception_raise
+                (when (defined? 'mach_make_memory_entry) mach_make_memory_entry)
                 mach_port_get_context_from_user
                 mach_port_request_notification
@@ -1266 +1267 @@
     )
 )
-)