Changeset 276658 in webkit


Ignore:
Timestamp:
Apr 27, 2021, 1:37:56 PM (4 years ago)
Author:
pvollan@apple.com
Message:

Enforce IOKit filtering
​https://bugs.webkit.org/show_bug.cgi?id=223937
<rdar://problem/76271551>

Reviewed by Brent Fulgham.

Enforce IOKit method filtering based on telemetry. This patch also adds IOKit method telemetry for some Apple Silicion
IOKit classes, which were overlooked in the first telemetry phase.

  • Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
  • WebProcess/com.apple.WebProcess.sb.in:
Location:
trunk/Source/WebKit
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r276653 r276658  
     12021-04-27  Per Arne  <pvollan@apple.com>
     2
     3        Enforce IOKit filtering
     4        https://bugs.webkit.org/show_bug.cgi?id=223937
     5        <rdar://problem/76271551>
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Enforce IOKit method filtering based on telemetry. This patch also adds IOKit method telemetry for some Apple Silicion
     10        IOKit classes, which were overlooked in the first telemetry phase.
     11
     12        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
     13        * WebProcess/com.apple.WebProcess.sb.in:
     14
    1152021-04-27  Chris Dumez  <cdumez@apple.com>
    216

  • trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

    r276590 r276658  
    259259                (deny (with telemetry)
    260260                    iokit-external-trap)
    261                 (allow (with telemetry) (with message "AGXDeviceUserClient")
     261                (deny (with telemetry) (with message "AGXDeviceUserClient")
    262262                    iokit-async-external-method
    263263                    iokit-external-method
    … …  
    433433                iokit-async-external-method
    434434                iokit-external-trap)
    435             (allow (with telemetry) (with message "IOSurfaceRootUserClient")
     435            (deny (with telemetry) (with message "IOSurfaceRootUserClient")
    436436                iokit-external-method)
    437437            (allow iokit-external-method
    … …  
    445445                    10
    446446                    11
     447                    12
    447448                    13
    448449                    14
    … …  
    496497                    iokit-async-external-method
    497498                    iokit-external-trap)
    498                 (allow (with telemetry) (with message "IOSurfaceAcceleratorClient")
     499                (deny (with telemetry) (with message "IOSurfaceAcceleratorClient")
    499500                    iokit-external-method)
    500501                (allow iokit-external-method

  • trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

    r276439 r276658  
    112112(define (IOAcceleratorMessageFilter)
    113113    (apply-message-filter
    114         (allow (with telemetry) (with message "IOAccelerator")
     114        (deny (with telemetry) (with message "IOAccelerator")
    115115            iokit-async-external-method
    116116            iokit-external-method
    … …  
    145145                23
    146146                24
     147                28
    147148                29
    148149                30
    … …  
    158159                261
    159160                262
     161                263
     162                265
    160163                267
    161164                512
    … …  
    170173(define (IOSurfaceRootUserClientMessageFilter)
    171174    (apply-message-filter
    172         (allow (with telemetry) (with message "IOSurfaceRootUserClient")
     175        (deny (with telemetry) (with message "IOSurfaceRootUserClient")
    173176            iokit-async-external-method
    174177            iokit-external-method
    … …  
    199202                34
    200203                35
     204                36
     205                38
    201206                44
    202207            )
    … …  
    204209        (deny (with telemetry)
    205210            iokit-external-trap
     211        )
     212    )
     213)
     214
     215(define (AppleAVDUserClientMessageFilter)
     216    (if (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES")
     217        (apply-message-filter
     218            (allow (with telemetry) (with message "AppleAVDUserClient")
     219                iokit-async-external-method
     220                iokit-external-method
     221                iokit-external-trap
     222            )
     223        )
     224    )
     225)
     226
     227(define (IOSurfaceAcceleratorClientMessageFilter)
     228    (if (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES")
     229        (apply-message-filter
     230            (allow (with telemetry) (with message "IOSurfaceAcceleratorClient")
     231                iokit-async-external-method
     232                iokit-external-method
     233                iokit-external-trap
     234            )
     235        )
     236    )
     237)
     238
     239(define (IOMobileFramebufferUserClientMessageFilter)
     240    (if (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES")
     241        (apply-message-filter
     242            (allow (with telemetry) (with message "IOMobileFramebufferUserClient")
     243                iokit-async-external-method
     244                iokit-external-method
     245                iokit-external-trap
     246            )
    206247        )
    207248    )
    … …  
    307348            (with telemetry-backtrace)
    308349            (apply-message-filter
    309                 (allow (with telemetry) (with message "AppleIntelMEUserClient")
     350                (deny (with telemetry) (with message "AppleIntelMEUserClient")
    310351                    iokit-external-method
    311352                )
    … …  
    339380            (with telemetry-backtrace)
    340381            (apply-message-filter
    341                 (allow (with telemetry) (with message "AppleSNBFBUserClient")
     382                (deny (with telemetry) (with message "AppleSNBFBUserClient")
    342383                    iokit-external-method
    343384                )
    … …  
    394435            (with telemetry-backtrace)
    395436            (apply-message-filter
    396                 (allow (with telemetry) (with message "AppleGraphicsControlClient")
     437                (deny (with telemetry) (with message "AppleGraphicsControlClient")
    397438                    iokit-async-external-method
    398439                    iokit-external-method
    … …  
    451492            (with telemetry-backtrace)
    452493            (apply-message-filter
    453                 (allow (with telemetry) (with message "AppleMGPUPowerControlClient")
     494                (deny (with telemetry) (with message "AppleMGPUPowerControlClient")
    454495                    iokit-external-method
    455496                )
    … …  
    10401081        (with telemetry-backtrace)
    10411082        (apply-message-filter
    1042             (allow (with telemetry) (with message "AppleUpstreamUserClient")
     1083            (deny (with telemetry) (with message "AppleUpstreamUserClient")
    10431084                iokit-external-method
    10441085            )
    … …  
    10751116        (with telemetry-backtrace)
    10761117        (apply-message-filter
    1077             (allow (with telemetry) (with message "RootDomainUserClient")
     1118            (deny (with telemetry) (with message "RootDomainUserClient")
    10781119                iokit-external-method
    10791120            )
    … …  
    11071148        (with telemetry-backtrace)
    11081149        (apply-message-filter
    1109             (allow (with telemetry) (with message "AudioAUUC")
     1150            (deny (with telemetry) (with message "AudioAUUC")
    11101151                iokit-external-method
    11111152            )
    … …  
    11921233            (iokit-user-client-class
    11931234                "AppleAVDUserClient"
     1235            )
     1236        )
     1237#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
     1238        (AppleAVDUserClientMessageFilter)
     1239#endif
     1240    )
     1241    (allow iokit-open
     1242#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 110000
     1243        (with telemetry-backtrace)
     1244#endif
     1245        (require-all
     1246            (extension "com.apple.webkit.extension.iokit")
     1247            (iokit-user-client-class
    11941248                "IOMobileFramebufferUserClient"
     1249            )
     1250        )
     1251#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
     1252        (IOMobileFramebufferUserClientMessageFilter)
     1253#endif
     1254    )
     1255    (allow iokit-open
     1256#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 110000
     1257        (with telemetry-backtrace)
     1258#endif
     1259        (require-all
     1260            (extension "com.apple.webkit.extension.iokit")
     1261            (iokit-user-client-class
    11951262                "IOSurfaceAcceleratorClient" ;; <rdar://problem/63696732>
    11961263            )
    11971264        )
     1265#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
     1266        (IOSurfaceAcceleratorClientMessageFilter)
     1267#endif
    11981268    )
    11991269)
    … …  
    21042174            (iokit-user-client-class
    21052175                "AppleAVDUserClient"
     2176            )
     2177        )
     2178#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
     2179        (AppleAVDUserClientMessageFilter)
     2180#endif
     2181    )
     2182    (allow iokit-open (with report)
     2183#if __MAC_OS_X_VERSION_MIN_REQUIRED > 110000
     2184        (with telemetry-backtrace)
     2185#endif
     2186        (require-all
     2187            (require-not (extension "com.apple.webkit.extension.iokit"))
     2188            (iokit-user-client-class
    21062189                "IOSurfaceAcceleratorClient"
    21072190            )
    21082191        )
     2192#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
     2193        (IOSurfaceAcceleratorClientMessageFilter)
     2194#endif
    21092195    )
    21102196)
Note: See TracChangeset for help on using the changeset viewer.