Changeset 285723 in webkit

Timestamp:

Nov 12, 2021, 8:38:59 AM (4 years ago)

Author:

pvollan@apple.com

Message:

[macOS][GPUP] Remove sandbox write access to files
​https://bugs.webkit.org/show_bug.cgi?id=232247
<rdar://problem/84620023>

Reviewed by Brent Fulgham.

Based on telemetry, remove sandbox write access to files in the GPU process on macOS.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-11-12  Per Arne Vollan <pvollan@apple.com>
+
+        [macOS][GPUP] Remove sandbox write access to files
+        https://bugs.webkit.org/show_bug.cgi?id=232247
+        <rdar://problem/84620023>
+
+        Reviewed by Brent Fulgham.
+
+        Based on telemetry, remove sandbox write access to files in the GPU process on macOS.
+
+        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+
 2021-11-12  Per Arne Vollan <pvollan@apple.com>
 

trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -75 +75 @@
     (literal "/private/etc/passwd"))
 
-(allow file-write-data (with telemetry)
-    (literal "/dev/null")
-    (literal "/dev/zero"))
-
-(allow file-read*
+(allow file-read* file-write-data file-ioctl
     (literal "/dev/dtracehelper"))
-(allow file-write-data
-       file-ioctl (with telemetry)
-    (literal "/dev/dtracehelper"))
-
-;;; Allow creation of core dumps.
-(allow file-write-create (with telemetry)
-    (require-all (prefix "/cores/")
-        (vnode-type REGULAR-FILE)))
 
 ;;; Allow IPC to standard system agents.