Changeset 209133 in webkit

Timestamp:

Nov 30, 2016 9:53:12 AM (7 years ago)

Author:

Brent Fulgham

Message:

Correct plugin sandbox after r208611
​https://bugs.webkit.org/show_bug.cgi?id=165187
<rdar://problem/29431165>

Reviewed by Alex Christensen.

In r208611 I removed the 'else' clause of a Scheme conditional
that was needed to properly run plugins (such as Flash Player).

This change retains the relevant current sandbox content, while
still stripping out the old code that is no longer needed.

• PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2016-11-30  Brent Fulgham  <bfulgham@apple.com>
+
+        Correct plugin sandbox after r208611
+        https://bugs.webkit.org/show_bug.cgi?id=165187
+        <rdar://problem/29431165>
+
+        Reviewed by Alex Christensen.
+
+        In r208611 I removed the 'else' clause of a Scheme conditional
+        that was needed to properly run plugins (such as Flash Player).
+
+        This change retains the relevant current sandbox content, while
+        still stripping out the old code that is no longer needed.
+
+        * PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
+
 2016-11-29  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in

@@ -348 +348 @@
     (allow device-microphone))
 
+(allow ipc-posix-shm*
+    (ipc-posix-name-regex #"^AudioIO")
+    (ipc-posix-name-regex #"^CFPBS:")
+    (ipc-posix-name "com.apple.ColorSync.Gen.lock")
+    (ipc-posix-name "com.apple.ColorSync.Disp.lock")
+    (ipc-posix-name "com.apple.ColorSync.Gray2.2")
+    (ipc-posix-name "com.apple.ColorSync.sRGB")
+    (ipc-posix-name "com.apple.ColorSync.GenGray")
+    (ipc-posix-name "com.apple.ColorSync.GenRGB")
+    (ipc-posix-name-regex #"^com\.apple\.cs\.")
+    (ipc-posix-name-regex #"^ls\."))
+(allow ipc-posix-shm-read*
+    (ipc-posix-name-regex #"^/tmp/com\.apple\.csseed\.")
+    (ipc-posix-name "FNetwork.defaultStorageSession")
+    (ipc-posix-name "apple.shm.notification_center"))
+
 ;; Silently block access to some resources
 (deny file-read* file-write* (with no-log)