Changeset 235411 in webkit

Timestamp:

Aug 27, 2018 4:47:40 PM (6 years ago)

Author:

pvollan@apple.com

Message:

[macOS] Block CoreServices in sandbox.
​https://bugs.webkit.org/show_bug.cgi?id=189005
<rdar://problem/35369091>

Reviewed by Brent Fulgham.

The sandbox for the WebContent process should block CoreServices.

• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-08-27  Per Arne Vollan  <pvollan@apple.com>
+
+        [macOS] Block CoreServices in sandbox.
+        https://bugs.webkit.org/show_bug.cgi?id=189005
+        <rdar://problem/35369091>
+
+        Reviewed by Brent Fulgham.
+
+        The sandbox for the WebContent process should block CoreServices.
+
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2018-08-27  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -648 +648 @@
 (allow mach-lookup
     (global-name-regex #"^com.apple.distributed_notifications")                                                       
-    (global-name "com.apple.CoreServices.coreservicesd"))
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101400
+    (global-name "com.apple.CoreServices.coreservicesd")
+#endif
+)
 (allow file-read-data
     (literal "/dev/autofs_nowait")) ; Used by CF to circumvent automount triggers