Changeset 240500 in webkit

Timestamp:

Jan 25, 2019 1:40:11 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Deny mach lookups to services not used.
​https://bugs.webkit.org/show_bug.cgi?id=193828

Reviewed by Brent Fulgham.

Start denying mach lookups to iOS services, which were previously allowed with reporting.
Living-on has indicated that these services are not used.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (4 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-01-25  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Deny mach lookups to services not used.
+        https://bugs.webkit.org/show_bug.cgi?id=193828
+
+        Reviewed by Brent Fulgham.
+
+        Start denying mach lookups to iOS services, which were previously allowed with reporting.
+        Living-on has indicated that these services are not used.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2019-01-25  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -450 +450 @@
     (global-name "com.apple.coremedia.videoqueue"))
 
-(allow mach-lookup (with report)
+;; These services have been identified as unused during living-on.
+;; This list overrides some definitions above and in common.sb.
+;; FIXME: remove overridden rules once the final list has been
+;; established, see https://bugs.webkit.org/show_bug.cgi?id=193840
+(deny mach-lookup
     (global-name "com.apple.AGXCompilerService")
     (global-name "com.apple.CoreAuthentication.daemon.libxpc")
@@ -477 +481 @@
     (global-name "com.apple.assertiond.processassertionconnection")
     (global-name "com.apple.assertiond.processinfoservice")
-    (global-name "com.apple.audio.AURemoteIOServer")
     (global-name "com.apple.audio.AudioComponentPrefs")
     (global-name "com.apple.audio.AudioQueueServer")
@@ -498 +501 @@
     (global-name "com.apple.coremedia.capturesource")
     (global-name "com.apple.coremedia.compressionsession")
-    (global-name "com.apple.coremedia.endpoint.xpc")
     (global-name "com.apple.coremedia.endpointplaybacksession.xpc")
     (global-name "com.apple.coremedia.endpointremotecontrolsession.xpc")
     (global-name "com.apple.coremedia.figcontentkeysession.xpc")
-    (global-name "com.apple.coremedia.figcpecryptor")
     (global-name "com.apple.coremedia.remotequeue")
     (global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc")
@@ -532 +533 @@
     (global-name "com.apple.mediaserverd")
     (global-name "com.apple.mobile.usermanagerd.xpc")
-    (global-name "com.apple.mobilegestalt.xpc")
     (global-name "com.apple.nehelper")
     (global-name "com.apple.nesessionmanager")