Changeset 243888 in webkit

Timestamp:

Apr 4, 2019 12:13:38 PM (5 years ago)

Author:

pvollan@apple.com

Message:

[macOS][iOS] Add filter to syscall sandbox rule
​https://bugs.webkit.org/show_bug.cgi?id=196613
<rdar://problem/49531420>

Reviewed by Brent Fulgham.

This will restrict the existing sandbox rule for the syscall.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-04  Per Arne Vollan  <pvollan@apple.com>
+
+        [macOS][iOS] Add filter to syscall sandbox rule
+        https://bugs.webkit.org/show_bug.cgi?id=196613
+        <rdar://problem/49531420>
+
+        Reviewed by Brent Fulgham.
+
+        This will restrict the existing sandbox rule for the syscall.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-04-04  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -601 +601 @@
         (syscall-number SYS_pread_nocancel)
         (syscall-number SYS___semwait_signal_nocancel)
-        (syscall-number SYS_kdebug_trace_string) ;; Needed for performance sampling, see <rdar://problem/48829655>.
+    )
+    (with-filter (system-attribute apple-internal)
+        (allow syscall-unix (syscall-number SYS_kdebug_trace_string)) ;; <rdar://problem/49531420>
     )
 )

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -964 +964 @@
         (syscall-number SYS_gettid) ;; Needed for base system, see <rdar://problem/48651255>
         (syscall-number SYS_memorystatus_control) ;; Needed for memory measurement infrastructure, see <rdar://problem/48647263>
-        (syscall-number SYS_kdebug_trace_string) ;; Needed for performance sampling, see <rdar://problem/48829655>.
         (syscall-number SYS_psynch_rw_rdlock) ;; <rdar://problem/49060359>
     )
+    (with-filter (system-attribute apple-internal)
+        (allow syscall-unix (syscall-number SYS_kdebug_trace_string)) ;; <rdar://problem/49531420>
+    )
 )