Changeset 245246 in webkit

Timestamp:

May 13, 2019 12:53:44 PM (5 years ago)

Author:

Brent Fulgham

Message:

Correct the sandbox to allow loading libraries from /Library/Apple
​https://bugs.webkit.org/show_bug.cgi?id=197844

Reviewed by Per Arne Vollan.

Grant access to '/Library/Apple' as an appropriate place to load
system frameworks.

• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-05-13  Brent Fulgham  <bfulgham@apple.com>
+
+        Correct the sandbox to allow loading libraries from /Library/Apple 
+        https://bugs.webkit.org/show_bug.cgi?id=197844
+
+        Reviewed by Per Arne Vollan.
+
+        Grant access to '/Library/Apple' as an appropriate place to load
+        system frameworks.
+
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-05-13  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -41 +41 @@
     (require-all (file-mode #o0004)
     (require-any (subpath "/Library/Filesystems/NetFSPlugins")
+    (subpath "/Library/Apple/System")
     (subpath "/Library/Preferences/Logging")      ; Logging Rethink
     (subpath "/System")
@@ -53 +54 @@
     (subpath "/AppleInternal/Library/Preferences/Logging")
     (system-attribute apple-internal)))
+
+;;; Allow mapping of system frameworks + dylibs
+(allow file-map-executable
+    (subpath "/Library/Apple/System/Library/Frameworks")
+    (subpath "/Library/Apple/System/Library/PrivateFrameworks")
+    (subpath "/System/Library/Frameworks")
+    (subpath "/System/Library/PrivateFrameworks")
+    (subpath "/usr/lib")
+    (literal "/usr/local/lib/sanitizers"))
 
 (allow file-read-metadata