Changeset 246702 in webkit

Timestamp:

Jun 21, 2019 3:52:52 PM (5 years ago)

Author:

Brent Fulgham

Message:

Adjust sandboxes based on seed feedback
​https://bugs.webkit.org/show_bug.cgi?id=199119
<rdar://problem/50164879>

Reviewed by Geoffrey Garen.

Update our sandboxes to address test failures and bugs encountered during initial iOS 13 and
macOS Catalina testing.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-06-21  Brent Fulgham  <bfulgham@apple.com>
+
+        Adjust sandboxes based on seed feedback
+        https://bugs.webkit.org/show_bug.cgi?id=199119
+        <rdar://problem/50164879>
+
+        Reviewed by Geoffrey Garen.
+
+        Update our sandboxes to address test failures and bugs encountered during initial iOS 13 and
+        macOS Catalina testing.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2019-06-21  Jiewen Tan  <jiewen_tan@apple.com>
 

trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in

@@ -93 +93 @@
         "com.apple.ist.ds.appleconnect2.uat" ;; Remove after <rdar://problem/35542803> ships
         "com.apple.networkConnect"))
+
 (allow file-read*
     ;; Basic system paths
+    (subpath "/Library/Fonts") ;; Needed to serialize font data types <rdar://problem/50164879>
     (subpath "/Library/Frameworks")
     (subpath "/Library/Managed Preferences")

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

@@ -73 +73 @@
 )
 
+;; Read-only preferences and data
+(allow file-read*
+    ;; Basic system paths
+    (subpath "/Library/Fonts") ;; Needed to serialize font data types <rdar://problem/50164879>
+)
+
 ;; Security framework
 (allow mach-lookup

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -289 +289 @@
     (iokit-property "class-code")
     (iokit-property "color-accuracy-index")
+    (iokit-property "compatible") ;; <rdar://problem/47523516>
     (iokit-property "compatible-device-fallback") ;; <rdar://problem/49497720>
     (iokit-property "device-colors") ;; <rdar://problem/51322072>

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -168 +168 @@
         "kern.maxfilesperproc"
         "kern.memorystatus_level"
+        "kern.osproductversion" ;; <rdar://problem/51756739>
         "kern.safeboot"
         "kern.version"
@@ -636 +637 @@
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 || PLATFORM(IOSMAC)
 (deny mach-lookup (with no-log)
+    (global-name "com.apple.CoreServices.coreservicesd")
+    (global-name "com.apple.DiskArbitration.diskarbitrationd")
     (global-name "com.apple.ViewBridgeAuxiliary")
     (global-name "com.apple.windowserver.active"))
 #endif
-
 
 ;; Needed to support encrypted media playback <rdar://problem/40038478>