Changeset 251688 in webkit

Timestamp:

Oct 28, 2019 5:21:53 PM (4 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Fix sandbox violations
​https://bugs.webkit.org/show_bug.cgi?id=203505

Reviewed by Brent Fulgham.

Running layout tests shows that allowing mach lookup is needed for a set of services which was previously denied.
This patch add rules for allowing these services again. The service 'com.apple.logd.events' is still denied, since
it has not been observed to be in use.

No new tests, covered by existing tests.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-10-28  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Fix sandbox violations
+        https://bugs.webkit.org/show_bug.cgi?id=203505
+
+        Reviewed by Brent Fulgham.
+
+        Running layout tests shows that allowing mach lookup is needed for a set of services which was previously denied.
+        This patch add rules for allowing these services again. The service 'com.apple.logd.events' is still denied, since
+        it has not been observed to be in use.
+
+        No new tests, covered by existing tests.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2019-10-28  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -452 +452 @@
         (extension "com.apple.fileprovider.read-write")))
 
-(deny mach-lookup (with no-report)
-    (global-name "com.apple.logd")
+(allow mach-lookup
+    (global-name "com.apple.logd"))
+
+(deny mach-lookup (with send-signal SIGKILL)
     (global-name "com.apple.logd.events"))
+
+(allow mach-lookup
+    (global-name "com.apple.cfprefsd.daemon"))
 
 (allow ipc-posix-shm-read*
        (ipc-posix-name-prefix "apple.cfprefs."))
+ 
+(allow mach-lookup
+    (global-name "com.apple.lsd.mapdb"))
 
 ;; <rdar://problem/12413942>
@@ -485 +493 @@
        (literal "/private/var/run/syslog"))
 
-(deny mach-lookup (with no-report)
+(allow mach-lookup
        (global-name "com.apple.system.notification_center"))
-(deny ipc-posix-shm-read* (with no-report)
+(allow ipc-posix-shm-read*
        (ipc-posix-name "apple.shm.notification_center"))