Changeset 252211 in webkit

Timestamp:

Nov 7, 2019 3:20:01 PM (4 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Add logging and telemetry to more mach lookup rules
​https://bugs.webkit.org/show_bug.cgi?id=203978

Reviewed by Brent Fulgham.

Add logging and telemetry to help determine if mach lookup of these services can be denied in the WebContent process.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (8 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-11-07  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Add logging and telemetry to more mach lookup rules
+        https://bugs.webkit.org/show_bug.cgi?id=203978
+
+        Reviewed by Brent Fulgham.
+
+        Add logging and telemetry to help determine if mach lookup of these services can be denied in the WebContent process.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2019-11-07  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -123 +123 @@
 (define-once (play-audio)
     (allow mach-lookup
-           (global-name "com.apple.audio.AURemoteIOServer")
+           (global-name "com.apple.audio.AURemoteIOServer"))
+    (allow mach-lookup (with report) (with telemetry)
            (xpc-service-name "com.apple.audio.toolbox.reporting.service")))
 
@@ -202 +203 @@
     (allow mach-lookup
            (global-name "com.apple.mediaremoted.xpc"))
+    (allow mach-lookup (with report) (with telemetry)
+        (xpc-service-name "com.apple.MediaPlayer.RemotePlayerService"))
 )
 
@@ -628 +631 @@
        (ipc-posix-name-prefix "apple.cfprefs."))
  
-(allow mach-lookup
+(allow mach-lookup (with report) (with telemetry)
+    (global-name "com.apple.lsd.open")
     (global-name "com.apple.lsd.mapdb"))
 
@@ -644 +648 @@
     (allow ipc-posix-sem-open))
 
+(allow mach-lookup (with report) (with telemetry)
+    (global-name "com.apple.runningboard"))
+
 (allow system-sched
        (require-entitlement "com.apple.private.kernel.override-cpumon"))
@@ -653 +660 @@
     (allow sysctl-read sysctl-write
            (sysctl-name "vm.footprint_suspend")))
+
+(allow mach-lookup (with report) (with telemetry)
+       (global-name "com.apple.system.logger"))
 
 (allow file-read-metadata network-outbound
@@ -661 +671 @@
 (allow ipc-posix-shm-read*
        (ipc-posix-name "apple.shm.notification_center"))
+
+(allow mach-lookup (with report) (with telemetry)
+    (global-name "com.apple.diagnosticd"))
 
 (logd-diagnostic-client)
@@ -718 +731 @@
 (speech-synthesis-and-voiceover)
 
-(allow mach-lookup
+(allow mach-lookup (with report) (with telemetry)
     (global-name "com.apple.audio.AudioComponentRegistrar"))
 
@@ -762 +775 @@
 (allow file-read*
     (well-known-system-group-container-subpath "/systemgroup.com.apple.lsd.iconscache"))
-(allow mach-lookup
+(allow mach-lookup (with report) (with telemetry)
     (xpc-service-name "com.apple.iconservices")
     (global-name "com.apple.iconservices"))