Changeset 256473 in webkit

Timestamp:

Feb 12, 2020 1:49:12 PM (4 years ago)

Author:

Brent Fulgham

Message:

[iOS] Remove access to AppleKeyStoreUserClient from the WebContent process
​https://bugs.webkit.org/show_bug.cgi?id=207654
<rdar://problem/58804060>

Reviewed by Per Arne Vollan.

Testing and telemetry show that we no longer need access to the AppleKeyStoreUserClient
IOKit class in the WebContent or GPU processes. We should remove this access.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb (modified) (2 diffs)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-02-12  Brent Fulgham  <bfulgham@apple.com>
+
+        [iOS] Remove access to AppleKeyStoreUserClient from the WebContent process
+        https://bugs.webkit.org/show_bug.cgi?id=207654
+        <rdar://problem/58804060>
+
+        Reviewed by Per Arne Vollan.
+
+        Testing and telemetry show that we no longer need access to the AppleKeyStoreUserClient
+        IOKit class in the WebContent or GPU processes. We should remove this access.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2020-02-12  Said Abou-Hallawa  <said@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb

@@ -106 +106 @@
                (global-name "com.apple.mobileassetd" "com.apple.mobileassetd.v2"))
         (mobile-preferences-read "com.apple.MobileAsset")))
-
-(define-once (mobile-keybag-access)
-     (allow iokit-open
-            (iokit-user-client-class "AppleKeyStoreUserClient")))
 
 (define-once (play-audio)
@@ -762 +758 @@
 
 (framebuffer-access)
-
-;; <rdar://problem/7822790>
-(mobile-keybag-access)
 
 ; <rdar://problem/7595408> , <rdar://problem/7643881>

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -119 +119 @@
                (global-name "com.apple.mobileassetd" "com.apple.mobileassetd.v2"))
         (mobile-preferences-read "com.apple.MobileAsset")))
-
-(define-once (mobile-keybag-access)
-    (allow iokit-open (with telemetry)
-        (iokit-user-client-class "AppleKeyStoreUserClient")  ;; Needed by NSURLCache
-))
 
 (define-once (play-audio)
@@ -763 +758 @@
 
 (framebuffer-access)
-
-;; <rdar://problem/7822790>
-(mobile-keybag-access)
 
 ; <rdar://problem/7595408> , <rdar://problem/7643881>