Changeset 269877 in webkit

Timestamp:

Nov 16, 2020 2:07:42 PM (3 years ago)

Author:

Brent Fulgham

Message:

[macOS] Remove remote tcp capability from WebContent Sandbox
​https://bugs.webkit.org/show_bug.cgi?id=218999
<rdar://problem/70355789>

Reviewed by Per Arne Vollan.

Since we have moved all network activity (aside from some syslog use) out of the WebContent
process, we do not need the ability to open remote tcp connections. We should deny this
capability from our non-Network sandboxes.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:
• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in (modified) (1 diff)
• WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-11-16  Brent Fulgham  <bfulgham@apple.com>
+
+        [macOS] Remove remote tcp capability from WebContent Sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=218999
+        <rdar://problem/70355789>
+
+        Reviewed by Per Arne Vollan.
+
+        Since we have moved all network activity (aside from some syslog use) out of the WebContent
+        process, we do not need the ability to open remote tcp connections. We should deny this
+        capability from our non-Network sandboxes.
+
+        * GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
+        * WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2020-11-16  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in

@@ -681 +681 @@
        ;; ObjC map_images needs to send logging data to syslog. <rdar://problem/39778918>
        (literal "/private/var/run/syslog")
-       (remote tcp))
+#if __MAC_OS_X_VERSION_MIN_REQUIRED <= 101500
+       (remote tcp)
+#endif
+)
 
 ;; CFNetwork

trunk/Source/WebKit/WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in

@@ -385 +385 @@
        ;; ObjC map_images needs to send logging data to syslog. <rdar://problem/39778918>
        (literal "/private/var/run/syslog")
-       (remote tcp))
+)
 
 ;; CFNetwork

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -1034 +1034 @@
        ;; ObjC map_images needs to send logging data to syslog. <rdar://problem/39778918>
        (literal "/private/var/run/syslog")
-       (remote tcp))
+#if __MAC_OS_X_VERSION_MIN_REQUIRED <= 101500
+       (remote tcp)
+#endif
+)
 
 ;; CFNetwork