Changeset 273169 in webkit

Timestamp:

Feb 19, 2021 3:24:51 PM (3 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Remove access to IOSurfaceAcceleratorClient
​https://bugs.webkit.org/show_bug.cgi?id=222199
<rdar://problem/73518610>

Reviewed by Brent Fulgham.

Remove access to IOSurfaceAcceleratorClient in the WebContent process on iOS when the GPU process is enabled.
This patch also adds the IOKit filter from IOSurfaceRootUserClient when the GPU process is not enabled, to
the rule for IOSurfaceRootUserClient when the GPU process is enabled.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-02-19  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Remove access to IOSurfaceAcceleratorClient
+        https://bugs.webkit.org/show_bug.cgi?id=222199
+        <rdar://problem/73518610>
+
+        Reviewed by Brent Fulgham.
+
+        Remove access to IOSurfaceAcceleratorClient in the WebContent process on iOS when the GPU process is enabled.
+        This patch also adds the IOKit filter from IOSurfaceRootUserClient when the GPU process is not enabled, to
+        the rule for IOSurfaceRootUserClient when the GPU process is enabled.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2021-02-19  Jean-Yves Avenard  <jya@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -1017 +1017 @@
 )
 
-;; FIXME: This is just for logging. Remove when the GPU process is enabled by default.
-(allow iokit-open (with report) (with telemetry-backtrace)
+(allow iokit-open (with telemetry-backtrace)
+    (require-all
+        (require-not (extension "com.apple.webkit.extension.iokit"))
+        (iokit-user-client-class
+            "IOSurfaceRootUserClient"
+        )
+    )
+    (when (defined? 'iokit-external-method)
+        (apply-message-filter
+            (deny (with telemetry)
+                iokit-async-external-method
+                iokit-external-trap)
+            (allow
+                iokit-external-method)
+        )
+    )
+)
+
+(deny iokit-open (with telemetry-backtrace)
     (require-all
         (require-not (extension "com.apple.webkit.extension.iokit"))
         (iokit-user-client-class
             "IOSurfaceAcceleratorClient"
-            "IOSurfaceRootUserClient"
         )
     )