Changeset 85407 in webkit


Ignore:
Timestamp:
May 1, 2011 12:10:39 AM (13 years ago)
Author:
ike@apple.com
Message:

2011-04-30 Ivan Krstić <​ike@apple.com>

Reviewed by Sam Weinig.

Reindent WebProcess sandbox to standard scheme style
​https://bugs.webkit.org/show_bug.cgi?id=59870

  • WebProcess/com.apple.WebProcess.sb:
Location:
trunk/Source/WebKit2
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r85389 r85407  
     12011-04-30  Ivan Krstić  <ike@apple.com>
     2
     3        Reviewed by Sam Weinig.
     4
     5        Reindent WebProcess sandbox to standard scheme style
     6        https://bugs.webkit.org/show_bug.cgi?id=59870
     7
     8        * WebProcess/com.apple.WebProcess.sb:
     9
    1102011-04-28  Jer Noble  <jer.noble@apple.com>
    211

  • trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb

    r85268 r85407  
    1111;; Read-only preferences and data
    1212(allow file-read*
    13     ;; Basic system paths
    14     (subpath "/Library/Dictionaries")
    15     (subpath "/Library/Fonts")
    16     (subpath "/Library/Frameworks")
    17     (subpath "/Library/Keychains")
    18     (subpath "/private/var/db/mds")
    19     (subpath "/private/var/db/DetachedSignatures")
    20     (regex #"^/private/etc/(hosts|group|passwd)$")
     13       ;; Basic system paths
     14       (subpath "/Library/Dictionaries")
     15       (subpath "/Library/Fonts")
     16       (subpath "/Library/Frameworks")
     17       (subpath "/Library/Keychains")
     18       (subpath "/private/var/db/mds")
     19       (subpath "/private/var/db/DetachedSignatures")
     20       (regex #"^/private/etc/(hosts|group|passwd)$")
    2121
    22     ;; Plugins
    23     (subpath "/Library/Internet Plug-Ins")
    24     (subpath (string-append (param "HOME_DIR") "/Library/Internet Plug-Ins"))
     22       ;; Plugins
     23       (subpath "/Library/Internet Plug-Ins")
     24       (subpath (string-append (param "HOME_DIR") "/Library/Internet Plug-Ins"))
    2525
    26     ;; System and user preferences
    27     (literal "/Library/Preferences/.GlobalPreferences.plist")
    28     (literal "/Library/Preferences/com.apple.crypto.plist")
    29     (literal "/Library/Preferences/com.apple.security.plist")
    30     (literal "/Library/Preferences/com.apple.security.common.plist")
    31     (literal "/Library/Preferences/com.apple.security.revocation.plist")
    32     (literal (string-append (param "HOME_DIR") "/Library/Preferences/.GlobalPreferences.plist"))
    33     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/\.GlobalPreferences\."))
    34     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.ATS.plist"))
    35     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.HIToolbox.plist"))
    36     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.plist"))
    37     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.WebFoundation.plist"))
    38     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.plist"))
    39     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.revocation.plist"))
    40     (literal (string-append (param "HOME_DIR") "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain"))
    41     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$"))
     26       ;; System and user preferences
     27       (literal "/Library/Preferences/.GlobalPreferences.plist")
     28       (literal "/Library/Preferences/com.apple.crypto.plist")
     29       (literal "/Library/Preferences/com.apple.security.plist")
     30       (literal "/Library/Preferences/com.apple.security.common.plist")
     31       (literal "/Library/Preferences/com.apple.security.revocation.plist")
     32       (literal (string-append (param "HOME_DIR") "/Library/Preferences/.GlobalPreferences.plist"))
     33       (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/\.GlobalPreferences\."))
     34       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.ATS.plist"))
     35       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.HIToolbox.plist"))
     36       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.plist"))
     37       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.WebFoundation.plist"))
     38       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.plist"))
     39       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.revocation.plist"))
     40       (literal (string-append (param "HOME_DIR") "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain"))
     41       (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$"))
    4242
    43     ;; On-disk WebKit2 framework location, to account for debug installations
    44     ;; outside of /System/Library/Frameworks
    45     (subpath (param "WEBKIT2_FRAMEWORK_DIR"))
     43       ;; On-disk WebKit2 framework location, to account for debug installations
     44       ;; outside of /System/Library/Frameworks
     45       (subpath (param "WEBKIT2_FRAMEWORK_DIR"))
    4646
    47     ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
    48     (subpath (string-append (param "HOME_DIR") "/Library/Fonts"))
     47       ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
     48       (subpath (string-append (param "HOME_DIR") "/Library/Fonts"))
    4949
    50     ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
    51     (subpath (string-append (param "HOME_DIR") "/Library/Audio/Plug-Ins/Components"))
    52     (subpath (string-append (param "HOME_DIR") "/Library/Preferences/QuickTime Preferences"))
    53     (literal (string-append (param "HOME_DIR") "/Library/Caches/com.apple.coreaudio.components.plist"))
    54     (subpath "/Library/Audio/Plug-Ins/Components")
    55     (subpath "/Library/Audio/Plug-Ins/HAL")
    56     (subpath "/Library/Video/Plug-Ins")
    57     (subpath "/Library/QuickTime")
     50       ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
     51       (subpath (string-append (param "HOME_DIR") "/Library/Audio/Plug-Ins/Components"))
     52       (subpath (string-append (param "HOME_DIR") "/Library/Preferences/QuickTime Preferences"))
     53       (literal (string-append (param "HOME_DIR") "/Library/Caches/com.apple.coreaudio.components.plist"))
     54       (subpath "/Library/Audio/Plug-Ins/Components")
     55       (subpath "/Library/Audio/Plug-Ins/HAL")
     56       (subpath "/Library/Video/Plug-Ins")
     57       (subpath "/Library/QuickTime")
    5858
    59     ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed.
    60     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.universalaccess.plist"))
     59       ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed.
     60       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.universalaccess.plist"))
    6161
    62     ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed.
    63     (subpath (string-append (param "HOME_DIR") "/Library/Keyboard Layouts"))
     62       ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed.
     63       (subpath (string-append (param "HOME_DIR") "/Library/Keyboard Layouts"))
    6464
    65     ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed.
    66     (subpath (string-append (param "HOME_DIR") "/Library/Input Methods"))
     65       ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed.
     66       (subpath (string-append (param "HOME_DIR") "/Library/Input Methods"))
    6767
    68     ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
    69     (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))
     68       ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
     69       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))
    7070
    71     (subpath (string-append (param "HOME_DIR") "/Library/Dictionaries"))
    72 )
     71       (subpath (string-append (param "HOME_DIR") "/Library/Dictionaries")))
    7372
    7473;; This should be updated when <rdar://problem/9355830> is fixed.
    … …  
    8281;; Writable preferences and temporary files
    8382(allow file*
    84     (subpath (string-append (param "HOME_DIR") "/Library/Caches/com.apple.WebProcess"))
    85     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.HIToolbox\."))
    86     (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.WebProcess\."))
    87     (subpath (string-append (param "HOME_DIR") "/Library/Keychains"))
    88 )
     83       (subpath (string-append (param "HOME_DIR") "/Library/Caches/com.apple.WebProcess"))
     84       (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.HIToolbox\."))
     85       (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.WebProcess\."))
     86       (subpath (string-append (param "HOME_DIR") "/Library/Keychains")))
    8987
    9088;; Darwin temporary files and Security mds caches, if present
    … …  
    10199(if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR")))
    102100    (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR"))))
    103    
     101
    104102;; The NSURLCache directory.
    105103(if (positive? (string-length (param "NSURL_CACHE_DIR")))
    … …  
    112110;; IOKit user clients
    113111(allow iokit-open
    114     (iokit-connection "IOAccelerator")
    115     (iokit-user-client-class "IOAccelerationUserClient")
    116     (iokit-user-client-class "IOFramebufferSharedUserClient")
    117     (iokit-user-client-class "AppleGraphicsControlClient")
    118     (iokit-user-client-class "AGPMClient")
    119     (iokit-user-client-class "IOHIDParamUserClient")
    120     (iokit-user-client-class "RootDomainUserClient")
    121     (iokit-user-client-class "IOSurfaceRootUserClient")
    122     (iokit-user-client-class "IOSurfaceSendRight")
    123     (iokit-user-client-class "IOAudioControlUserClient")
    124     (iokit-user-client-class "IOAudioEngineUserClient")
    125 )
     112       (iokit-connection "IOAccelerator")
     113       (iokit-user-client-class "IOAccelerationUserClient")
     114       (iokit-user-client-class "IOFramebufferSharedUserClient")
     115       (iokit-user-client-class "AppleGraphicsControlClient")
     116       (iokit-user-client-class "AGPMClient")
     117       (iokit-user-client-class "IOHIDParamUserClient")
     118       (iokit-user-client-class "RootDomainUserClient")
     119       (iokit-user-client-class "IOSurfaceRootUserClient")
     120       (iokit-user-client-class "IOSurfaceSendRight")
     121       (iokit-user-client-class "IOAudioControlUserClient")
     122       (iokit-user-client-class "IOAudioEngineUserClient"))
    126123
    127124;; Various services required by AppKit and other frameworks
    128125(allow mach-lookup
    129     (global-name "com.apple.CoreServices.coreservicesd")
    130     (global-name "com.apple.DiskArbitration.diskarbitrationd")
    131     (global-name "com.apple.FileCoordination")
    132     (global-name "com.apple.FontObjectsServer")
    133     (global-name "com.apple.FontServer")
    134     (global-name "com.apple.SecurityServer")
    135     (global-name "com.apple.SystemConfiguration.configd")
    136     (global-name "com.apple.audio.VDCAssistant")
    137     (global-name "com.apple.audio.audiohald")
    138     (global-name "com.apple.audio.coreaudiod")
    139     (global-name "com.apple.cookied")
    140     (global-name "com.apple.cvmsServ")
    141     (global-name "com.apple.networkd")
    142     (global-name "com.apple.dock.server")
    143     (global-name "com.apple.ocspd")
    144     (global-name "com.apple.pasteboard.1")
    145     (global-name "com.apple.system.opendirectoryd.api")
    146     (global-name "com.apple.window_proxies")
    147     (global-name "com.apple.windowserver.active")
    148     (global-name-regex #"^com\.apple\.WebKit\.WebProcess-")
     126       (global-name "com.apple.CoreServices.coreservicesd")
     127       (global-name "com.apple.DiskArbitration.diskarbitrationd")
     128       (global-name "com.apple.FileCoordination")
     129       (global-name "com.apple.FontObjectsServer")
     130       (global-name "com.apple.FontServer")
     131       (global-name "com.apple.SecurityServer")
     132       (global-name "com.apple.SystemConfiguration.configd")
     133       (global-name "com.apple.audio.VDCAssistant")
     134       (global-name "com.apple.audio.audiohald")
     135       (global-name "com.apple.audio.coreaudiod")
     136       (global-name "com.apple.cookied")
     137       (global-name "com.apple.cvmsServ")
     138       (global-name "com.apple.networkd")
     139       (global-name "com.apple.dock.server")
     140       (global-name "com.apple.ocspd")
     141       (global-name "com.apple.pasteboard.1")
     142       (global-name "com.apple.system.opendirectoryd.api")
     143       (global-name "com.apple.window_proxies")
     144       (global-name "com.apple.windowserver.active")
     145       (global-name-regex #"^com\.apple\.WebKit\.WebProcess-")
    149146
    150     ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
    151     (global-name "com.apple.metadata.mds")
    152 )
     147       ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
     148       (global-name "com.apple.metadata.mds"))
    153149
    154150(allow system-socket (socket-domain AF_ROUTE))
    155151(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
    156152(allow network-outbound
    157    ;; Kernel controls
    158    (control-name "com.apple.network.statistics")
    159    (control-name "com.apple.netsrc")
     153       ;; Kernel controls
     154       (control-name "com.apple.network.statistics")
     155       (control-name "com.apple.netsrc")
    160156
    161    ;; Local mDNSResponder for DNS, arbitrary outbound TCP
    162    (literal "/private/var/run/mDNSResponder")
    163    (remote tcp)
    164 )
     157       ;; Local mDNSResponder for DNS, arbitrary outbound TCP
     158       (literal "/private/var/run/mDNSResponder")
     159       (remote tcp))
    165160
    166161;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed.
    … …  
    168163(allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render"))
    169164(allow file-read*
    170    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Safari.RSS.plist"))
    171    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Syndication.plist"))
    172 )
     165       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Safari.RSS.plist"))
     166       (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Syndication.plist")))
    173167
    174168;; Mute violations
Note: See TracChangeset for help on using the changeset viewer.