Title: [212870] trunk/Source/WebKit2
- Revision
- 212870
- Author
- [email protected]
- Date
- 2017-02-22 17:58:50 -0800 (Wed, 22 Feb 2017)
Log Message
[Mac] Tighten sandbox to deny process-info* access
https://bugs.webkit.org/show_bug.cgi?id=168704
<rdar://problem/16371441>
Reviewed by Alex Christensen.
Tighten the various WebKit sandboxes by denying access to process-info.
Add back specific features needed to run WebKit tests and to do browsing
of websites (including plugins).
* DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in:
* NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
* WebProcess/com.apple.WebProcess.sb.in:
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (212869 => 212870)
--- trunk/Source/WebKit2/ChangeLog 2017-02-23 01:55:05 UTC (rev 212869)
+++ trunk/Source/WebKit2/ChangeLog 2017-02-23 01:58:50 UTC (rev 212870)
@@ -1,3 +1,20 @@
+2017-02-22 Brent Fulgham <[email protected]>
+
+ [Mac] Tighten sandbox to deny process-info* access
+ https://bugs.webkit.org/show_bug.cgi?id=168704
+ <rdar://problem/16371441>
+
+ Reviewed by Alex Christensen.
+
+ Tighten the various WebKit sandboxes by denying access to process-info.
+ Add back specific features needed to run WebKit tests and to do browsing
+ of websites (including plugins).
+
+ * DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in:
+ * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+ * PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
+ * WebProcess/com.apple.WebProcess.sb.in:
+
2017-02-22 Anders Carlsson <[email protected]>
Crash if there's a mismatch between the WebKit used by the UI process and child processes respectively
Modified: trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in (212869 => 212870)
--- trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in 2017-02-23 01:55:05 UTC (rev 212869)
+++ trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in 2017-02-23 01:58:50 UTC (rev 212870)
@@ -27,6 +27,11 @@
(import "system.sb")
+;;; process-info* defaults to allow; deny it and then allow operations we actually need.
+(deny process-info*)
+(allow process-info-pidinfo)
+(allow process-info-setcontrol (target self))
+
;; Utility functions for home directory relative path filters
(define (home-regex home-relative-regex)
(regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
Modified: trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (212869 => 212870)
--- trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2017-02-23 01:55:05 UTC (rev 212869)
+++ trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2017-02-23 01:58:50 UTC (rev 212870)
@@ -27,6 +27,11 @@
(import "system.sb")
+;;; process-info* defaults to allow; deny it and then allow operations we actually need.
+(deny process-info*)
+(allow process-info-pidinfo)
+(allow process-info-setcontrol (target self))
+
;; Utility functions for home directory relative path filters
(define (home-regex home-relative-regex)
(regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
Modified: trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in (212869 => 212870)
--- trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in 2017-02-23 01:55:05 UTC (rev 212869)
+++ trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in 2017-02-23 01:58:50 UTC (rev 212870)
@@ -27,6 +27,11 @@
(import "system.sb")
+;;; process-info* defaults to allow; deny it and then allow operations we actually need.
+(deny process-info*)
+(allow process-info-pidinfo)
+(allow process-info-setcontrol (target self))
+
;; Utility functions
(define (home-literal home-relative-literal)
(literal (string-append (param "HOME_DIR") home-relative-literal)))
Modified: trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in (212869 => 212870)
--- trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in 2017-02-23 01:55:05 UTC (rev 212869)
+++ trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in 2017-02-23 01:58:50 UTC (rev 212870)
@@ -27,6 +27,12 @@
(import "system.sb")
+;;; process-info* defaults to allow; deny it and then allow operations we actually need.
+(deny process-info*)
+(allow process-info-pidinfo)
+(allow process-info-setcontrol (target self))
+(allow process-codesigning-status*)
+
;; Utility functions for home directory relative path filters
(define (home-regex home-relative-regex)
(regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
