Title: [276821] trunk/Source/WebKit
- Revision
- 276821
- Author
- [email protected]
- Date
- 2021-04-29 16:41:09 -0700 (Thu, 29 Apr 2021)
Log Message
[iOS] Remove unused logd-diagnostic-client rules
https://bugs.webkit.org/show_bug.cgi?id=225214
<rdar://problem/66587621>
Reviewed by Per Arne Vollan.
WebKit does not have either of the two entitlements required to use the 'log-diagnostic-client' rules.
We should remove these rules from the sandbox to reduce attack surface, since they provide no benefit.
* Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
* Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
* Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
* Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (276820 => 276821)
--- trunk/Source/WebKit/ChangeLog 2021-04-29 23:35:41 UTC (rev 276820)
+++ trunk/Source/WebKit/ChangeLog 2021-04-29 23:41:09 UTC (rev 276821)
@@ -1,3 +1,19 @@
+2021-04-29 Brent Fulgham <[email protected]>
+
+ [iOS] Remove unused logd-diagnostic-client rules
+ https://bugs.webkit.org/show_bug.cgi?id=225214
+ <rdar://problem/66587621>
+
+ Reviewed by Per Arne Vollan.
+
+ WebKit does not have either of the two entitlements required to use the 'log-diagnostic-client' rules.
+ We should remove these rules from the sandbox to reduce attack surface, since they provide no benefit.
+
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
2021-04-29 Peng Liu <[email protected]>
[GPUP] Two message loops between WebContent process and GPU process to enable/select audio/video tracks
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb (276820 => 276821)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb 2021-04-29 23:35:41 UTC (rev 276820)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb 2021-04-29 23:41:09 UTC (rev 276821)
@@ -352,22 +352,6 @@
(allow file-read* file-write-data file-ioctl
(literal "/dev/aes_0")))
-(define-once (logd-diagnostic-paths)
- (require-any
- (subpath "/private/var/db/diagnostics")
- (subpath "/private/var/db/timesync")
- (subpath "/private/var/db/uuidtext")
- (subpath "/private/var/userdata/diagnostics")))
-(define-once (logd-diagnostic-client)
- (with-filter
- (require-all
- (require-any
- (require-entitlement "com.apple.private.logging.diagnostic")
- (require-entitlement "com.apple.diagnosticd.diagnostic"))
- (extension "com.apple.logd.read-only"))
- (allow file-read*
- (logd-diagnostic-paths))))
-
(define required-etc-files
(literal "/private/etc/fstab"
"/private/etc/hosts"
@@ -630,8 +614,6 @@
(allow mach-lookup (with report) (with telemetry)
(global-name "com.apple.diagnosticd"))
-(logd-diagnostic-client)
-
(managed-configuration-read-public)
(deny system-info (with no-report)
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (276820 => 276821)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb 2021-04-29 23:35:41 UTC (rev 276820)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb 2021-04-29 23:41:09 UTC (rev 276821)
@@ -279,22 +279,6 @@
(allow mach-lookup
(global-name "com.apple.osanalytics.osanalyticshelper")))
-(define-once (logd-diagnostic-paths)
- (require-any
- (subpath "/private/var/db/diagnostics")
- (subpath "/private/var/db/timesync")
- (subpath "/private/var/db/uuidtext")
- (subpath "/private/var/userdata/diagnostics")))
-(define-once (logd-diagnostic-client)
- (with-filter
- (require-all
- (require-any
- (require-entitlement "com.apple.private.logging.diagnostic")
- (require-entitlement "com.apple.diagnosticd.diagnostic"))
- (extension "com.apple.logd.read-only"))
- (allow file-read*
- (logd-diagnostic-paths))))
-
(define required-etc-files
(literal "/private/etc/fstab"
"/private/etc/hosts"
@@ -509,8 +493,6 @@
(global-name "com.apple.aggregated")
)
-(logd-diagnostic-client)
-
(managed-configuration-read-public)
(allow mach-lookup (with report) (with telemetry)
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb (276820 => 276821)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb 2021-04-29 23:35:41 UTC (rev 276820)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb 2021-04-29 23:41:09 UTC (rev 276821)
@@ -149,22 +149,6 @@
(allow file-read* file-write-data file-ioctl
(literal "/dev/aes_0")))
-(define-once (logd-diagnostic-paths)
- (require-any
- (subpath "/private/var/db/diagnostics")
- (subpath "/private/var/db/timesync")
- (subpath "/private/var/db/uuidtext")
- (subpath "/private/var/userdata/diagnostics")))
-(define-once (logd-diagnostic-client)
- (with-filter
- (require-all
- (require-any
- (require-entitlement "com.apple.private.logging.diagnostic")
- (require-entitlement "com.apple.diagnosticd.diagnostic"))
- (extension "com.apple.logd.read-only"))
- (allow file-read*
- (logd-diagnostic-paths))))
-
(define required-etc-files
(literal "/private/etc/fstab"
"/private/etc/hosts"
@@ -399,8 +383,6 @@
(allow mach-lookup (with report) (with telemetry)
(global-name "com.apple.diagnosticd"))
-(logd-diagnostic-client)
-
(managed-configuration-read-public)
(deny system-info (with no-report)
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (276820 => 276821)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2021-04-29 23:35:41 UTC (rev 276820)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2021-04-29 23:41:09 UTC (rev 276821)
@@ -386,22 +386,6 @@
(allow file-read* file-write-data file-ioctl
(literal "/dev/aes_0")))
-(define-once (logd-diagnostic-paths)
- (require-any
- (subpath "/private/var/db/diagnostics")
- (subpath "/private/var/db/timesync")
- (subpath "/private/var/db/uuidtext")
- (subpath "/private/var/userdata/diagnostics")))
-(define-once (logd-diagnostic-client)
- (with-filter
- (require-all
- (require-any
- (require-entitlement "com.apple.private.logging.diagnostic")
- (require-entitlement "com.apple.diagnosticd.diagnostic"))
- (extension "com.apple.logd.read-only"))
- (allow file-read*
- (logd-diagnostic-paths))))
-
(define required-etc-files
(literal "/private/etc/fstab"
"/private/etc/hosts"
@@ -749,8 +733,6 @@
(allow ipc-posix-shm-read*
(ipc-posix-name "apple.shm.notification_center"))
-(logd-diagnostic-client)
-
(managed-configuration-read-public)
(deny system-info (with no-report)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
