Modified: trunk/Source/WebKit/ChangeLog (286002 => 286003)
--- trunk/Source/WebKit/ChangeLog 2021-11-18 15:13:13 UTC (rev 286002)
+++ trunk/Source/WebKit/ChangeLog 2021-11-18 15:52:42 UTC (rev 286003)
@@ -1,3 +1,15 @@
+2021-11-18 Per Arne Vollan <[email protected]>
+
+ [macOS] Block access to unused resources in the Networking process' sandbox
+ https://bugs.webkit.org/show_bug.cgi?id=233086
+ <rdar://problem/85376544>
+
+ Reviewed by Brent Fulgham.
+
+ Based on telemetry, block access to unused resources in the Networking process' sandbox on macOS.
+
+ * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+
2021-10-25 Carlos Garcia Campos <[email protected]>
[GTK][a11y] Add initial WTR accessibility support when building with ATSPI
Modified: trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (286002 => 286003)
--- trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2021-11-18 15:13:13 UTC (rev 286002)
+++ trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2021-11-18 15:52:42 UTC (rev 286003)
@@ -38,36 +38,38 @@
#include "Shared/Sandbox/preferences.sb"
-#if PLATFORM(MAC)
-;;;
-;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can
-;;; remove unneeded sandbox extensions.
-;;;
+;; Utility functions for home directory relative path filters
+(define (home-regex home-relative-regex)
+ (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
-(allow mach-register (with telemetry) (local-name-prefix ""))
+(define (home-subpath home-relative-subpath)
+ (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
-(allow mach-lookup (with telemetry) (xpc-service-name-prefix ""))
+(define (home-literal home-relative-literal)
+ (literal (string-append (param "HOME_DIR") home-relative-literal)))
+#if PLATFORM(MAC)
+(deny mach-register (with telemetry) (local-name-prefix ""))
+
(allow system-automount
(process-attribute is-platform-binary))
(allow file-map-executable (with telemetry))
-(allow file-map-executable (with telemetry)
- (subpath "/Library/Apple/System/Library/Frameworks")
- (subpath "/Library/Apple/System/Library/PrivateFrameworks")
- (subpath "/System/Library/Frameworks")
- (subpath "/System/Library/PrivateFrameworks")
- (subpath "/usr/lib")
- (subpath "/usr/local/lib/sanitizers") ;; FIXME(209820)
- (subpath "/usr/appleinternal/lib") ;; <rdar://problem/72317112>
-)
+(allow file-map-executable
+ (home-subpath "/Library/Caches")
+ (home-subpath "/Library/Containers")
+ (subpath (param "DARWIN_USER_TEMP_DIR"))
+ (subpath "/Library/KerberosPlugins")
+ (subpath "/System/Library/Frameworks")
+ (subpath "/System/Library/KerberosPlugins")
+ (subpath "/System/Library/PrivateFrameworks")
+ (subpath "/usr/lib"))
(allow file-read-metadata
- (literal "/var"))
-(allow file-read-metadata (with telemetry)
- (literal "/etc")
- (literal "/tmp")
- (literal "/private/etc/localtime"))
+ (literal "/etc")
+ (literal "/tmp")
+ (literal "/var")
+ (literal "/private/etc/localtime"))
(allow file-read-metadata (with telemetry) (path-ancestors "/System/Volumes/Data/private"))
@@ -76,9 +78,7 @@
(allow file-read*
(subpath "/System"))
-(allow file-read* (with telemetry)
- (subpath "/Library/Apple/System")
- (subpath "/Library/Filesystems/NetFSPlugins")
+(allow file-read*
(subpath "/Library/Preferences/Logging") ; Logging Rethink
#if __MAC_OS_X_VERSION_MIN_REQUIRED < 110000
(subpath "/private/var/db/dyld")
@@ -87,50 +87,30 @@
(subpath "/usr/lib")
(subpath "/usr/share"))
-(allow file-read* (with telemetry)
- (literal "/dev/autofs_nowait")
- (literal "/dev/random")
+(allow file-read*
(literal "/dev/urandom")
(literal "/private/etc/master.passwd")
(literal "/private/etc/passwd")
- (literal "/private/etc/protocols")
(literal "/private/etc/services"))
-(allow file-read* (with telemetry)
- file-write-data
- (literal "/dev/null")
- (literal "/dev/zero"))
-
-(allow file-read* (with telemetry)
- file-write-data
- file-ioctl
+(allow file-read* file-write-data file-ioctl
(literal "/dev/dtracehelper"))
-(allow file-read* (with telemetry)
- (subpath "/usr/local/lib/sanitizers") ;; FIXME(209820)
- (subpath "/usr/appleinternal/lib") ;; <rdar://problem/72317112>
-)
-
-(allow file-write-create (with telemetry)
- (require-all (prefix "/cores/")
- (vnode-type REGULAR-FILE)))
-
-(allow file-read* (with telemetry)
+(allow file-read*
(require-all (subpath "/AppleInternal/Library/Preferences/Logging")
(system-attribute apple-internal)))
-(allow file-read* file-map-executable (with telemetry)
- (require-all (subpath "/usr/local/lib/log")
- (system-attribute apple-internal)))
-
-(allow network-outbound (with telemetry)
+(allow network-outbound
(literal "/private/var/run/syslog"))
-(allow ipc-posix-shm-read* (with telemetry)
- (ipc-posix-name "apple.shm.notification_center")
- (ipc-posix-name-prefix "apple.cfprefs."))
+(allow ipc-posix-shm-read*
+ (ipc-posix-name "apple.shm.notification_center")
+#if !ENABLE(CFPREFS_DIRECT_MODE)
+ (ipc-posix-name-prefix "apple.cfprefs.")
+#endif
+)
-(allow mach-lookup (with telemetry)
+(allow mach-lookup
(global-name "com.apple.system.opendirectoryd.libinfo")
(global-name "com.apple.trustd.agent"))
@@ -138,38 +118,32 @@
(allow mach-lookup
(global-name "com.apple.trustd")))
-(with-filter (system-attribute apple-internal)
- (allow mach-lookup (with telemetry) (global-name "com.apple.internal.objc_trace")))
-
(define (system-network)
- (allow file-read* (with telemetry)
+ (allow file-read*
(literal "/Library/Preferences/com.apple.networkd.plist")
(literal "/private/var/db/nsurlstoraged/dafsaData.bin"))
- (allow mach-lookup (with telemetry)
+ (deny mach-lookup (with telemetry)
(global-name "com.apple.SystemConfiguration.PPPController")
(global-name "com.apple.SystemConfiguration.SCNetworkReachability")
+ (global-name "com.apple.networkd")
+ (global-name "com.apple.nsurlstorage-cache")
+ (global-name "com.apple.symptomsd"))
+ (allow mach-lookup
(global-name "com.apple.dnssd.service")
(global-name "com.apple.nehelper")
(global-name "com.apple.nesessionmanager")
- (global-name "com.apple.networkd")
- (global-name "com.apple.nsurlstorage-cache")
- (global-name "com.apple.symptomsd")
(global-name "com.apple.usymptomsd"))
- (allow network-outbound (with telemetry)
- (control-name "com.apple.netsrc")
- (control-name "com.apple.network.statistics"))
- (allow system-socket (with telemetry)
+ (allow network-outbound
+ (control-name "com.apple.netsrc"))
+ (deny system-socket (with telemetry)
+ (socket-domain AF_ROUTE))
+ (allow system-socket
(require-all (socket-domain AF_SYSTEM)
- (socket-protocol 2)) ; SYSPROTO_CONTROL
- (socket-domain AF_ROUTE))
- (allow mach-lookup (with telemetry)
+ (socket-protocol 2))) ; SYSPROTO_CONTROL
+ (allow mach-lookup
(global-name "com.apple.AppSSO.service-xpc"))
- (allow ipc-posix-shm-read-data (with telemetry)
+ (deny ipc-posix-shm-read-data (with telemetry)
(ipc-posix-name "/com.apple.AppSSO.version")))
-
-;;;
-;;; End rules originally copied from 'system.sb'
-;;;
#else
(import "system.sb")
#endif
@@ -180,50 +154,21 @@
(allow process-info-pidinfo)
(allow process-info-setcontrol (target self))
-(deny sysctl*)
-(allow sysctl-read (with telemetry)
+(deny sysctl* (with telemetry))
+(allow sysctl-read
(sysctl-name
- "hw.activecpu" ;; <rdar://problem/56795575>
- "hw.availcpu"
- "hw.cacheconfig" ;; <rdar://problem/78213563>
- "hw.cachelinesize" ;; <rdar://problem/56795575>
- "hw.cachesize" ;; <rdar://problem/78213563>
- "hw.cpusubfamily"
- "hw.cputhreadtype"
- "hw.l1dcachesize" ;; <rdar://problem/56795575>
- "hw.l1icachesize" ;; <rdar://problem/56795575>
- "hw.l2cachesize" ;; <rdar://problem/56795575>
- "hw.l3cachesize" ;; <rdar://problem/56795575>
- "hw.logicalcpu" ;; <rdar://problem/56795575>
- "hw.logicalcpu_max" ;; <rdar://problem/56795575>
"hw.memsize"
- "hw.model" ;; Needed for bundle loading
"hw.ncpu"
- "hw.nperflevels" ;; <rdar://problem/76783596>
- "hw.pagesize" ;; <rdar://problem/76783596>
- "hw.pagesize_compat" ;; <rdar://problem/76783596>
- "hw.physicalcpu" ;; <rdar://problem/58416475>
- "hw.physicalcpu_max" ;; <rdar://problem/58416475>
- "hw.physmem" ;; <rdar://problem/76782530>
- "kern.hostname"
- "kern.hv_vmm_present"
"kern.maxfilesperproc"
- "kern.memorystatus_level"
"kern.osproductversion" ;; Needed by CFNetwork (HSTS store and others)
+ "kern.ostype"
"kern.osversion" ;; Needed by WebKit and ASL logging.
"kern.tcsm_available" ;; Needed for IndexedDB support.
- "kern.tcsm_enable"
- "kern.ostype"
- "kern.version"
- "sysctl.name2oid"
- "vm.footprint_suspend")
+ "kern.tcsm_enable")
(sysctl-name-prefix "kern.proc.pid.")
- (sysctl-name-prefix "net.routetable")
- (sysctl-name-prefix "hw.optional.") ;; <rdar://problem/71462790>
- (sysctl-name-prefix "hw.perflevel") ;; <rdar://problem/76783596>
-)
+ (sysctl-name-prefix "net.routetable"))
-(allow sysctl-write (with telemetry)
+(allow sysctl-write
(sysctl-name
"kern.tcsm_enable"))
@@ -246,19 +191,6 @@
(deny mach-lookup (xpc-service-name-prefix ""))
-;; Utility functions for home directory relative path filters
-(define (home-regex home-relative-regex)
- (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
-
-(define (home-subpath home-relative-subpath)
- (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
-
-(define (home-literal home-relative-literal)
- (literal (string-append (param "HOME_DIR") home-relative-literal)))
-
-;; CFNetwork
-(allow file-read-data (with telemetry) (path "/private/var/db/nsurlstoraged/dafsaData.bin"))
-
;; Remove when <rdar://problem/29646094> is fixed.
(define (HEX-pattern-match-generator pattern-descriptor)
(letrec ((pattern-string ""))
@@ -295,29 +227,25 @@
"com.apple.ist.ds.appleconnect2.uat" ;; Remove after <rdar://problem/35542803> ships
"com.apple.networkConnect")
-(allow file-read* (with telemetry)
+(allow file-read*
;; Basic system paths
(subpath "/Library/Frameworks")
(subpath "/Library/Managed Preferences")
- ;; System and user preferences
- (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$")
-
;; On-disk WebKit2 framework location, to account for debug installations
;; outside of /System/Library/Frameworks
(subpath (param "WEBKIT2_FRAMEWORK_DIR")))
-(allow system-fsctl (with telemetry) (fsctl-command (_IO "h" 47)))
-(allow file-read-data (with telemetry)
+(allow file-read-data
(literal "/usr/local/lib/log") ; <rdar://problem/36629495>
)
;; Sandbox extensions
(define (apply-read-and-issue-extension op path-filter)
- (op file-read* (with telemetry) path-filter)
+ (op file-read* path-filter)
(op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
(define (apply-write-and-issue-extension op path-filter)
- (op file-write* (with telemetry) path-filter)
+ (op file-write* path-filter)
(op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
(define (read-only-and-issue-extensions path-filter)
(apply-read-and-issue-extension allow path-filter))
@@ -327,32 +255,27 @@
(read-only-and-issue-extensions (extension "com.apple.app-sandbox.read"))
(read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write"))
-(allow file-read* file-write* (with telemetry) (subpath (param "DARWIN_USER_CACHE_DIR")))
+(allow file-read* file-write* (subpath (param "DARWIN_USER_CACHE_DIR")))
-(allow file-read* file-write* (with telemetry) (subpath (param "DARWIN_USER_TEMP_DIR")))
+(allow file-read* file-write* (subpath (param "DARWIN_USER_TEMP_DIR")))
;; IOKit user clients
-(allow iokit-open (with telemetry)
+(allow iokit-open
(iokit-user-client-class "RootDomainUserClient") ; Used by PowerObserver
)
-;; cookied.
-;; FIXME: Update for <rdar://problem/13642852>.
-(allow ipc-posix-shm-read-data (with telemetry)
- (ipc-posix-name "FNetwork.defaultStorageSession")
- (ipc-posix-name-regex #"\.PrivateBrowsing-")
- (ipc-posix-name-prefix "^WebKit Test-")
- (ipc-posix-name "/com.apple.AppSSO.version")
-)
+(deny mach-lookup (with telemetry)
+ (global-name "com.apple.PowerManagement.control"))
;; Various services required by CFNetwork and other frameworks
-(allow mach-lookup (with telemetry)
+(allow mach-lookup
(global-name "com.apple.FileCoordination")
- (global-name "com.apple.PowerManagement.control")
(global-name "com.apple.SystemConfiguration.configd")
- (global-name "com.apple.cookied")
(global-name "com.apple.cfnetwork.AuthBrokerAgent")
(global-name "com.apple.cfnetwork.cfnetworkagent")
+#if __MAC_OS_X_VERSION_MIN_REQUIRED < 120000
+ (global-name "com.apple.cookied")
+#endif
(global-name "com.apple.ist.ds.appleconnect2.service.kdctunnelcontroller")
(global-name "com.apple.logd")
(global-name "com.apple.logd.events")
@@ -359,9 +282,7 @@
(global-name "com.apple.lsd.mapdb")
(global-name "com.apple.nesessionmanager.flow-divert-token")
(global-name "com.apple.nesessionmanager.content-filter") ;; <rdar://problem/47598758>
- (global-name "com.apple.system.notification_center")
- (global-name "com.apple.AppSSO.service-xpc")
-)
+ (global-name "com.apple.system.notification_center"))
(with-filter (system-attribute apple-internal)
(allow mach-lookup
@@ -381,17 +302,19 @@
)
)
+(deny mach-lookup (with telemetry)
+ (global-name "com.apple.ctkd.token-client")
+ (global-name "com.apple.securityd.xpc")
+ (global-name "com.apple.CoreAuthentication.agent")
+ (global-name "com.apple.ocspd"))
+
;; Security framework
-(allow mach-lookup (with telemetry)
- (global-name "com.apple.ctkd.token-client")
- (global-name "com.apple.securityd.xpc")
- (global-name "com.apple.CoreAuthentication.agent")
- (global-name "com.apple.ocspd")
- (global-name "com.apple.SecurityServer"))
+(allow mach-lookup
+ (global-name "com.apple.SecurityServer"))
;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
;; Restrict AppSandboxed processes from creating /Library/Keychains, but allow access to the contents of /Library/Keychains:
-(allow file-read-data file-read-metadata file-write* (with telemetry)
+(allow file-read-data file-read-metadata
(subpath "/Library/Keychains")
(home-subpath "/Library/Keychains"))
@@ -400,7 +323,7 @@
(regex (string-append "/Library/Keychains/" (uuid-regex-string) "(/|$)"))
(home-regex (string-append "/Library/Keychains/" (uuid-regex-string) "(/|$)")))
-(allow file-read* (with telemetry) (subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when <rdar://problem/9538414> is fixed.
+(allow file-read* (subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when <rdar://problem/9538414> is fixed.
(with-filter (uid 0)
(allow file-write* (with telemetry)
(subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when <rdar://problem/9538414> is fixed.
@@ -412,17 +335,12 @@
"com.apple.security.common"
"com.apple.security.revocation")
-(allow file-read* (with telemetry)
+(allow file-read*
(subpath "/private/var/db/mds")
- (literal "/private/var/db/DetachedSignatures")
; The following are needed until the causes of <rdar://problem/41487786> are resolved.
(literal "/Library/Preferences/com.apple.security.plist")
- (literal "/Library/Preferences/com.apple.security.common.plist")
- (literal "/Library/Preferences/com.apple.security.revocation.plist")
- (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
(home-literal "/Library/Preferences/com.apple.security.plist")
- (home-literal "/Library/Preferences/com.apple.security.revocation.plist")
; Likewise for <rdar://problem/43310000>
(literal "/Library/Preferences/com.apple.ist.ds.appleconnect2.plist")
@@ -433,21 +351,20 @@
(home-regex (string-append "/Library/Preferences/ByHost/com\.apple\.ist\.ds\.appleconnect2\.production\." (uuid-regex-string) "\.plist$"))
)
-(allow ipc-posix-shm-read* ipc-posix-shm-write-create ipc-posix-shm-write-data (with telemetry)
+(allow ipc-posix-shm-read* ipc-posix-shm-write-create ipc-posix-shm-write-data
(ipc-posix-name "com.apple.AppleDatabaseChanged"))
(system-network)
-(allow network-outbound (with telemetry)
+(allow network-outbound
;; Local mDNSResponder for DNS, arbitrary outbound TCP
(literal "/private/var/run/mDNSResponder")
(remote tcp))
;; FIXME should be removed when <rdar://problem/9347205> + related radar in Safari is fixed
-(allow mach-lookup (with telemetry)
+(allow mach-lookup
(global-name "org.h5l.kcm")
(global-name "com.apple.GSSCred")
- (global-name "com.apple.ist.ds.appleconnect.service.kdctunnel") ;; Remove after <rdar://problem/35542803> ships
- (global-name "com.apple.system.logger"))
+ (global-name "com.apple.ist.ds.appleconnect.service.kdctunnel")) ;; Remove after <rdar://problem/35542803> ships
(allow network-outbound (with telemetry)
(remote udp))
(shared-preferences-read
@@ -454,8 +371,7 @@
"com.apple.GSS"
"com.apple.Kerberos"
"edu.mit.Kerberos")
-(allow file-read* (with telemetry)
- (literal "/private/etc/krb5.conf")
+(allow file-read*
(literal "/private/etc/services")
(literal "/private/etc/hosts")
(subpath "/Library/KerberosPlugins/GSSAPI")
@@ -513,27 +429,29 @@
(remote tcp))
;; For reporting progress for active downloads <rdar://problem/44405661>
-(allow mach-lookup (with telemetry)
+(allow mach-lookup
(global-name "com.apple.ProgressReporting"))
;; Needed for TCC.
-(allow mach-lookup (with telemetry)
+(allow mach-lookup
(global-name "com.apple.tccd"))
-(allow file-read* file-write* (with telemetry)
+(allow file-read* file-write*
(home-subpath "/Library/HTTPStorages"))
-(allow file-read* (with telemetry)
- (prefix "/private/var/db/com.apple.networkextension.")
-)
+(allow file-read*
+ (prefix "/private/var/db/com.apple.networkextension."))
(when (defined? 'syscall-unix)
(allow syscall-unix (with telemetry))
(allow syscall-unix (syscall-number
SYS___channel_get_info
+ SYS___channel_open
SYS___channel_sync
SYS___disable_threadsignal
SYS___mac_syscall
+ SYS___pthread_sigmask
+ SYS___semwait_signal
SYS_access
SYS_bsdthread_create
SYS_bsdthread_ctl
@@ -540,33 +458,62 @@
SYS_bsdthread_terminate
SYS_change_fdguard_np
SYS_csrctl
+ SYS_dup
+ SYS_exit
SYS_fcntl
SYS_fcntl_nocancel
+ SYS_fgetattrlist
+ SYS_fileport_makeport
+ SYS_flock
SYS_fsgetpath
SYS_fstat
+ SYS_fstat64
SYS_fstatat
+ SYS_fstatat64
SYS_fstatfs
+ SYS_fstatfs64
SYS_fsync
SYS_ftruncate
SYS_getattrlist
SYS_getaudit_addr
SYS_getdirentries
+ SYS_getdirentries64
+ SYS_getegid
SYS_getentropy
SYS_geteuid
SYS_getfsstat
+ SYS_getfsstat64
+ SYS_getgid
+ SYS_getgroups
+ SYS_getpeername
SYS_getrlimit
+ SYS_getsockname
+ SYS_getsockopt
+ SYS_gettid
SYS_gettimeofday
SYS_getuid
+ SYS_getxattr
SYS_guarded_close_np
+ SYS_guarded_open_dprotected_np
SYS_guarded_open_np
SYS_guarded_pwrite_np
SYS_iopolicysys
SYS_issetugid
+ SYS_kdebug_trace64
+ SYS_kdebug_trace_string
+ SYS_kdebug_typefilter
+ SYS_kevent
SYS_kevent_id
SYS_kevent_qos
+ SYS_kqueue
+ SYS_listxattr
SYS_lseek
SYS_lstat
+ SYS_lstat64
+ SYS_lstat64_extended
SYS_madvise
+ SYS_memorystatus_control
+ SYS_mkdir
SYS_mkdirat
SYS_mmap
SYS_mprotect
@@ -574,23 +521,46 @@
SYS_munmap
SYS_necp_client_action
SYS_necp_open
+ SYS_open_dprotected_np
SYS_pathconf
+ SYS_pipe
SYS_pread
SYS_pread_nocancel
+ SYS_pselect
SYS_psynch_cvbroad
+ SYS_psynch_cvclrprepost
SYS_psynch_cvsignal
SYS_psynch_cvwait
SYS_psynch_mutexdrop
SYS_psynch_mutexwait
+ SYS_psynch_rw_rdlock
SYS_psynch_rw_unlock
SYS_psynch_rw_wrlock
SYS_read
+ SYS_read_nocancel
+ SYS_readlink
+ SYS_recvfrom
+ SYS_recvfrom_nocancel
+ SYS_recvmsg
+ SYS_rename
SYS_rmdir
SYS_select
+ SYS_select_nocancel
+ SYS_sendmsg
+ SYS_sendmsg_nocancel
+ SYS_sendto
+ SYS_sendto_nocancel
SYS_setattrlistat
SYS_setrlimit
+ SYS_setsockopt
+ SYS_shutdown
+ SYS_sigaltstack
+ SYS_socketpair
SYS_stat
+ SYS_stat64
+ SYS_stat64_extended
SYS_statfs
+ SYS_statfs64
SYS_thread_selfid
SYS_ulock_wait
SYS_ulock_wake
