Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3e277d994fe5fa7482b96d1dd87e0e7643803d42
https://github.com/WebKit/WebKit/commit/3e277d994fe5fa7482b96d1dd87e0e7643803d42
Author: Chris Dumez <[email protected]>
Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths:
M Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in
M Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in
M Source/WebKit/Shared/Sandbox/iOS/gpu-defines.sb
M Source/WebKit/Shared/Sandbox/iOS/networking-defines.sb
M Source/WebKit/Shared/Sandbox/iOS/webcontent-defines.sb
M Source/WebKit/WebProcess/com.apple.WebProcess.sb.in
M Source/WebKit/WebProcess/com.apple.WebProcess.x86.sb.in
Log Message:
-----------
[Sandboxing] Update sandbox profiles to allow the `*at` counterparts to some
syscalls
https://bugs.webkit.org/show_bug.cgi?id=319647
rdar://181861452
Reviewed by Sihui Liu.
Whereever we
allow:
```
`SYS_rename`
`SYS_open_dprotected_np`
`SYS_open`
```
We need to also allow:
```
`SYS_renameat`
`SYS_openat_dprotected_np`
`SYS_openat`
```
This is to unblock an underlying framework.
* Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* Source/WebKit/Shared/Sandbox/iOS/gpu-defines.sb:
* Source/WebKit/Shared/Sandbox/iOS/networking-defines.sb:
* Source/WebKit/Shared/Sandbox/iOS/webcontent-defines.sb:
* Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:
* Source/WebKit/WebProcess/com.apple.WebProcess.x86.sb.in:
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dp7X1c6kX1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3NTk0QG1haW4=&emid=aa89ca76-f4dc-484e-88a8-283adf159d3a&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
