133750 2014-06-11 10:59:51 -0700 Restrict database process profile 2014-06-11 13:24:15 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 oliver oliver oldest_to_newest 1014809 0 oliver 2014-06-11 10:59:51 -0700 Restrict database process profile 1014810 1 232875 oliver 2014-06-11 11:00:24 -0700 Created attachment 232875 Patch 1014820 2 232875 ap 2014-06-11 11:32:22 -0700 Comment on attachment 232875 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=232875&action=review > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb:47 > +;; FIXME: Should be removed once <rdar://problem/16329087> is fixed. > +(deny file-write-xattr (xattr "com.apple.quarantine") (with no-log)) Please remove this, there is no quarantine. > Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb:50 > +;; Reserve a namespace for additional protected extended attributes. > +(deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\.")) Do any iOS profiles have this, or is it an OS X only thing? 1014877 3 oliver 2014-06-11 13:24:15 -0700 Committed r169821: <http://trac.webkit.org/changeset/169821> 232875 2014-06-11 11:00:24 -0700 2014-06-11 11:32:22 -0700 Patch bug-133750-20140611105959.patch text/plain 3384 oliver U3VidmVyc2lvbiBSZXZpc2lvbjogMTY5NzU5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cKaW5kZXggYzI4YjJmODdlNGYyNDE2 MzMyNzBkYTQ0NGIxNzU3YjIzNTNjYzcwMi4uZTU0N2M5NTgxM2I5MGZiNjY4NTAwNTMzNTk2N2Yx NmUwNGMyMWNhYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDE0LTA2LTExICBPbGl2 ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CisKKyAgICAgICAgUmVzdHJpY3QgZGF0YWJhc2Ug cHJvY2VzcyBwcm9maWxlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xMzM3NTAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBNYWtlIHRoZSBzYW5kYm94IHByb2ZpbGUgbXVjaCBtb3JlIHJlc3RyaWN0aXZlLgor CisgICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktp dC5EYXRhYmFzZXMuc2I6CisKIDIwMTQtMDYtMTAgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxl LmNvbT4KIAogICAgICAgICBBZGQgcHJvY2VzcyBlbnRpdGxlbWVudHMKZGlmZiAtLWdpdCBhL1Nv dXJjZS9XZWJLaXQyL1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJL aXQuRGF0YWJhc2VzLnNiIGIvU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxl cy9pb3MvY29tLmFwcGxlLldlYktpdC5EYXRhYmFzZXMuc2IKaW5kZXggODc5YzUyMDZiM2YzOTZh ODdlNjhlNjdmNmNkZmE5NTFkOTZlN2QwOC4uMDcyN2I4OTNiODc4N2FhOGI1OGQxMDI2MzU0N2Q4 MjQ0YmNhMTQ4NyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvUmVzb3VyY2VzL1NhbmRib3hQ cm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5EYXRhYmFzZXMuc2IKKysrIGIvU291cmNlL1dl YktpdDIvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5EYXRh YmFzZXMuc2IKQEAgLTQsMTAgKzQsMTAgQEAKIDsgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVk IHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zCiA7IGFyZSBtZXQ6CiA7IDEu IFJlZGlzdHJpYnV0aW9ucyBvZiBzb3VyY2UgY29kZSBtdXN0IHJldGFpbiB0aGUgYWJvdmUgY29w eXJpZ2h0Ci07IG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dp bmcgZGlzY2xhaW1lci4KKzsgICAgbm90aWNlLCB0aGlzIGxpc3Qgb2YgY29uZGl0aW9ucyBhbmQg dGhlIGZvbGxvd2luZyBkaXNjbGFpbWVyLgogOyAyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5 IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodAotOyBub3RpY2UsIHRoaXMg bGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlCi07 IGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBk aXN0cmlidXRpb24uCis7ICAgIG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRo ZSBmb2xsb3dpbmcgZGlzY2xhaW1lciBpbiB0aGUKKzsgICAgZG9jdW1lbnRhdGlvbiBhbmQvb3Ig b3RoZXIgbWF0ZXJpYWxzIHByb3ZpZGVkIHdpdGggdGhlIGRpc3RyaWJ1dGlvbi4KIDsKIDsgVEhJ UyBTT0ZUV0FSRSBJUyBQUk9WSURFRCBCWSBBUFBMRSBJTkMuIEFORCBJVFMgQ09OVFJJQlVUT1JT IGBgQVMgSVMnJwogOyBBTkQgQU5ZIEVYUFJFU1MgT1IgSU1QTElFRCBXQVJSQU5USUVTLCBJTkNM VURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywKQEAgLTIyLDcgKzIyLDMyIEBACiA7IFRIRSBQT1NT SUJJTElUWSBPRiBTVUNIIERBTUFHRS4KIAogKHZlcnNpb24gMSkKLShhbGxvdyBkZWZhdWx0KQor KGRlbnkgZGVmYXVsdCAod2l0aCBwYXJ0aWFsLXN5bWJvbGljYXRpb24pKQorKGFsbG93IHN5c3Rl bS1hdWRpdCBmaWxlLXJlYWQtbWV0YWRhdGEpCiAKIChpbXBvcnQgImNvbW1vbi5zYiIpCiAoaW1w b3J0ICJyZW1vdmVkLWRldi1ub2Rlcy5zYiIpCisKKzs7IFNhbmRib3ggZXh0ZW5zaW9ucworKGRl ZmluZSAoYXBwbHktcmVhZC1hbmQtaXNzdWUtZXh0ZW5zaW9uIG9wIHBhdGgtZmlsdGVyKQorICAg IChvcCBmaWxlLXJlYWQqIHBhdGgtZmlsdGVyKQorICAgIChvcCBmaWxlLWlzc3VlLWV4dGVuc2lv biAocmVxdWlyZS1hbGwgKGV4dGVuc2lvbi1jbGFzcyAiY29tLmFwcGxlLmFwcC1zYW5kYm94LnJl YWQiKSBwYXRoLWZpbHRlcikpKQorKGRlZmluZSAoYXBwbHktd3JpdGUtYW5kLWlzc3VlLWV4dGVu c2lvbiBvcCBwYXRoLWZpbHRlcikKKyAgICAob3AgZmlsZS13cml0ZSogcGF0aC1maWx0ZXIpCisg ICAgKG9wIGZpbGUtaXNzdWUtZXh0ZW5zaW9uIChyZXF1aXJlLWFsbCAoZXh0ZW5zaW9uLWNsYXNz ICJjb20uYXBwbGUuYXBwLXNhbmRib3gucmVhZC13cml0ZSIpIHBhdGgtZmlsdGVyKSkpCisoZGVm aW5lIChyZWFkLW9ubHktYW5kLWlzc3VlLWV4dGVuc2lvbnMgcGF0aC1maWx0ZXIpCisgICAgKGFw cGx5LXJlYWQtYW5kLWlzc3VlLWV4dGVuc2lvbiBhbGxvdyBwYXRoLWZpbHRlcikpCisoZGVmaW5l IChyZWFkLXdyaXRlLWFuZC1pc3N1ZS1leHRlbnNpb25zIHBhdGgtZmlsdGVyKQorICAgIChhcHBs eS1yZWFkLWFuZC1pc3N1ZS1leHRlbnNpb24gYWxsb3cgcGF0aC1maWx0ZXIpCisgICAgKGFwcGx5 LXdyaXRlLWFuZC1pc3N1ZS1leHRlbnNpb24gYWxsb3cgcGF0aC1maWx0ZXIpKQorKHJlYWQtb25s eS1hbmQtaXNzdWUtZXh0ZW5zaW9ucyAoZXh0ZW5zaW9uICJjb20uYXBwbGUuYXBwLXNhbmRib3gu cmVhZCIpKQorKHJlYWQtd3JpdGUtYW5kLWlzc3VlLWV4dGVuc2lvbnMgKGV4dGVuc2lvbiAiY29t LmFwcGxlLmFwcC1zYW5kYm94LnJlYWQtd3JpdGUiKSkKKworOzsgRklYTUU6IFNob3VsZCBiZSBy ZW1vdmVkIG9uY2UgPHJkYXI6Ly9wcm9ibGVtLzE2MzI5MDg3PiBpcyBmaXhlZC4KKyhkZW55IGZp bGUtd3JpdGUteGF0dHIgKHhhdHRyICJjb20uYXBwbGUucXVhcmFudGluZSIpICh3aXRoIG5vLWxv ZykpCisKKzs7IFJlc2VydmUgYSBuYW1lc3BhY2UgZm9yIGFkZGl0aW9uYWwgcHJvdGVjdGVkIGV4 dGVuZGVkIGF0dHJpYnV0ZXMuCisoZGVueSBmaWxlLXJlYWQteGF0dHIgZmlsZS13cml0ZS14YXR0 ciAoeGF0dHItcmVnZXggIyJeY29tXC5hcHBsZVwuc2VjdXJpdHlcLnByaXZhdGVcLiIpKQorCiso aWYgKGRlZmluZWQ/ICd2bm9kZS10eXBlKQorICAgIChkZW55IGZpbGUtd3JpdGUtY3JlYXRlICh2 bm9kZS10eXBlIFNZTUxJTkspKSkK