156668 2016-04-16 14:30:39 -0700 [Mac] Web Content service with a restricted entitlement may load arbitrary dylibs 2017-06-15 10:45:33 -0700 1 1 1 Unclassified WebKit WebKit2 Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 173424 1 mitz mitz sam thorton oldest_to_newest 1184384 0 mitz 2016-04-16 14:30:39 -0700 <rdar://problem/25429784> When the changes for bug 155414 are in effect, the Web Content service is signed with a restricted entitlement but isn’t guarded against loading arbitrary dylibs. 1184385 1 276563 mitz 2016-04-16 14:34:51 -0700 Created attachment 276563 Enable library validation when needed 1184386 2 mitz 2016-04-16 14:37:08 -0700 Fixed in <http://trac.webkit.org/r199628>. 1202072 3 mitz 2016-06-13 20:27:51 -0700 This was reverted in <http://trac.webkit.org/r200172>. 1202073 4 mitz 2016-06-13 20:31:23 -0700 Using <rdar://problem/26714558> to reenable in macOS Sierra and later. 1202074 5 281230 mitz 2016-06-13 20:34:52 -0700 Created attachment 281230 Enable library validation when needed 1202079 6 mitz 2016-06-13 21:01:35 -0700 Committed <http://trac.webkit.org/r202024>. 1221662 7 mitz 2016-08-20 12:51:10 -0700 Can do this for El Capitan as well now. 1221663 8 286544 mitz 2016-08-20 12:53:06 -0700 Created attachment 286544 Enable library validation for El Capitan too 1221667 9 mitz 2016-08-20 15:02:09 -0700 Committed <https://trac.webkit.org/r204682>. 276563 2016-04-16 14:34:51 -0700 2016-06-13 20:28:08 -0700 Enable library validation when needed bug-156668-20160416143506.patch text/plain 2293 mitz SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDE5OTYyNykKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE2LTA0LTE2ICBEYW4gQmVy bnN0ZWluICA8bWl0ekBhcHBsZS5jb20+CisKKyAgICAgICAgW01hY10gV2ViIENvbnRlbnQgc2Vy dmljZSB3aXRoIGEgcmVzdHJpY3RlZCBlbnRpdGxlbWVudCBtYXkgbG9hZCBhcmJpdHJhcnkgZHls aWJzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTY2 NjgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI1NDI5Nzg0PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogQ29uZmlndXJhdGlvbnMvV2ViQ29udGVu dFNlcnZpY2UueGNjb25maWc6IEVuYWJsZSBsaWJyYXJ5IHZhbGlkYXRpb24gd2hlbiB0aGUgV2Vi IENvbnRlbnQKKyAgICAgICAgICBzZXJ2aWNlIGlzIGdpdmVuIHRoZSBYUEMgZG9tYWluIGV4dGVu c2lvbiBlbnRpdGxlbWVudC4KKwogMjAxNi0wNC0xNSAgRGFuIEJlcm5zdGVpbiAgPG1pdHpAYXBw bGUuY29tPgogCiAgICAgICAgIFtNYWNdIFdlYkNvbnRlbnQsIE5ldHdvcmtpbmcgYW5kIERhdGFi YXNlcyBzZXJ2aWNlcyBoYXZlIGkzODYgc2xpY2VzIHRoYXQgYXJlIG5ldmVyIHVzZWQKSW5kZXg6 IFNvdXJjZS9XZWJLaXQyL0NvbmZpZ3VyYXRpb25zL1dlYkNvbnRlbnRTZXJ2aWNlLnhjY29uZmln Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJLaXQyL0NvbmZpZ3VyYXRpb25zL1dlYkNvbnRlbnRT ZXJ2aWNlLnhjY29uZmlnCShyZXZpc2lvbiAxOTk2MjQpCisrKyBTb3VyY2UvV2ViS2l0Mi9Db25m aWd1cmF0aW9ucy9XZWJDb250ZW50U2VydmljZS54Y2NvbmZpZwkod29ya2luZyBjb3B5KQpAQCAt MjcsNiArMjcsNyBAQCBXS19YUENfU0VSVklDRV9JT1NfRU5USVRMRU1FTlRTX0JBU0UgPSBXCiAK IENPREVfU0lHTl9FTlRJVExFTUVOVFNbc2RrPW1hY29zeCpdID0gJChDT0RFX1NJR05fRU5USVRM RU1FTlRTX09TWF9XSVRIX1hQQ19ET01BSU5fRVhURU5TSU9OXyQoV0tfV0VCQ09OVEVOVF9TRVJW SUNFX05FRURTX1hQQ19ET01BSU5fRVhURU5TSU9OX0VOVElUTEVNRU5UKSk7CiBDT0RFX1NJR05f RU5USVRMRU1FTlRTX09TWF9XSVRIX1hQQ19ET01BSU5fRVhURU5TSU9OX1lFUyA9IENvbmZpZ3Vy YXRpb25zL1dlYkNvbnRlbnQtT1NYLmVudGl0bGVtZW50czsKK09USEVSX0NPREVfU0lHTl9GTEFH U1tzZGs9bWFjb3N4Kl0gPSAkKFdLX1hQQ19ET01BSU5fRVhURU5TSU9OX0NPREVfU0lHTl9GTEFH Uyk7CiAKIFBST0RVQ1RfTkFNRSA9IGNvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudCQoV0tfWFBD X1NFUlZJQ0VfU1VGRklYKTsKIElORk9QTElTVF9GSUxFW3Nkaz1pcGhvbmUqXSA9IFdlYlByb2Nl c3MvRW50cnlQb2ludC9tYWMvWFBDU2VydmljZS9XZWJDb250ZW50U2VydmljZS9JbmZvLWlPUy5w bGlzdDsKQEAgLTQwLDMgKzQxLDYgQEAgV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19E T01BSU5fRQogV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19ET01BSU5fRVhURU5TSU9O X0VOVElUTEVNRU5UXyA9ICQoV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19ET01BSU5f RVhURU5TSU9OX0VOVElUTEVNRU5UX05PKTsKIFdLX1dFQkNPTlRFTlRfU0VSVklDRV9ORUVEU19Y UENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJVExFTUVOVF9OTyA9ICQoV0tfV0VCQ09OVEVOVF9TRVJW SUNFX05FRURTX1hQQ19ET01BSU5fRVhURU5TSU9OX0VOVElUTEVNRU5UKTsKIFdLX1dFQkNPTlRF TlRfU0VSVklDRV9ORUVEU19YUENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJVExFTUVOVF9ZRVMgPSAk KFdLX1JFTE9DQVRBQkxFX0ZSQU1FV09SS1MpOworCitXS19YUENfRE9NQUlOX0VYVEVOU0lPTl9D T0RFX1NJR05fRkxBR1MgPSAkKFdLX1hQQ19ET01BSU5fRVhURU5TSU9OX0NPREVfU0lHTl9GTEFH U18kKFdLX1dFQkNPTlRFTlRfU0VSVklDRV9ORUVEU19YUENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJ VExFTUVOVCkpOworV0tfWFBDX0RPTUFJTl9FWFRFTlNJT05fQ09ERV9TSUdOX0ZMQUdTX1lFUyA9 IC1vIGxpYnJhcnk7Cg== 281230 2016-06-13 20:34:52 -0700 2016-08-20 12:53:03 -0700 Enable library validation when needed bug-156668-20160613203626.patch text/plain 2464 mitz SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMjAyMikKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE2LTA2LTEzICBEYW4gQmVy bnN0ZWluICA8bWl0ekBhcHBsZS5jb20+CisKKyAgICAgICAgW01hY10gV2ViIENvbnRlbnQgc2Vy dmljZSB3aXRoIGEgcmVzdHJpY3RlZCBlbnRpdGxlbWVudCBtYXkgbG9hZCBhcmJpdHJhcnkgZHls aWJzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTY2 NjgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI2NzE0NTU4PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogQ29uZmlndXJhdGlvbnMvV2ViQ29udGVu dFNlcnZpY2UueGNjb25maWc6IEVuYWJsZSBsaWJyYXJ5IHZhbGlkYXRpb24gd2hlbiB0aGUgV2Vi IENvbnRlbnQKKyAgICAgICAgICBzZXJ2aWNlIGlzIGdpdmVuIHRoZSBYUEMgZG9tYWluIGV4dGVu c2lvbiBlbnRpdGxlbWVudCB3aGVuIHRhcmdldGluZyBtYWNPUyBTaWVycmEgb3IgbGF0ZXIuCisK IDIwMTYtMDYtMTMgIEFsZXggQ2hyaXN0ZW5zZW4gIDxhY2hyaXN0ZW5zZW5Ad2Via2l0Lm9yZz4K IAogICAgICAgICBBZGQgV2ViU29ja2V0UHJvdmlkZXIgc3R1YgpJbmRleDogU291cmNlL1dlYktp dDIvQ29uZmlndXJhdGlvbnMvV2ViQ29udGVudFNlcnZpY2UueGNjb25maWcKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL1dlYktpdDIvQ29uZmlndXJhdGlvbnMvV2ViQ29udGVudFNlcnZpY2UueGNjb25m aWcJKHJldmlzaW9uIDIwMjAyMikKKysrIFNvdXJjZS9XZWJLaXQyL0NvbmZpZ3VyYXRpb25zL1dl YkNvbnRlbnRTZXJ2aWNlLnhjY29uZmlnCSh3b3JraW5nIGNvcHkpCkBAIC0yNyw2ICsyNyw5IEBA IFdLX1hQQ19TRVJWSUNFX0lPU19FTlRJVExFTUVOVFNfQkFTRSA9IFcKIAogQ09ERV9TSUdOX0VO VElUTEVNRU5UU1tzZGs9bWFjb3N4Kl0gPSAkKENPREVfU0lHTl9FTlRJVExFTUVOVFNfT1NYX1dJ VEhfWFBDX0RPTUFJTl9FWFRFTlNJT05fJChXS19XRUJDT05URU5UX1NFUlZJQ0VfTkVFRFNfWFBD X0RPTUFJTl9FWFRFTlNJT05fRU5USVRMRU1FTlQpKTsKIENPREVfU0lHTl9FTlRJVExFTUVOVFNf T1NYX1dJVEhfWFBDX0RPTUFJTl9FWFRFTlNJT05fWUVTID0gQ29uZmlndXJhdGlvbnMvV2ViQ29u dGVudC1PU1guZW50aXRsZW1lbnRzOworT1RIRVJfQ09ERV9TSUdOX0ZMQUdTW3Nkaz1tYWNvc3gq XSA9ICQoT1RIRVJfQ09ERV9TSUdOX0ZMQUdTX21hY29zeF8kKFRBUkdFVF9NQUNfT1NfWF9WRVJT SU9OX01BSk9SKSk7CitPVEhFUl9DT0RFX1NJR05fRkxBR1NfbWFjb3N4XzEwMTIwMCA9ICQoV0tf WFBDX0RPTUFJTl9FWFRFTlNJT05fQ09ERV9TSUdOX0ZMQUdTKTsKK09USEVSX0NPREVfU0lHTl9G TEFHU19tYWNvc3hfMTAxMzAwID0gJChPVEhFUl9DT0RFX1NJR05fRkxBR1NfbWFjb3N4XzEwMTIw MCk7CiAKIFBST0RVQ1RfTkFNRSA9IGNvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudCQoV0tfWFBD X1NFUlZJQ0VfU1VGRklYKTsKIElORk9QTElTVF9GSUxFW3Nkaz1pcGhvbmUqXSA9IFdlYlByb2Nl c3MvRW50cnlQb2ludC9tYWMvWFBDU2VydmljZS9XZWJDb250ZW50U2VydmljZS9JbmZvLWlPUy5w bGlzdDsKQEAgLTQwLDMgKzQzLDYgQEAgV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19E T01BSU5fRQogV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19ET01BSU5fRVhURU5TSU9O X0VOVElUTEVNRU5UXyA9ICQoV0tfV0VCQ09OVEVOVF9TRVJWSUNFX05FRURTX1hQQ19ET01BSU5f RVhURU5TSU9OX0VOVElUTEVNRU5UX05PKTsKIFdLX1dFQkNPTlRFTlRfU0VSVklDRV9ORUVEU19Y UENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJVExFTUVOVF9OTyA9ICQoV0tfV0VCQ09OVEVOVF9TRVJW SUNFX05FRURTX1hQQ19ET01BSU5fRVhURU5TSU9OX0VOVElUTEVNRU5UKTsKIFdLX1dFQkNPTlRF TlRfU0VSVklDRV9ORUVEU19YUENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJVExFTUVOVF9ZRVMgPSAk KFdLX1JFTE9DQVRBQkxFX0ZSQU1FV09SS1MpOworCitXS19YUENfRE9NQUlOX0VYVEVOU0lPTl9D T0RFX1NJR05fRkxBR1MgPSAkKFdLX1hQQ19ET01BSU5fRVhURU5TSU9OX0NPREVfU0lHTl9GTEFH U18kKFdLX1dFQkNPTlRFTlRfU0VSVklDRV9ORUVEU19YUENfRE9NQUlOX0VYVEVOU0lPTl9FTlRJ VExFTUVOVCkpOworV0tfWFBDX0RPTUFJTl9FWFRFTlNJT05fQ09ERV9TSUdOX0ZMQUdTX1lFUyA9 IC1vIGxpYnJhcnk7Cg== 286544 2016-08-20 12:53:06 -0700 2016-08-20 14:39:05 -0700 Enable library validation for El Capitan too bug-156668-20160820125112.patch text/plain 1902 mitz SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwNDY4MCkKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE2LTA4LTIwICBEYW4gQmVy bnN0ZWluICA8bWl0ekBhcHBsZS5jb20+CisKKyAgICAgICAgW01hY10gV2ViIENvbnRlbnQgc2Vy dmljZSB3aXRoIGEgcmVzdHJpY3RlZCBlbnRpdGxlbWVudCBtYXkgbG9hZCBhcmJpdHJhcnkgZHls aWJzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTY2 NjgKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI1NDI5Nzg0PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogQ29uZmlndXJhdGlvbnMvV2ViQ29udGVu dFNlcnZpY2UueGNjb25maWc6IEVuYWJsZSBsaWJyYXJ5IHZhbGlkYXRpb24gd2hlbiB0aGUgV2Vi IENvbnRlbnQKKyAgICAgICAgICBzZXJ2aWNlIGlzIGdpdmVuIHRoZSBYUEMgZG9tYWluIGV4dGVu c2lvbiBlbnRpdGxlbWVudC4KKwogMjAxNi0wOC0yMCAgSmF2aWVyIEZlcm5hbmRleiAgPGpmZXJu YW5kZXpAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR1RLXSBVbnJldmlld2VkIEdUSyBidWlsZCBm aXggc2luY2UgcjIwNDY2NSBhbmQgMjA0NjY4CkluZGV4OiBTb3VyY2UvV2ViS2l0Mi9Db25maWd1 cmF0aW9ucy9XZWJDb250ZW50U2VydmljZS54Y2NvbmZpZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViS2l0Mi9Db25maWd1cmF0aW9ucy9XZWJDb250ZW50U2VydmljZS54Y2NvbmZpZwkocmV2aXNp b24gMjA0NjgwKQorKysgU291cmNlL1dlYktpdDIvQ29uZmlndXJhdGlvbnMvV2ViQ29udGVudFNl cnZpY2UueGNjb25maWcJKHdvcmtpbmcgY29weSkKQEAgLTI3LDkgKzI3LDcgQEAgV0tfWFBDX1NF UlZJQ0VfSU9TX0VOVElUTEVNRU5UU19CQVNFID0gVwogCiBDT0RFX1NJR05fRU5USVRMRU1FTlRT W3Nkaz1tYWNvc3gqXSA9ICQoQ09ERV9TSUdOX0VOVElUTEVNRU5UU19PU1hfV0lUSF9YUENfRE9N QUlOX0VYVEVOU0lPTl8kKFdLX1dFQkNPTlRFTlRfU0VSVklDRV9ORUVEU19YUENfRE9NQUlOX0VY VEVOU0lPTl9FTlRJVExFTUVOVCkpOwogQ09ERV9TSUdOX0VOVElUTEVNRU5UU19PU1hfV0lUSF9Y UENfRE9NQUlOX0VYVEVOU0lPTl9ZRVMgPSBDb25maWd1cmF0aW9ucy9XZWJDb250ZW50LU9TWC5l bnRpdGxlbWVudHM7Ci1PVEhFUl9DT0RFX1NJR05fRkxBR1Nbc2RrPW1hY29zeCpdID0gJChPVEhF Ul9DT0RFX1NJR05fRkxBR1NfbWFjb3N4XyQoVEFSR0VUX01BQ19PU19YX1ZFUlNJT05fTUFKT1Ip KTsKLU9USEVSX0NPREVfU0lHTl9GTEFHU19tYWNvc3hfMTAxMjAwID0gJChXS19YUENfRE9NQUlO X0VYVEVOU0lPTl9DT0RFX1NJR05fRkxBR1MpOwotT1RIRVJfQ09ERV9TSUdOX0ZMQUdTX21hY29z eF8xMDEzMDAgPSAkKE9USEVSX0NPREVfU0lHTl9GTEFHU19tYWNvc3hfMTAxMjAwKTsKK09USEVS X0NPREVfU0lHTl9GTEFHU1tzZGs9bWFjb3N4Kl0gPSAkKFdLX1hQQ19ET01BSU5fRVhURU5TSU9O X0NPREVfU0lHTl9GTEFHUyk7CiAKIFBST0RVQ1RfTkFNRSA9IGNvbS5hcHBsZS5XZWJLaXQuV2Vi Q29udGVudCQoV0tfWFBDX1NFUlZJQ0VfU1VGRklYKTsKIElORk9QTElTVF9GSUxFW3Nkaz1pcGhv bmUqXSA9IFdlYlByb2Nlc3MvRW50cnlQb2ludC9tYWMvWFBDU2VydmljZS9XZWJDb250ZW50U2Vy dmljZS9JbmZvLWlPUy5wbGlzdDsK