197844 2019-05-13 10:11:12 -0700 Correct the sandbox to allow loading libraries from /Library/Apple 2019-05-13 12:53:51 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham ap bfulgham bshafiei commit-queue pvollan oldest_to_newest 1535655 0 bfulgham 2019-05-13 10:11:12 -0700 Some InjectedBundles need to load libraries from "/Library/Apple", which is not allowed by default. Revise the sandbox to support this additional location for frameworks. 1535656 1 369744 bfulgham 2019-05-13 10:13:11 -0700 Created attachment 369744 Patch 1535657 2 bfulgham 2019-05-13 10:17:17 -0700 <rdar://problem/50727815> 1535660 3 369744 pvollan 2019-05-13 10:27:46 -0700 Comment on attachment 369744 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369744&action=review R=me. > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:43 > (allow file-read* > (require-all (file-mode #o0004) > (require-any (subpath "/Library/Filesystems/NetFSPlugins") > + (subpath "/Library/Apple/System") Is this only needed for the injected bundle? If that is the case, maybe we could issue an extension? I don't think this is required now, and could be done in a followup patch. > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:63 > +;;; Allow mapping of system frameworks + dylibs > +(allow file-map-executable > + (subpath "/Library/Apple/System/Library/Frameworks") > + (subpath "/Library/Apple/System/Library/PrivateFrameworks") > + (subpath "/System/Library/Frameworks") > + (subpath "/System/Library/PrivateFrameworks") > + (subpath "/usr/lib") Ditto. 1535670 4 369744 bfulgham 2019-05-13 10:44:47 -0700 Comment on attachment 369744 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369744&action=review >> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:43 >> + (subpath "/Library/Apple/System") > > Is this only needed for the injected bundle? If that is the case, maybe we could issue an extension? I don't think this is required now, and could be done in a followup patch. After reviewing things further, I think we should just treat this as another canonical location where system frameworks might live. It's not specific to injected bundles. >> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:63 >> + (subpath "/usr/lib") > > Ditto. This section might not be needed (yet), because we don't prohibit file mapping. But having this here will allow us to flip on that protection in a future patch. 1535732 5 369744 commit-queue 2019-05-13 12:53:50 -0700 Comment on attachment 369744 Patch Clearing flags on attachment: 369744 Committed r245246: <https://trac.webkit.org/changeset/245246> 1535733 6 commit-queue 2019-05-13 12:53:51 -0700 All reviewed patches have been landed. Closing bug. 369744 2019-05-13 10:13:11 -0700 2019-05-13 12:53:50 -0700 Patch bug-197844-20190513101311.patch text/plain 1957 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ1MTk2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGE0MGEyZDRkMDkxZWU4NGQw OTAyNTdlNWUzNjM1NzMzZWEzMzgxZjkuLjRiYzEwN2Q4ZDRmYzJlYTM1NTA3YWFlMzQxY2I0Yzk0 NTk5NzQwMWIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTktMDUtMTMgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgQ29ycmVjdCB0aGUgc2FuZGJv eCB0byBhbGxvdyBsb2FkaW5nIGxpYnJhcmllcyBmcm9tIC9MaWJyYXJ5L0FwcGxlIAorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk3ODQ0CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgR3JhbnQgYWNjZXNzIHRv ICcvTGlicmFyeS9BcHBsZScgYXMgYW4gYXBwcm9wcmlhdGUgcGxhY2UgdG8gbG9hZAorICAgICAg ICBzeXN0ZW0gZnJhbWV3b3Jrcy4KKworICAgICAgICAqIFdlYlByb2Nlc3MvY29tLmFwcGxlLldl YlByb2Nlc3Muc2IuaW46CisKIDIwMTktMDUtMTAgIEJyZW50IEZ1bGdoYW0gIDxiZnVsZ2hhbUBh cHBsZS5jb20+CiAKICAgICAgICAgU3RyZWFtbGluZSB0ZXN0LWFuZC1jbGVhciBvcGVyYXRpb24g Zm9yIENvbnRleHRNZW51CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29t LmFwcGxlLldlYlByb2Nlc3Muc2IuaW4gYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29tLmFw cGxlLldlYlByb2Nlc3Muc2IuaW4KaW5kZXggMDliOGVlZTM0NGQ1ZjY1OTQyMTk5NTEwYWRiZDli NzFlNDQ5MWE5YS4uZWFiMjU0ZWRjMDE4ZjMzMTcwY2Y5MjMwNzc2MmUzY2U5YjRlNDhiNiAxMDA2 NDQKLS0tIGEvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNi LmluCisrKyBiL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5z Yi5pbgpAQCAtNDAsNiArNDAsNyBAQAogKGFsbG93IGZpbGUtcmVhZCoKICAgICAocmVxdWlyZS1h bGwgKGZpbGUtbW9kZSAjbzAwMDQpCiAgICAgKHJlcXVpcmUtYW55IChzdWJwYXRoICIvTGlicmFy eS9GaWxlc3lzdGVtcy9OZXRGU1BsdWdpbnMiKQorICAgIChzdWJwYXRoICIvTGlicmFyeS9BcHBs ZS9TeXN0ZW0iKQogICAgIChzdWJwYXRoICIvTGlicmFyeS9QcmVmZXJlbmNlcy9Mb2dnaW5nIikg ICAgICA7IExvZ2dpbmcgUmV0aGluawogICAgIChzdWJwYXRoICIvU3lzdGVtIikKICAgICAoc3Vi cGF0aCAiL3ByaXZhdGUvdmFyL2RiL2R5bGQiKQpAQCAtNTMsNiArNTQsMTUgQEAKICAgICAoc3Vi cGF0aCAiL0FwcGxlSW50ZXJuYWwvTGlicmFyeS9QcmVmZXJlbmNlcy9Mb2dnaW5nIikKICAgICAo c3lzdGVtLWF0dHJpYnV0ZSBhcHBsZS1pbnRlcm5hbCkpKQogCis7OzsgQWxsb3cgbWFwcGluZyBv ZiBzeXN0ZW0gZnJhbWV3b3JrcyArIGR5bGlicworKGFsbG93IGZpbGUtbWFwLWV4ZWN1dGFibGUK KyAgICAoc3VicGF0aCAiL0xpYnJhcnkvQXBwbGUvU3lzdGVtL0xpYnJhcnkvRnJhbWV3b3JrcyIp CisgICAgKHN1YnBhdGggIi9MaWJyYXJ5L0FwcGxlL1N5c3RlbS9MaWJyYXJ5L1ByaXZhdGVGcmFt ZXdvcmtzIikKKyAgICAoc3VicGF0aCAiL1N5c3RlbS9MaWJyYXJ5L0ZyYW1ld29ya3MiKQorICAg IChzdWJwYXRoICIvU3lzdGVtL0xpYnJhcnkvUHJpdmF0ZUZyYW1ld29ya3MiKQorICAgIChzdWJw YXRoICIvdXNyL2xpYiIpCisgICAgKGxpdGVyYWwgIi91c3IvbG9jYWwvbGliL3Nhbml0aXplcnMi KSkKKwogKGFsbG93IGZpbGUtcmVhZC1tZXRhZGF0YQogICAgIChsaXRlcmFsICIvZXRjIikKICAg ICAobGl0ZXJhbCAiL3RtcCIpCg==