197895 2019-05-14 14:28:06 -0700 Allow NSFileCoordinator to be called from WebContent process 2019-09-03 17:50:01 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 achristensen achristensen bfulgham commit-queue pvollan webkit-bug-importer oldest_to_newest 1536246 0 achristensen 2019-05-14 14:28:06 -0700 Allow NSFileCoordinator to be called from WebContent process 1536248 1 369893 achristensen 2019-05-14 14:30:58 -0700 Created attachment 369893 Patch 1536249 2 achristensen 2019-05-14 14:31:00 -0700 <rdar://problem/50107679> 1536271 3 369893 bfulgham 2019-05-14 15:13:19 -0700 Comment on attachment 369893 Patch r=me 1536274 4 369893 pvollan 2019-05-14 15:28:32 -0700 Comment on attachment 369893 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369893&action=review > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:598 > +(allow mach-lookup > + (global-name "com.apple.FileCoordination")) > + Would it be possible to broker the NSFileCoordinator call to the UI process, to avoid allowing this mach-lookup? 1536288 5 369893 pvollan 2019-05-14 15:55:43 -0700 Comment on attachment 369893 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369893&action=review >> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:598 >> + > > Would it be possible to broker the NSFileCoordinator call to the UI process, to avoid allowing this mach-lookup? Or perhaps we could issue a mach lookup sandbox extension from the UI process in the injected bundle case? 1536412 6 369893 achristensen 2019-05-15 07:27:35 -0700 Comment on attachment 369893 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369893&action=review >>> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:598 >>> + >> >> Would it be possible to broker the NSFileCoordinator call to the UI process, to avoid allowing this mach-lookup? > > Or perhaps we could issue a mach lookup sandbox extension from the UI process in the injected bundle case? The mach-lookup is now matching iOS, so I'm not too concerned about adding it. I do regret the additional syscalls, and I'm not sure if you can make sandbox extensions for syscalls. 1536420 7 369893 commit-queue 2019-05-15 07:55:17 -0700 Comment on attachment 369893 Patch Clearing flags on attachment: 369893 Committed r245322: <https://trac.webkit.org/changeset/245322> 1536421 8 commit-queue 2019-05-15 07:55:19 -0700 All reviewed patches have been landed. Closing bug. 369893 2019-05-14 14:30:58 -0700 2019-05-15 07:55:17 -0700 Patch bug-197895-20190514143057.patch text/plain 3542 achristensen SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNDUyNTApCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE5LTA1LTE0ICBBbGV4IENocmlz dGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgQWxsb3cgTlNGaWxl Q29vcmRpbmF0b3IgdG8gYmUgY2FsbGVkIGZyb20gV2ViQ29udGVudCBwcm9jZXNzCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTc4OTUKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzUwMTA3Njc5PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgICogV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5p bjoKKyAgICAgICAgRXhwYW5kIHNhbmRib3ggdG8gYWxsb3cgdXNlIG9mIGNvbS5hcHBsZS5GaWxl Q29vcmRpbmF0aW9uIG1hY2ggc2VydmljZSBsaWtlIHdlIGRvIG9uIGlPUy4KKwogMjAxOS0wNS0x MyAgQnJlbnQgRnVsZ2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBDb3JyZWN0 IHRoZSBzYW5kYm94IHRvIGFsbG93IGxvYWRpbmcgbGlicmFyaWVzIGZyb20gL0xpYnJhcnkvQXBw bGUgCkluZGV4OiBTb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Mu c2IuaW4KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5X ZWJQcm9jZXNzLnNiLmluCShyZXZpc2lvbiAyNDUyNTApCisrKyBTb3VyY2UvV2ViS2l0L1dlYlBy b2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW4JKHdvcmtpbmcgY29weSkKQEAgLTU5Myw2 ICs1OTMsOSBAQAogKGFsbG93IG1hY2gtbG9va3VwCiAgICAgICAgKGdsb2JhbC1uYW1lICJjb20u YXBwbGUud2ViaW5zcGVjdG9yIikpCiAKKyhhbGxvdyBtYWNoLWxvb2t1cAorICAgIChnbG9iYWwt bmFtZSAiY29tLmFwcGxlLkZpbGVDb29yZGluYXRpb24iKSkKKwogOzsgVmFyaW91cyBzZXJ2aWNl cyByZXF1aXJlZCBieSBBcHBLaXQgYW5kIG90aGVyIGZyYW1ld29ya3MKIChhbGxvdyBtYWNoLWxv b2t1cAogI2lmIF9fTUFDX09TX1hfVkVSU0lPTl9NSU5fUkVRVUlSRUQgPCAxMDE0MDAKQEAgLTk4 Niw2ICs5ODksOSBAQAogICAgICAgICAoc3lzY2FsbC1udW1iZXIgU1lTX3F1b3RhY3RsKSA7OyA8 cmRhcjovL3Byb2JsZW0vNDk5NDUwMzE+CiAgICAgICAgIChzeXNjYWxsLW51bWJlciBTWVNfc3Rh dDY0X2V4dGVuZGVkKSA7OyA8cmRhcjovL3Byb2JsZW0vNTA0NzMzMzA+CiAgICAgICAgIChzeXNj YWxsLW51bWJlciBTWVNfbHN0YXQ2NF9leHRlbmRlZCkKKyAgICAgICAgKHN5c2NhbGwtbnVtYmVy IFNZU19pb3BvbGljeXN5cykKKyAgICAgICAgKHN5c2NhbGwtbnVtYmVyIFNZU193b3JrcV9vcGVu KQorICAgICAgICAoc3lzY2FsbC1udW1iZXIgU1lTX2dldGdyb3VwcykKICAgICApCiApCiAKSW5k ZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJldmlz aW9uIDI0NTMxMCkKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsx LDE2IEBACisyMDE5LTA1LTE0ICBBbGV4IENocmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtp dC5vcmc+CisKKyAgICAgICAgQWxsb3cgTlNGaWxlQ29vcmRpbmF0b3IgdG8gYmUgY2FsbGVkIGZy b20gV2ViQ29udGVudCBwcm9jZXNzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD0xOTc4OTUKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzUwMTA3Njc5Pgor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBhIHVu aXQgdGVzdCB0aGF0IHZlcmlmaWVzIGNhbGxpbmcgdGhlIGJsb2NrIHN1Y2NlZWRzLgorCisgICAg ICAgICogVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9BZGRpdGlvbmFsUmVhZEFjY2Vz c0FsbG93ZWRVUkxzUGx1Z2luLm1tOgorICAgICAgICAoLVtBZGRpdGlvbmFsUmVhZEFjY2Vzc0Fs bG93ZWRVUkxzUGx1Z0luIHdlYlByb2Nlc3NQbHVnSW46ZGlkQ3JlYXRlQnJvd3NlckNvbnRleHRD b250cm9sbGVyOl0pOgorCiAyMDE5LTA1LTE0ICBZb3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFwcGxl LmNvbT4KIAogICAgICAgICBBIHNlcnZpY2Ugd29ya2VyIHByb2Nlc3Mgc2hvdWxkIGFwcCBuYXAg d2hlbiBhbGwgaXRzIGNsaWVudHMgYXBwIG5hcApJbmRleDogVG9vbHMvVGVzdFdlYktpdEFQSS9U ZXN0cy9XZWJLaXRDb2NvYS9BZGRpdGlvbmFsUmVhZEFjY2Vzc0FsbG93ZWRVUkxzUGx1Z2luLm1t Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFRvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Q29jb2EvQWRk aXRpb25hbFJlYWRBY2Nlc3NBbGxvd2VkVVJMc1BsdWdpbi5tbQkocmV2aXNpb24gMjQ1MjUwKQor KysgVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXRDb2NvYS9BZGRpdGlvbmFsUmVhZEFj Y2Vzc0FsbG93ZWRVUkxzUGx1Z2luLm1tCSh3b3JraW5nIGNvcHkpCkBAIC01Miw2ICs1MiwxMyBA QCAtICh2b2lkKXdlYlByb2Nlc3NQbHVnSW46KFdLV2ViUHJvY2Vzc1BsCiAKICAgICBfaW50ZXJm YWNlID0gW19XS1JlbW90ZU9iamVjdEludGVyZmFjZSByZW1vdGVPYmplY3RJbnRlcmZhY2VXaXRo UHJvdG9jb2w6QHByb3RvY29sKEFkZGl0aW9uYWxSZWFkQWNjZXNzQWxsb3dlZFVSTHNQcm90b2Nv bCldOwogICAgIFtbYnJvd3NlckNvbnRleHRDb250cm9sbGVyIF9yZW1vdGVPYmplY3RSZWdpc3Ry eV0gcmVnaXN0ZXJFeHBvcnRlZE9iamVjdDpzZWxmIGludGVyZmFjZTpfaW50ZXJmYWNlLmdldCgp XTsKKworICAgIF9fYmxvY2sgYm9vbCBibG9ja0NhbGxlZCA9IGZhbHNlOworICAgIE5TRmlsZUNv b3JkaW5hdG9yICpjb29yZGluYXRvciA9IFtbTlNGaWxlQ29vcmRpbmF0b3IgYWxsb2NdIGluaXRX aXRoRmlsZVByZXNlbnRlcjpuaWxdOworICAgIFtjb29yZGluYXRvciBjb29yZGluYXRlUmVhZGlu Z0l0ZW1BdFVSTDpbTlNVUkwgZmlsZVVSTFdpdGhQYXRoOkAiL0FwcGxpY2F0aW9ucy9TYWZhcmku YXBwIl0gb3B0aW9uczpOU0ZpbGVDb29yZGluYXRvclJlYWRpbmdXaXRob3V0Q2hhbmdlcyBlcnJv cjpuaWwgYnlBY2Nlc3NvcjpeKE5TVVJMICpuZXdVUkwpIHsKKyAgICAgICAgYmxvY2tDYWxsZWQg PSB0cnVlOworICAgIH1dOworICAgIEFTU0VSVChibG9ja0NhbGxlZCk7CiB9CiAKIC0gKHZvaWQp ZGVhbGxvYwo=