203626 2019-10-30 14:03:23 -0700 Investigate if mach lookup access to *.apple-extension-service, *.viewservice, and com.apple.uikit.viewservice.* can be denied 2019-11-01 13:19:20 -0700 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 pvollan pvollan ap bfulgham commit-queue ggaren webkit-bug-importer oldest_to_newest 1585493 0 pvollan 2019-10-30 14:03:23 -0700 These services have not been observed being in use while running layout test, and should be denied in the WebContent Sandbox. 1585495 1 webkit-bug-importer 2019-10-30 14:03:41 -0700 <rdar://problem/56757653> 1585497 2 382348 pvollan 2019-10-30 14:06:16 -0700 Created attachment 382348 Patch 1585503 3 382351 pvollan 2019-10-30 14:10:54 -0700 Created attachment 382351 Patch 1585539 4 382351 bfulgham 2019-10-30 14:58:16 -0700 Comment on attachment 382351 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=382351&action=review I am worried about this change. Please make sure to test on a device with this sandbox, using MobileMaill and MobileSafari, and attempting to share URLs. > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:434 > (xpc-service-name-regex #"\.apple-extension-service$") ;; <rdar://problem/19525887> I can't see this radar, but this could be related to sharing services. We should make sure to test with share sheet before checking this change in. > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:435 > (xpc-service-name-regex #"\.viewservice$") ;; <rdar://problem/31252371> I'm worried about this denial: According to <rdar://problem/31252371>, this was triggered in MobileSafari. Unless you have run MobileSafari with this change, I wouldn't want to land this. 1585586 5 pvollan 2019-10-30 15:33:08 -0700 (In reply to Brent Fulgham from comment #4) > Comment on attachment 382351 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=382351&action=review > > I am worried about this change. Please make sure to test on a device with > this sandbox, using MobileMaill and MobileSafari, and attempting to share > URLs. > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:434 > > (xpc-service-name-regex #"\.apple-extension-service$") ;; <rdar://problem/19525887> > > I can't see this radar, but this could be related to sharing services. We > should make sure to test with share sheet before checking this change in. > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:435 > > (xpc-service-name-regex #"\.viewservice$") ;; <rdar://problem/31252371> > > I'm worried about this denial: According to <rdar://problem/31252371>, this > was triggered in MobileSafari. Unless you have run MobileSafari with this > change, I wouldn't want to land this. I will perform tests with MobileMail and MobileSafari, sharing URLs and testing with share sheet. Thanks for reviewing! 1585800 6 382351 ap 2019-10-30 23:18:42 -0700 Comment on attachment 382351 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=382351&action=review > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:432 > + (deny mach-lookup (with send-signal SIGKILL) Sending SIGKILL is potentially super disruptive to a lot of people if we miss something in testing. At the very least, there should be a bug that tracks removing SIGKILL before shipping, but really, we need a better mechanism to learn about sandbox violations. 1586454 7 382599 pvollan 2019-11-01 11:23:46 -0700 Created attachment 382599 Patch 1586476 8 382599 ap 2019-11-01 11:49:55 -0700 Comment on attachment 382599 Patch OK. I don't know what "with telemetry" does, but it sounds appropriate :) 1586480 9 pvollan 2019-11-01 11:52:52 -0700 (In reply to Alexey Proskuryakov from comment #8) > Comment on attachment 382599 [details] > Patch > > OK. I don't know what "with telemetry" does, but it sounds appropriate :) Thanks for reviewing :) 1586509 10 382599 commit-queue 2019-11-01 13:19:18 -0700 Comment on attachment 382599 Patch Clearing flags on attachment: 382599 Committed r251935: <https://trac.webkit.org/changeset/251935> 1586510 11 commit-queue 2019-11-01 13:19:20 -0700 All reviewed patches have been landed. Closing bug. 382348 2019-10-30 14:06:16 -0700 2019-10-30 14:10:52 -0700 Patch bug-203626-20191030140615.patch text/plain 2213 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTE3OTkpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE5LTEwLTMwICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBTdGFydCBkZW55aW5nIG1hY2gg bG9va3VwIGFjY2VzcyB0byAqLmFwcGxlLWV4dGVuc2lvbi1zZXJ2aWNlIGFuZCAqLnZpZXdzZXJ2 aWNlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDM2 MjYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGVz ZSBzZXJ2aWNlcyBoYXZlIG5vdCBiZWVuIG9ic2VydmVkIGJlaW5nIGluIHVzZSB3aGlsZSBydW5u aW5nIGxheW91dCB0ZXN0LCBhbmQgc2hvdWxkIGJlIGRlbmllZCBpbiB0aGUKKyAgICAgICAgV2Vi Q29udGVudCBTYW5kYm94LiBUbyBjYXRjaCBwb3NzaWJsZSByZWdyZXNzaW9ucyBmcm9tIHRoaXMg Y2hhbmdlLCB3ZSB3aWxsIHNlbmQgYSBTSUdLSUxMIHNpZ25hbCB0byB0aGUKKyAgICAgICAgV2Vi Q29udGVudCBwcm9jZXNzIGlmIGl0IHRyaWVzIHRvIGxvb2sgdXAgdGhlIHNlcnZpY2UuCisKKyAg ICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lldl YkNvbnRlbnQuc2I6CisKIDIwMTktMTAtMzAgIEFuZHJlcyBHb256YWxleiAgPGFuZHJlc2dfMjJA YXBwbGUuY29tPgogCiAgICAgICAgIENyZWF0ZSBiYXNlIGNsYXNzIGNvbW1vbiB0byBBY2Nlc3Np YmlsaXR5T2JqZWN0IGFuZCBBWElzb2xhdGVkVHJlZU5vZGUuCkluZGV4OiBTb3VyY2UvV2ViS2l0 L1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVu dC5zYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJvZmls ZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYgkocmV2aXNpb24gMjUxNzg0KQor KysgU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUu V2ViS2l0LldlYkNvbnRlbnQuc2IJKHdvcmtpbmcgY29weSkKQEAgLTQyNiwxMiArNDI2LDE1IEBA CiAgICAgKGFsbG93IG1hY2gtbG9va3VwCiAgICAgICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxl LmZyb250Ym9hcmQuc3lzdGVtYXBwc2VydmljZXMiKSAgICAgICAgICAgICAgICAgOyAtW1VJVmll d1NlcnZpY2VJbnRlcmZhY2UgX2NyZWF0ZVByb2Nlc3NBc3NlcnRpb25dIC0+IFNCU1Byb2Nlc3NJ REZvckRpc3BsYXlJZGVudGlmaWVyKCkKICAgICAgICAgKGdsb2JhbC1uYW1lLXJlZ2V4ICMiXmNv bVwuYXBwbGVcLnVpa2l0XC52aWV3c2VydmljZVwuLisiKQotICAgICAgICAoeHBjLXNlcnZpY2Ut bmFtZS1yZWdleCAjIlwuYXBwbGUtZXh0ZW5zaW9uLXNlcnZpY2UkIikgOzsgPHJkYXI6Ly9wcm9i bGVtLzE5NTI1ODg3PgotICAgICAgICAoeHBjLXNlcnZpY2UtbmFtZS1yZWdleCAjIlwudmlld3Nl cnZpY2UkIikgOzsgPHJkYXI6Ly9wcm9ibGVtLzMxMjUyMzcxPgogICAgICAgICAoZ2xvYmFsLW5h bWUgImNvbS5hcHBsZS5DQVJlbmRlclNlcnZlciIpCiAgICAgICAgIChnbG9iYWwtbmFtZSAiY29t LmFwcGxlLmlvaGlkZXZlbnRzeXN0ZW0iKQogICAgICkKIAorICAgIChkZW55IG1hY2gtbG9va3Vw ICh3aXRoIHNlbmQtc2lnbmFsIFNJR0tJTEwpCisgICAgICAgICh4cGMtc2VydmljZS1uYW1lLXJl Z2V4ICMiXC5hcHBsZS1leHRlbnNpb24tc2VydmljZSQiKSA7OyA8cmRhcjovL3Byb2JsZW0vMTk1 MjU4ODc+CisgICAgICAgICh4cGMtc2VydmljZS1uYW1lLXJlZ2V4ICMiXC52aWV3c2VydmljZSQi KSA7OyA8cmRhcjovL3Byb2JsZW0vMzEyNTIzNzE+CisgICAgKQorCiAgICAgOyBVSUtpdC1yZXF1 aXJlZCBJT0tpdCBub2Rlcy4KICAgICAoYWxsb3cgaW9raXQtb3BlbgogICAgICAgICAoaW9raXQt dXNlci1jbGllbnQtY2xhc3MgIkFwcGxlSlBFR0RyaXZlclVzZXJDbGllbnQiKQo= 382351 2019-10-30 14:10:54 -0700 2019-11-01 11:23:45 -0700 Patch bug-203626-20191030141053.patch text/plain 2089 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTE3OTkpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE5LTEwLTMwICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBTdGFydCBkZW55aW5nIG1hY2gg bG9va3VwIGFjY2VzcyB0byAqLmFwcGxlLWV4dGVuc2lvbi1zZXJ2aWNlLCAqLnZpZXdzZXJ2aWNl LCBhbmQgY29tLmFwcGxlLnVpa2l0LnZpZXdzZXJ2aWNlLioKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMzYyNgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZXNlIHNlcnZpY2VzIGhhdmUgbm90IGJlZW4g b2JzZXJ2ZWQgYmVpbmcgaW4gdXNlIHdoaWxlIHJ1bm5pbmcgbGF5b3V0IHRlc3QsIGFuZCBzaG91 bGQgYmUgZGVuaWVkIGluIHRoZQorICAgICAgICBXZWJDb250ZW50IFNhbmRib3guIFRvIGNhdGNo IHBvc3NpYmxlIHJlZ3Jlc3Npb25zIGZyb20gdGhpcyBjaGFuZ2UsIHdlIHdpbGwgc2VuZCBhIFNJ R0tJTEwgc2lnbmFsIHRvIHRoZQorICAgICAgICBXZWJDb250ZW50IHByb2Nlc3MgaWYgaXQgdHJp ZXMgdG8gbG9vayB1cCB0aGUgc2VydmljZS4KKworICAgICAgICAqIFJlc291cmNlcy9TYW5kYm94 UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYjoKKwogMjAxOS0xMC0z MCAgQW5kcmVzIEdvbnphbGV6ICA8YW5kcmVzZ18yMkBhcHBsZS5jb20+CiAKICAgICAgICAgQ3Jl YXRlIGJhc2UgY2xhc3MgY29tbW9uIHRvIEFjY2Vzc2liaWxpdHlPYmplY3QgYW5kIEFYSXNvbGF0 ZWRUcmVlTm9kZS4KSW5kZXg6IFNvdXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxl cy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5X ZWJDb250ZW50LnNiCShyZXZpc2lvbiAyNTE3ODQpCisrKyBTb3VyY2UvV2ViS2l0L1Jlc291cmNl cy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYgkod29y a2luZyBjb3B5KQpAQCAtNDI1LDExICs0MjUsMTQgQEAKIAogICAgIChhbGxvdyBtYWNoLWxvb2t1 cAogICAgICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5mcm9udGJvYXJkLnN5c3RlbWFwcHNl cnZpY2VzIikgICAgICAgICAgICAgICAgIDsgLVtVSVZpZXdTZXJ2aWNlSW50ZXJmYWNlIF9jcmVh dGVQcm9jZXNzQXNzZXJ0aW9uXSAtPiBTQlNQcm9jZXNzSURGb3JEaXNwbGF5SWRlbnRpZmllcigp CisgICAgICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLkNBUmVuZGVyU2VydmVyIikKKyAgICAg ICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuaW9oaWRldmVudHN5c3RlbSIpCisgICAgKQorCisg ICAgKGRlbnkgbWFjaC1sb29rdXAgKHdpdGggc2VuZC1zaWduYWwgU0lHS0lMTCkKICAgICAgICAg KGdsb2JhbC1uYW1lLXJlZ2V4ICMiXmNvbVwuYXBwbGVcLnVpa2l0XC52aWV3c2VydmljZVwuLisi KQogICAgICAgICAoeHBjLXNlcnZpY2UtbmFtZS1yZWdleCAjIlwuYXBwbGUtZXh0ZW5zaW9uLXNl cnZpY2UkIikgOzsgPHJkYXI6Ly9wcm9ibGVtLzE5NTI1ODg3PgogICAgICAgICAoeHBjLXNlcnZp Y2UtbmFtZS1yZWdleCAjIlwudmlld3NlcnZpY2UkIikgOzsgPHJkYXI6Ly9wcm9ibGVtLzMxMjUy MzcxPgotICAgICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5DQVJlbmRlclNlcnZlciIpCi0g ICAgICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmlvaGlkZXZlbnRzeXN0ZW0iKQogICAgICkK IAogICAgIDsgVUlLaXQtcmVxdWlyZWQgSU9LaXQgbm9kZXMuCg== 382599 2019-11-01 11:23:46 -0700 2019-11-01 13:19:18 -0700 Patch bug-203626-20191101112346.patch text/plain 1859 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTE5MzApCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE5LTExLTAxICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBJbnZlc3RpZ2F0ZSBpZiBtYWNo IGxvb2t1cCBhY2Nlc3MgdG8gKi5hcHBsZS1leHRlbnNpb24tc2VydmljZSwgKi52aWV3c2Vydmlj ZSwgYW5kIGNvbS5hcHBsZS51aWtpdC52aWV3c2VydmljZS4qIGNhbiBiZSBkZW5pZWQKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMzYyNgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1vZGlmeSB0aGUgYWxs b3cgcnVsZSBmb3IgdGhlc2Ugc2VydmljZXMgdG8gaW5jbHVkZSB0aGUgdGVsZW1ldHJ5IG9wdGlv bi4KKworICAgICAgICAqIFJlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5X ZWJLaXQuV2ViQ29udGVudC5zYjoKKwogMjAxOS0xMS0wMSAgUGVuZyBMaXUgIDxwZW5nLmxpdTZA YXBwbGUuY29tPgogCiAgICAgICAgIFR1cm4gb24gdGhlIFBpY3R1cmUtaW4tUGljdHVyZSBBUEkg ZmVhdHVyZSBieSBkZWZhdWx0CkluZGV4OiBTb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94 UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYgo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBTb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5X ZWJLaXQuV2ViQ29udGVudC5zYgkocmV2aXNpb24gMjUxOTI5KQorKysgU291cmNlL1dlYktpdC9S ZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQu c2IJKHdvcmtpbmcgY29weSkKQEAgLTQyNSwxMSArNDI1LDE0IEBACiAKICAgICAoYWxsb3cgbWFj aC1sb29rdXAKICAgICAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuZnJvbnRib2FyZC5zeXN0 ZW1hcHBzZXJ2aWNlcyIpICAgICAgICAgICAgICAgICA7IC1bVUlWaWV3U2VydmljZUludGVyZmFj ZSBfY3JlYXRlUHJvY2Vzc0Fzc2VydGlvbl0gLT4gU0JTUHJvY2Vzc0lERm9yRGlzcGxheUlkZW50 aWZpZXIoKQorICAgICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5DQVJlbmRlclNlcnZlciIp CisgICAgICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmlvaGlkZXZlbnRzeXN0ZW0iKQorICAg ICkKKworICAgIChhbGxvdyBtYWNoLWxvb2t1cCAod2l0aCB0ZWxlbWV0cnkpCiAgICAgICAgIChn bG9iYWwtbmFtZS1yZWdleCAjIl5jb21cLmFwcGxlXC51aWtpdFwudmlld3NlcnZpY2VcLi4rIikK ICAgICAgICAgKHhwYy1zZXJ2aWNlLW5hbWUtcmVnZXggIyJcLmFwcGxlLWV4dGVuc2lvbi1zZXJ2 aWNlJCIpIDs7IDxyZGFyOi8vcHJvYmxlbS8xOTUyNTg4Nz4KICAgICAgICAgKHhwYy1zZXJ2aWNl LW5hbWUtcmVnZXggIyJcLnZpZXdzZXJ2aWNlJCIpIDs7IDxyZGFyOi8vcHJvYmxlbS8zMTI1MjM3 MT4KLSAgICAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuQ0FSZW5kZXJTZXJ2ZXIiKQotICAg ICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5pb2hpZGV2ZW50c3lzdGVtIikKICAgICApCiAK ICAgICA7IFVJS2l0LXJlcXVpcmVkIElPS2l0IG5vZGVzLgo=