205240 2019-12-14 14:15:57 -0800 [iOS] Deny mach lookup access to "*.viewservice" in the WebContent process 2019-12-14 15:20:54 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 pvollan pvollan bfulgham commit-queue ggaren webkit-bug-importer oldest_to_newest 1598670 0 pvollan 2019-12-14 14:15:57 -0800 As part of sandbox hardening in the WebContent process, mach lookup access to “*.viewservice” should be removed. 1598671 1 pvollan 2019-12-14 14:16:12 -0800 rdar://problem/56990598 1598672 2 385700 pvollan 2019-12-14 14:20:49 -0800 Created attachment 385700 Patch 1598673 3 385700 bfulgham 2019-12-14 14:30:13 -0800 Comment on attachment 385700 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=385700&action=review R=me > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:-446 > - (xpc-service-name-regex #"\.viewservice$") ;; <rdar://problem/31252371> Here we go! 1598674 4 pvollan 2019-12-14 14:35:36 -0800 (In reply to Brent Fulgham from comment #3) > Comment on attachment 385700 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=385700&action=review > > R=me > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:-446 > > - (xpc-service-name-regex #"\.viewservice$") ;; <rdar://problem/31252371> > > Here we go! Thanks for reviewing :) 1598676 5 385700 commit-queue 2019-12-14 15:20:52 -0800 Comment on attachment 385700 Patch Clearing flags on attachment: 385700 Committed r253529: <https://trac.webkit.org/changeset/253529> 1598677 6 commit-queue 2019-12-14 15:20:54 -0800 All reviewed patches have been landed. Closing bug. 385700 2019-12-14 14:20:49 -0800 2019-12-14 15:20:52 -0800 Patch bug-205240-20191214142048.patch text/plain 3395 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTM1MjgpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE5LTEyLTE0ICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBbaU9TXSBEZW55IG1hY2ggbG9v a3VwIGFjY2VzcyB0byAiKi52aWV3c2VydmljZSIgaW4gdGhlIFdlYkNvbnRlbnQgcHJvY2Vzcwor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA1MjQwCisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQXMgcGFydCBv ZiBzYW5kYm94IGhhcmRlbmluZyBpbiB0aGUgV2ViQ29udGVudCBwcm9jZXNzLCBtYWNoIGxvb2t1 cCBhY2Nlc3MgdG8g4oCcKi52aWV3c2VydmljZeKAnSBzaG91bGQgYmUgcmVtb3ZlZC4KKworICAg ICAgICBUZXN0OiBmYXN0L3NhbmRib3gvaW9zL3NhbmRib3gtbWFjaC1sb29rdXAuaHRtbAorCisg ICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5X ZWJDb250ZW50LnNiOgorCiAyMDE5LTEyLTE0ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5j b20+CiAKICAgICAgICAgV2ViU1dTZXJ2ZXJDb25uZWN0aW9uOjpzdGFydEZldGNoKCkgc2hvdWxk IG5ldmVyIGZhaWwgc3luY2hyb25vdXNseQpJbmRleDogU291cmNlL1dlYktpdC9SZXNvdXJjZXMv U2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20u YXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IJKHJldmlzaW9uIDI1MzUyNikKKysrIFNvdXJjZS9X ZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJD b250ZW50LnNiCSh3b3JraW5nIGNvcHkpCkBAIC00NDMsNyArNDQzLDYgQEAKIAogICAgIChhbGxv dyBtYWNoLWxvb2t1cCAod2l0aCByZXBvcnQpICh3aXRoIHRlbGVtZXRyeSkKICAgICAgICAgKGds b2JhbC1uYW1lLXJlZ2V4ICMiXmNvbVwuYXBwbGVcLnVpa2l0XC52aWV3c2VydmljZVwuLisiKQot ICAgICAgICAoeHBjLXNlcnZpY2UtbmFtZS1yZWdleCAjIlwudmlld3NlcnZpY2UkIikgOzsgPHJk YXI6Ly9wcm9ibGVtLzMxMjUyMzcxPgogICAgICkKIAogICAgIDsgVUlLaXQtcmVxdWlyZWQgSU9L aXQgbm9kZXMuCkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTM1MjYpCisrKyBMYXlvdXRUZXN0cy9DaGFu Z2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxMyBAQAorMjAxOS0xMi0xNCAgUGVyIEFy bmUgVm9sbGFuICA8cHZvbGxhbkBhcHBsZS5jb20+CisKKyAgICAgICAgW2lPU10gRGVueSBtYWNo IGxvb2t1cCBhY2Nlc3MgdG8gIioudmlld3NlcnZpY2UiIGluIHRoZSBXZWJDb250ZW50IHByb2Nl c3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNTI0 MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZmFz dC9zYW5kYm94L2lvcy9zYW5kYm94LW1hY2gtbG9va3VwLWV4cGVjdGVkLnR4dDoKKyAgICAgICAg KiBmYXN0L3NhbmRib3gvaW9zL3NhbmRib3gtbWFjaC1sb29rdXAuaHRtbDoKKwogMjAxOS0xMi0x MyAgTXlsZXMgQy4gTWF4ZmllbGQgIDxtbWF4ZmllbGRAYXBwbGUuY29tPgogCiAgICAgICAgIFt3 YXRjaE9TXSBBcHBsZS5jb20gaXMgcmVuZGVyZWQgaW4gVGltZXMgTmV3IFJvbWFuCkluZGV4OiBM YXlvdXRUZXN0cy9mYXN0L3NhbmRib3gvaW9zL3NhbmRib3gtbWFjaC1sb29rdXAtZXhwZWN0ZWQu dHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3Qvc2FuZGJveC9pb3Mvc2FuZGJveC1t YWNoLWxvb2t1cC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDI1MzUyNikKKysrIExheW91dFRlc3Rz L2Zhc3Qvc2FuZGJveC9pb3Mvc2FuZGJveC1tYWNoLWxvb2t1cC1leHBlY3RlZC50eHQJKHdvcmtp bmcgY29weSkKQEAgLTQsNCArNCw1IEBAIE9uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmll cyBvZiAiUEEKIAogCiBQQVNTIGludGVybmFscy5oYXNTYW5kYm94TWFjaExvb2t1cEFjY2Vzc1Rv WFBDU2VydmljZU5hbWUoImNvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudCIsICJjb20uYXBwbGUu YXBwbGUtZXh0ZW5zaW9uLXNlcnZpY2UiKSBpcyBmYWxzZQorUEFTUyBpbnRlcm5hbHMuaGFzU2Fu ZGJveE1hY2hMb29rdXBBY2Nlc3NUb1hQQ1NlcnZpY2VOYW1lKCJjb20uYXBwbGUuV2ViS2l0Lldl YkNvbnRlbnQiLCAiY29tLmFwcGxlLnZpZXdzZXJ2aWNlIikgaXMgZmFsc2UKIApJbmRleDogTGF5 b3V0VGVzdHMvZmFzdC9zYW5kYm94L2lvcy9zYW5kYm94LW1hY2gtbG9va3VwLmh0bWwKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9zYW5kYm94L2lvcy9zYW5kYm94LW1hY2gtbG9va3Vw Lmh0bWwJKHJldmlzaW9uIDI1MzUyNikKKysrIExheW91dFRlc3RzL2Zhc3Qvc2FuZGJveC9pb3Mv c2FuZGJveC1tYWNoLWxvb2t1cC5odG1sCSh3b3JraW5nIGNvcHkpCkBAIC03LDYgKzcsNyBAQCBk ZXNjcmlwdGlvbignUmVncmVzc2lvbiB0ZXN0cyBmb3IgbWFjaCBsCiAKIGlmICh3aW5kb3cuaW50 ZXJuYWxzKSB7CiAgICAgc2hvdWxkQmVGYWxzZSgiaW50ZXJuYWxzLmhhc1NhbmRib3hNYWNoTG9v a3VwQWNjZXNzVG9YUENTZXJ2aWNlTmFtZShcImNvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudFwi LCBcImNvbS5hcHBsZS5hcHBsZS1leHRlbnNpb24tc2VydmljZVwiKSIpOworICAgIHNob3VsZEJl RmFsc2UoImludGVybmFscy5oYXNTYW5kYm94TWFjaExvb2t1cEFjY2Vzc1RvWFBDU2VydmljZU5h bWUoXCJjb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnRcIiwgXCJjb20uYXBwbGUudmlld3NlcnZp Y2VcIikiKTsKIH0KIDwvc2NyaXB0PgogPC9oZWFkPgo=