205468 2019-12-19 13:05:15 -0800 Unblock iokit-get-property needed for frame buffer initialization 2019-12-19 15:38:34 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham achristensen ap bfulgham commit-queue ggaren pvollan webkit-bug-importer oldest_to_newest 1600450 0 bfulgham 2019-12-19 13:05:15 -0800 Sandbox logging indicates that we are now blocking an iokit-get-property call that is needed when starting up the WebContent process. 1600451 1 bfulgham 2019-12-19 13:05:27 -0800 <rdar://problem/57897684> 1600452 2 386135 bfulgham 2019-12-19 13:07:32 -0800 Created attachment 386135 Patch 1600480 3 386135 pvollan 2019-12-19 13:33:34 -0800 Comment on attachment 386135 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=386135&action=review > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:105 > + ; IOMobileFramebuffer > + (with-filter (iokit-registry-entry-class "IOMobileFramebuffer") > + (allow iokit-get-properties > + (iokit-property "AppleTV" > + "DisplayPipePlaneBaseAlignment" > + "DisplayPipeStrideRequirements" > + "PerformanceStatistics" > + "appleTV-VID0" > + "appleTV-VID1" > + "hdcp-hoover-protocol"))) > + > + (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily") > +) Do we need to audit new iokit get properties rules in the WebContent process? Or is it always safe to add these? 1600490 4 386135 pvollan 2019-12-19 13:58:27 -0800 Comment on attachment 386135 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=386135&action=review >> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:105 >> +) > > Do we need to audit new iokit get properties rules in the WebContent process? Or is it always safe to add these? Are all strictly needed, or would a subset be sufficient? 1600491 5 386135 bfulgham 2019-12-19 14:04:07 -0800 Comment on attachment 386135 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=386135&action=review >>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:105 >>> +) >> >> Do we need to audit new iokit get properties rules in the WebContent process? Or is it always safe to add these? > > Are all strictly needed, or would a subset be sufficient? Many of these are already part of the "global" set of allow rules; I want to move to this model for them in the future. So this change is a first step in that direction. I think these are safe to add from a security standpoint. They were vetted for use in container.sb, and David has stated that he isn't worried about these "read data" properties. 1600499 6 386135 pvollan 2019-12-19 14:22:59 -0800 Comment on attachment 386135 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=386135&action=review R=me. >>>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:105 >>>> +) >>> >>> Do we need to audit new iokit get properties rules in the WebContent process? Or is it always safe to add these? >> >> Are all strictly needed, or would a subset be sufficient? > > Many of these are already part of the "global" set of allow rules; I want to move to this model for them in the future. So this change is a first step in that direction. > > I think these are safe to add from a security standpoint. They were vetted for use in container.sb, and David has stated that he isn't worried about these "read data" properties. Sounds good! 1600538 7 bfulgham 2019-12-19 15:38:34 -0800 Committed r253792: <https://trac.webkit.org/changeset/253792> 386135 2019-12-19 13:07:32 -0800 2019-12-19 14:30:52 -0800 Patch bug-205468-20191219130731.patch text/plain 2033 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjUzNzc4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDE4MmI2ZmM2OGY1NmI4ZDg0 ZmM3ZjViZTY1ZGI2ZTg1YzQ1ZjUwOTYuLmQ4ODBjMmNkYzYwZTQ3YTA5NzhkZDdkMjJjNDE5N2Nk YTgzOWEzMDkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTktMTItMTkgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgVW5ibG9jayBpb2tpdC1nZXQt cHJvcGVydHkgbmVlZGVkIGZvciBmcmFtZSBidWZmZXIgaW5pdGlhbGl6YXRpb24KKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNTQ2OAorICAgICAgICA8 cmRhcjovL3Byb2JsZW0vNTc4OTc2ODQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgKiBSZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBw bGUuV2ViS2l0LldlYkNvbnRlbnQuc2I6CisKIDIwMTktMTItMTkgIEJyZW50IEZ1bGdoYW0gIDxi ZnVsZ2hhbUBhcHBsZS5jb20+CiAKICAgICAgICAgV2ViQ29udGVudCBwcm9jZXNzIGRvZXMgbm90 IG5lZWQgYWNjZXNzIHRvICdjb20uYXBwbGUuc3lzdGVtLmxvZ2dlcicKZGlmZiAtLWdpdCBhL1Nv dXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktp dC5XZWJDb250ZW50LnNiIGIvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVz L2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IKaW5kZXggNjExNDY4MGRjZDc0Yjgx MjcxZDBmODcwMGY3NGVlMDNhN2EwMjM5Yi4uMTNmMWIxNTIzZTQzOWMxNzVkYjMzMTMyNmQwNjQ5 MDhmMGRkZGRmZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFBy b2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNvbnRlbnQuc2IKKysrIGIvU291cmNlL1dl YktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LldlYkNv bnRlbnQuc2IKQEAgLTg5LDcgKzg5LDIwIEBACiAoZGVmaW5lLW9uY2UgKGZyYW1lYnVmZmVyLWFj Y2VzcykKICAgICAoYWxsb3cgaW9raXQtb3BlbgogICAgICAgICAgICAoaW9raXQtdXNlci1jbGll bnQtY2xhc3MgIklPTW9iaWxlRnJhbWVidWZmZXJVc2VyQ2xpZW50IikpCi0gICAgKG1vYmlsZS1w cmVmZXJlbmNlcy1yZWFkICJjb20uYXBwbGUuaW9raXQuSU9Nb2JpbGVHcmFwaGljc0ZhbWlseSIp KQorCisgICAgOyBJT01vYmlsZUZyYW1lYnVmZmVyCisgICAgKHdpdGgtZmlsdGVyIChpb2tpdC1y ZWdpc3RyeS1lbnRyeS1jbGFzcyAiSU9Nb2JpbGVGcmFtZWJ1ZmZlciIpCisgICAgICAgIChhbGxv dyBpb2tpdC1nZXQtcHJvcGVydGllcworICAgICAgICAgICAgICAgKGlva2l0LXByb3BlcnR5ICJB cHBsZVRWIgorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJEaXNwbGF5UGlwZVBsYW5l QmFzZUFsaWdubWVudCIKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiRGlzcGxheVBp cGVTdHJpZGVSZXF1aXJlbWVudHMiCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlBl cmZvcm1hbmNlU3RhdGlzdGljcyIKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYXBw bGVUVi1WSUQwIgorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhcHBsZVRWLVZJRDEi CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImhkY3AtaG9vdmVyLXByb3RvY29sIikp KQorCisgICAgKG1vYmlsZS1wcmVmZXJlbmNlcy1yZWFkICJjb20uYXBwbGUuaW9raXQuSU9Nb2Jp bGVHcmFwaGljc0ZhbWlseSIpCispCiAKIChkZWZpbmUtb25jZSAoYXNzZXQtYWNjZXNzIC4gb3B0 aW9ucykKICAgICAobGV0ICgoYXNzZXQtYWNjZXNzLWZpbHRlcgo=