225370 2021-05-04 16:05:17 -0700 [Cocoa] Remove access to the unused 'nvram' system command 2021-05-05 11:44:16 -0700 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham bfulgham pvollan webkit-bug-importer oldest_to_newest 1756703 0 bfulgham 2021-05-04 16:05:17 -0700 Deny access to 'nvram' in the WebKit sandboxes. No API surface interacts with this low-level feature, and other system sandboxes already deny it. It should not have been possible to reach nvram, but there's no reason to allow the sandbox to access it. <rdar://problem/66583129> 1756704 1 427709 bfulgham 2021-05-04 16:07:49 -0700 Created attachment 427709 Patch 1756714 2 bfulgham 2021-05-04 16:35:13 -0700 Confirmed proper function on iOS device and macOS. Waiting for EWS to show any other impact on downlevel platforms. 1756968 3 427709 pvollan 2021-05-05 10:02:15 -0700 Comment on attachment 427709 Patch R=me. 1757011 4 ews-feeder 2021-05-05 11:43:32 -0700 Committed r277032 (237345@main): <https://commits.webkit.org/237345@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 427709. 1757012 5 webkit-bug-importer 2021-05-05 11:44:16 -0700 <rdar://problem/77567746> 427709 2021-05-04 16:07:49 -0700 2021-05-05 11:43:33 -0700 Patch bug-225370-20210504160749.patch text/plain 5640 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjc2OTMyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDVhNGI2MTI2YzUyNjVlY2Nl YjY3MWEyZGYzOWQyNjYwYTQyNjg3MGIuLmYzYjVmZjgyN2M4MjA2ZTJlOWY4NDIzOTkyYjM2ZDA1 NzM2YjgzYzAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjIgQEAKKzIwMjEtMDUtMDQgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgW0NvY29hXSBSZW1vdmUgYWNj ZXNzIHRvIHRoZSB1bnVzZWQgJ252cmFtJyBzeXN0ZW0gY29tbWFuZAorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI1MzcwCisgICAgICAgIDxyZGFyOi8v cHJvYmxlbS82NjU4MzEyOT4KKyAgICAgICAgCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFkZCBhICdkZW55JyBydWxlIGZvciBudnJhbSwgc2luY2Ugd2Ug ZG9uJ3QgdXNlIGl0IGFuZCBoYXZlIG5vIHJlYXNvbiB0byBhY2Nlc3MgaXQuCisKKyAgICAgICAg KiBHUFVQcm9jZXNzL21hYy9jb20uYXBwbGUuV2ViS2l0LkdQVVByb2Nlc3Muc2IuaW46CisgICAg ICAgICogTmV0d29ya1Byb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQuTmV0d29ya1Byb2Nlc3Mu c2IuaW46CisgICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxl LldlYktpdC5HUFUuc2I6CisgICAgICAgICogUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3Mv Y29tLmFwcGxlLldlYktpdC5OZXR3b3JraW5nLnNiOgorICAgICAgICAqIFJlc291cmNlcy9TYW5k Ym94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2ViQXV0aG4uc2I6CisgICAgICAgICog UmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50 LnNiOgorICAgICAgICAqIFdlYkF1dGhuUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktpdC5XZWJB dXRoblByb2Nlc3Muc2IuaW46CisgICAgICAgICogV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJv Y2Vzcy5zYi5pbjoKKwogMjAyMS0wNS0wMyAgWmhlbmNoYW8gTGkgIDx6aGVuY2hhb19saUBhcHBs ZS5jb20+CiAKICAgICAgICAgQWRkIG1hY09TIFNhZmFyaSBzYW5kYm94IGV4Y2VwdGlvbiBmb3Ig Y29tLmFwcGxlLkNGTmV0d29yayBwcmVmZXJlbmNlcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktp dC9HUFVQcm9jZXNzL21hYy9jb20uYXBwbGUuV2ViS2l0LkdQVVByb2Nlc3Muc2IuaW4gYi9Tb3Vy Y2UvV2ViS2l0L0dQVVByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQuR1BVUHJvY2Vzcy5zYi5p bgppbmRleCBhZmRmYTI5NTZjMzllYTIwZjQ2NDM3N2NiMTk2NTkwOWM2ZGJiZWJiLi5kMTk4OTU4 MjFjODlmOWI0NDQ1ZDUyYmY5M2IxOThiZGJmYzU5NzAzIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi S2l0L0dQVVByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQuR1BVUHJvY2Vzcy5zYi5pbgorKysg Yi9Tb3VyY2UvV2ViS2l0L0dQVVByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQuR1BVUHJvY2Vz cy5zYi5pbgpAQCAtMjMsNiArMjMsNyBAQAogCiAodmVyc2lvbiAxKQogKGRlbnkgZGVmYXVsdCAo d2l0aCBwYXJ0aWFsLXN5bWJvbGljYXRpb24pKQorKGRlbnkgbnZyYW0qKQogKGFsbG93IHN5c3Rl bS1hdWRpdCBmaWxlLXJlYWQtbWV0YWRhdGEpCiAKIDs7OwpkaWZmIC0tZ2l0IGEvU291cmNlL1dl YktpdC9OZXR3b3JrUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktpdC5OZXR3b3JrUHJvY2Vzcy5z Yi5pbiBiL1NvdXJjZS9XZWJLaXQvTmV0d29ya1Byb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQu TmV0d29ya1Byb2Nlc3Muc2IuaW4KaW5kZXggNmJhNWY5YzlkMzMwNWNhOTUzZTM3MjJkMzM5MzU5 ODYwNmY5NWE3My4uOTgzODMxNzg2ZGM0MWNlMGEyZmI0NDJmMzQ1ODkzMGViZmVlZDNjZCAxMDA2 NDQKLS0tIGEvU291cmNlL1dlYktpdC9OZXR3b3JrUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktp dC5OZXR3b3JrUHJvY2Vzcy5zYi5pbgorKysgYi9Tb3VyY2UvV2ViS2l0L05ldHdvcmtQcm9jZXNz L21hYy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtQcm9jZXNzLnNiLmluCkBAIC0yMyw2ICsyMyw3 IEBACiAKICh2ZXJzaW9uIDEpCiAoZGVueSBkZWZhdWx0ICh3aXRoIHBhcnRpYWwtc3ltYm9saWNh dGlvbikpCisoZGVueSBudnJhbSopCiAoYWxsb3cgc3lzdGVtLWF1ZGl0IGZpbGUtcmVhZC1tZXRh ZGF0YSkKIAogI2lmIF9fTUFDX09TX1hfVkVSU0lPTl9NSU5fUkVRVUlSRUQgPj0gMTAxNTAwCmRp ZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2Nv bS5hcHBsZS5XZWJLaXQuR1BVLnNiIGIvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFBy b2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0LkdQVS5zYgppbmRleCA3MmIwY2Y3YTA3ZTJiODlm NzI4M2MwNGVkNzA0YWQ2MTNiMjY5YzE2Li4wNDA0NmFjZDFhMjA4YmFjZTBkNTkyZTk0Nzk3MGY5 NmRkMDhhMDgzIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJv ZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuR1BVLnNiCisrKyBiL1NvdXJjZS9XZWJLaXQvUmVz b3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5HUFUuc2IKQEAgLTIz LDYgKzIzLDcgQEAKIAogKHZlcnNpb24gMSkKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlhbC1z eW1ib2xpY2F0aW9uKSkKKyhkZW55IG52cmFtKikKIChhbGxvdyBzeXN0ZW0tYXVkaXQgZmlsZS1y ZWFkLW1ldGFkYXRhKQogCiA7OzsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2Vz L1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5OZXR3b3JraW5nLnNiIGIvU291 cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0 Lk5ldHdvcmtpbmcuc2IKaW5kZXggZjk4ZmI0MGMzMmM3MDM0NzZhYzViNzQwZTJmNzk4YjlkNmIx MTU4NC4uNzY5YTMxZDhkNWNlNzhjOGE0MWM1NjIyNWJiMjE4YWE5YTA4MDQ5MyAxMDA2NDQKLS0t IGEvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lvcy9jb20uYXBwbGUu V2ViS2l0Lk5ldHdvcmtpbmcuc2IKKysrIGIvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJv eFByb2ZpbGVzL2lvcy9jb20uYXBwbGUuV2ViS2l0Lk5ldHdvcmtpbmcuc2IKQEAgLTIzLDYgKzIz LDcgQEAKIAogKHZlcnNpb24gMSkKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlhbC1zeW1ib2xp Y2F0aW9uKSkKKyhkZW55IG52cmFtKikKIChhbGxvdyBzeXN0ZW0tYXVkaXQgZmlsZS1yZWFkLW1l dGFkYXRhKQogCiA7OzsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRi b3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJBdXRobi5zYiBiL1NvdXJjZS9XZWJL aXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJBdXRo bi5zYgppbmRleCAxZTMwMjI0ZTY4MDgyNWVmMzhhZTY5NDM0MzJlNDAzZTEyMDkxMTkxLi45N2Qy MWM5NzQwYjA0NjQxYWY1ODcxNGU5OTg0OTljMDcwMTUyZTgxIDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9zL2NvbS5hcHBsZS5XZWJLaXQuV2Vi QXV0aG4uc2IKKysrIGIvU291cmNlL1dlYktpdC9SZXNvdXJjZXMvU2FuZGJveFByb2ZpbGVzL2lv cy9jb20uYXBwbGUuV2ViS2l0LldlYkF1dGhuLnNiCkBAIC0yMyw2ICsyMyw3IEBACiAKICh2ZXJz aW9uIDEpCiAoZGVueSBkZWZhdWx0ICh3aXRoIHBhcnRpYWwtc3ltYm9saWNhdGlvbikpCisoZGVu eSBudnJhbSopCiAoYWxsb3cgc3lzdGVtLWF1ZGl0IGZpbGUtcmVhZC1tZXRhZGF0YSkKIAogOzs7 CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1Jlc291cmNlcy9TYW5kYm94UHJvZmlsZXMvaW9z L2NvbS5hcHBsZS5XZWJLaXQuV2ViQ29udGVudC5zYiBiL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2Vz L1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNiCmluZGV4 IDBiZDk3YTdjZDdkNThmNDg5MmIzMGRhODg1MjhlZjRiZTgyYzZiOWQuLmUwYzMyYmM3NDI0Mzlh MGZjNWFmZmFmNjM5M2NiNTMyODY5YjJkMTcgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvUmVz b3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFwcGxlLldlYktpdC5XZWJDb250ZW50LnNi CisrKyBiL1NvdXJjZS9XZWJLaXQvUmVzb3VyY2VzL1NhbmRib3hQcm9maWxlcy9pb3MvY29tLmFw cGxlLldlYktpdC5XZWJDb250ZW50LnNiCkBAIC0yMyw2ICsyMyw3IEBACiAKICh2ZXJzaW9uIDEp CiAoZGVueSBkZWZhdWx0ICh3aXRoIHBhcnRpYWwtc3ltYm9saWNhdGlvbikpCisoZGVueSBudnJh bSopCiAoYWxsb3cgc3lzdGVtLWF1ZGl0IGZpbGUtcmVhZC1tZXRhZGF0YSkKIAogOzs7CmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViS2l0L1dlYkF1dGhuUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktp dC5XZWJBdXRoblByb2Nlc3Muc2IuaW4gYi9Tb3VyY2UvV2ViS2l0L1dlYkF1dGhuUHJvY2Vzcy9t YWMvY29tLmFwcGxlLldlYktpdC5XZWJBdXRoblByb2Nlc3Muc2IuaW4KaW5kZXggYTk5MmM1NGU4 YmE4MzJlMDM1ZTQwNGI5Y2E5Yzg3YTYxYWU4NzViNi4uZDg5MmZkOWY3MjY3Yzg5N2RhMDgwZWEw YzU4YzIwZjY3ZDUwOTBkOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9XZWJBdXRoblByb2Nl c3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQuV2ViQXV0aG5Qcm9jZXNzLnNiLmluCisrKyBiL1NvdXJj ZS9XZWJLaXQvV2ViQXV0aG5Qcm9jZXNzL21hYy9jb20uYXBwbGUuV2ViS2l0LldlYkF1dGhuUHJv Y2Vzcy5zYi5pbgpAQCAtMjMsNiArMjMsNyBAQAogCiAodmVyc2lvbiAxKQogKGRlbnkgZGVmYXVs dCAod2l0aCBwYXJ0aWFsLXN5bWJvbGljYXRpb24pKQorKGRlbnkgbnZyYW0qKQogKGFsbG93IHN5 c3RlbS1hdWRpdCBmaWxlLXJlYWQtbWV0YWRhdGEpCiAKIDs7OwpkaWZmIC0tZ2l0IGEvU291cmNl L1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluIGIvU291cmNlL1dl YktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCmluZGV4IDI2Y2ZiYmYz Y2U1MGQyYWNkNGZhNjdiZDNkNDgwZDI3MzhmYmM4NGMuLjg2NGMzMWU4YjZjNjM2ZTkyOTFlMmZi ODMxYTdmZGNlMGZlYmMwMzkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9j b20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgorKysgYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3Mv Y29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW4KQEAgLTIzLDYgKzIzLDcgQEAKIAogKHZlcnNpb24g MSkKIChkZW55IGRlZmF1bHQgKHdpdGggcGFydGlhbC1zeW1ib2xpY2F0aW9uKSkKKyhkZW55IG52 cmFtKikKIChhbGxvdyBzeXN0ZW0tYXVkaXQgZmlsZS1yZWFkLW1ldGFkYXRhKQogCiA7OzsK