Bug 169306

Summary: [Mac][iOS][WK2] Whitelist sysctl-read
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: WebKit2Assignee: Brent Fulgham <bfulgham>
Status: RESOLVED FIXED    
Severity: Normal Keywords: InRadar
Priority: P2    
Version: WebKit Nightly Build   
Hardware: All   
OS: macOS 10.12   
Attachments:
Description Flags
Patch
none
Patch achristensen: review+

Description Brent Fulgham 2017-03-07 14:20:25 PST 
We only have a small number of cases where we use sysctl in WebKit, and those cases are always in a read-only mode.

Modify our sandboxes to limit 'sysctl' use to read-only, and whitelist that access for the very small number of cases we actually use:

CTL_KERN, KERN_PROC. KERN_PROC_PID, #
CTL_HW, HW_AVAILCPU
CTL_HW, HW_NCPU
hw.model
kern.memorystatus_level
Comment 1 Brent Fulgham 2017-03-07 14:20:43 PST 
<rdar://problem/16371458>
Comment 2 Brent Fulgham 2017-03-07 14:22:24 PST 
Created attachment 303724 [details]
Patch
Comment 3 Brent Fulgham 2017-03-07 14:23:35 PST 
Created attachment 303725 [details]
Patch
Comment 4 Brent Fulgham 2017-03-07 14:53:20 PST 
Committed r213544: <http://trac.webkit.org/changeset/213544>