WebContent sandbox should not include 'system.sb'

• Component: WebKit2
• Status: RESOLVED FIXED

[Brent Fulgham]

To support further strengthening of the Safari sandbox, stop including the 'system.sb' sandbox, and instead place relevant rules from that sandbox profile in our WebContent sandbox.

This will allow us to tighten things down further than we could using the global sandbox.

<rdar://problem/35367154>

[Brent Fulgham]

Created attachment 326633 [details]
Patch

[Build Bot]

Comment on attachment 326633 [details]
Patch

Attachment 326633 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/5182796

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 326641 [details]
Archive of layout-test-results from ews107 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Brent Fulgham]

Created attachment 326700 [details]
Patch

[Build Bot]

Comment on attachment 326700 [details]
Patch

Attachment 326700 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/5195322

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 326701 [details]
Archive of layout-test-results from ews106 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Brent Fulgham]

Created attachment 326764 [details]
Patch

[Darin Adler]

Comment on attachment 326764 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=326764&action=review

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:32
> +;;; Imported from system.sb

We should word this comment differently.

The section below starts out as a copy of system.sb, but eventually it will be different; that’s the point of copying it here rather than doing an import command. So the comment should be worded differently to be forward-looking.

Related: the term "imported" in the comment is unnecessarily slightly confusing since the directive is "import" and idea is that we copied the contents here and did not import it.

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:217
>  (allow sysctl-read
>      (sysctl-name
> +        "hw.activecpu"
>          "hw.availcpu"
> -        "hw.ncpu"
> +        "hw.cputype"
> +        "hw.l2cachesize"
> +        "hw.logicalcpu_max"
> +        "hw.physicalcpu_max"
> +        "hw.machine"
> +        "hw.memsize"
>          "hw.model"
> +        "hw.ncpu"
> +        "hw.optional.avx1_0"
> +        "hw.optional.avx2_0"
> +        "hw.optional.sse4_2"
> +        "hw.optional.sse4_1"
> +        "hw.optional.sse3"
> +        "hw.optional.sse2"
> +        "hw.vectorunit"
> +        "kern.hostname"
> +        "kern.maxfilesperproc"
>          "kern.memorystatus_level"
> +        "kern.osrelease"
> +        "kern.ostype"
> +        "kern.osvariant_status"
> +        "kern.safeboot"
> +        "kern.version"
>          "vm.footprint_suspend"))

ChangeLog comment does not mention this change.

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:229
> -    (iokit-property-regex #"^AAPL,(DisplayPipe|OpenCLdisabled|alias-policy|boot-display|display-alias|mux-switch-state|ndrv-dev|primary-display|slot-name)")
> +    (iokit-property-regex #"^AAPL,(DisplayPipe|OpenCLdisabled|IOGraphics_LER(|_RegTag_1|_RegTag_0|_Busy_2)|alias-policy|boot-display|display-alias|mux-switch-state|ndrv-dev|primary-display|slot-name)")

ChangeLog comment does not mention this change.

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:375
>  (allow mach-lookup
> +    (xpc-service-name "com.apple.PerformanceAnalysis.animationperfd")
>      (xpc-service-name "com.apple.accessibility.mediaaccessibilityd")
>      (xpc-service-name "com.apple.audio.SandboxHelper")
>      (xpc-service-name "com.apple.coremedia.videodecoder")
>      (xpc-service-name "com.apple.coremedia.videoencoder")
>      (xpc-service-name-regex #"\.apple-extension-service$")
>      (xpc-service-name "com.apple.hiservices-xpcservice")
> +    (xpc-service-name "com.apple.ist.ds.appleconnect2.HelperService")
>      (xpc-service-name "com.apple.print.normalizerd")
> +    (xpc-service-name "com.apple.securityd.xpc")
> +    (xpc-service-name "com.apple.signpost.signpost-notificationd")
>  )

ChangeLog comment does not mention this change.

[Brent Fulgham]

Created attachment 326830 [details]
Patch

[Build Bot]

Comment on attachment 326830 [details]
Patch

Attachment 326830 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/5220993

New failing tests:
http/tests/workers/service/service-worker-clear.html

[Build Bot]

Created attachment 326836 [details]
Archive of layout-test-results from ews123 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews123  Port: ios-simulator-wk2  Platform: Mac OS X 10.12.6

[Brent Fulgham]

Comment on attachment 326830 [details]
Patch

This sandbox is not used for any iOS build, so the test failure is spurious.

[WebKit Commit Bot]

Comment on attachment 326830 [details]
Patch

Clearing flags on attachment: 326830

Committed r224799: <https://trac.webkit.org/changeset/224799>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Ryosuke Niwa]

This caused WebContent process to crash at launch. See https://webkit.org/b/179656.