Bug 183192 – Remove network access from the WebContent process sandbox

• Component: WebKit2
• Status: RESOLVED FIXED

[Brent Fulgham]

Now that Bug 178540 is done, we can remove basic network access from the WebContent process!

[Brent Fulgham]

I've run local tests against the upcoming macOS 10.13.4 and iOS 11.3 betas and confirmed this does not break browsing or media playback.

I ran a full test pass on macOS and confirmed no new test failures.

[Brent Fulgham]

<rdar://problem/35369115>

[Brent Fulgham]

Created attachment 334717 [details]
Patch

[Alex Christensen]

Comment on attachment 334717 [details]
Patch

r=me!
HOORAY!

[youenn fablet]

In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
(allow network-outbound
     (remote udp))

Can we try removing it as well?

[EWS Watchlist]

Comment on attachment 334717 [details]
Patch

Attachment 334717 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/6699122

Number of test failures exceeded the failure limit.

[EWS Watchlist]

Created attachment 334721 [details]
Archive of layout-test-results from ews105 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6

[youenn fablet]

Could there still be some media loading directly from the WebProcess on this Sierra bot?

[Brent Fulgham]

(In reply to youenn fablet from comment #8)
> Could there still be some media loading directly from the WebProcess on this
> Sierra bot?

Oh, I'll bet there is. I think we only took over full media loading in High Sierra.

I'll conditionalize the patch so it only takes effect on High Sierra and newer.

[Brent Fulgham]

(In reply to youenn fablet from comment #5)
> In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
> (allow network-outbound
>      (remote udp))
> 
> Can we try removing it as well?

Absolutely! I'll try it out in the morning.

[Brent Fulgham]

Created attachment 334726 [details]
Patch

[Brent Fulgham]

(In reply to Brent Fulgham from comment #10)
> (In reply to youenn fablet from comment #5)
> > In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
> > (allow network-outbound
> >      (remote udp))
> > 
> > Can we try removing it as well?
> 
> Absolutely! I'll try it out in the morning.

... or, right now.

[WebKit Commit Bot]

Comment on attachment 334726 [details]
Patch

Rejecting attachment 334726 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'land-attachment', '--force-clean', '--non-interactive', '--parent-command=commit-queue', 334726, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

Last 500 characters of output:
rdparty/autoinstalled/mechanize/_urllib2_fork.py", line 332, in _call_chain
    result = func(*args)
  File "/Volumes/Data/EWS/WebKit/Tools/Scripts/webkitpy/thirdparty/autoinstalled/mechanize/_urllib2_fork.py", line 1170, in https_open
    return self.do_open(conn_factory, req)
  File "/Volumes/Data/EWS/WebKit/Tools/Scripts/webkitpy/thirdparty/autoinstalled/mechanize/_urllib2_fork.py", line 1118, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 60] Operation timed out>

Full output: http://webkit-queues.webkit.org/results/6705241

[Brent Fulgham]

Committed r229093: <https://trac.webkit.org/changeset/229093>

[Michael Catanzaro]

Nice!