Bug 212720

Summary: Revise sandbox to support network stack telemetry without sandbox violation reports
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: WebKit2Assignee: Brent Fulgham <bfulgham>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, pvollan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch for landing none

Brent Fulgham
Reported 2020-06-03 15:19:47 PDT
Telemetry captured for various networking configurations has revealed a handful of mach service connections that should be allowed in the Network Process to support troubleshooting and field diagnostics. This patch revises the sandbox to avoid logging these accesses during normal operation, and to silence the back-traces in cases where we expect these ports to be unavailable.
Attachments
Patch (9.94 KB, patch)
2020-06-03 16:31 PDT, Brent Fulgham 		no flags
DetailsFormatted DiffDiff
Patch for landing (9.94 KB, patch)
2020-06-04 12:11 PDT, Brent Fulgham 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Brent Fulgham
Comment 1 2020-06-03 15:23:09 PDT
<rdar://problem/63895783>
Brent Fulgham
Comment 2 2020-06-03 16:31:45 PDT
Created attachment 400980 [details] Patch
Per Arne Vollan
Comment 3 2020-06-03 16:42:25 PDT
Comment on attachment 400980 [details] Patch Great! R=me.
Per Arne Vollan
Comment 4 2020-06-03 16:43:23 PDT
Comment on attachment 400980 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:953 > + "com.apple.osanalytics.osanalyticshelper" You also need to add this to the extension rule, I think.
Per Arne Vollan
Comment 5 2020-06-04 07:03:38 PDT
Comment on attachment 400980 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review >> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:953 >> + "com.apple.osanalytics.osanalyticshelper" > > You also need to add this to the extension rule, I think. Scratch that, this is the extension rule :)
Per Arne Vollan
Comment 6 2020-06-04 07:24:22 PDT
Comment on attachment 400980 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review > Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:300 > + (global-name "com.apple.aggregated") Perhaps we could issue an extension for internal builds, since this was a service not allowed before? > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:513 > + (global-name "com.apple.aggregated") Ditto.
EWS
Comment 7 2020-06-04 10:34:33 PDT
Tools/Scripts/svn-apply failed to apply attachment 400980 [details] to trunk. Please resolve the conflicts and upload a new patch.
Brent Fulgham
Comment 8 2020-06-04 12:11:21 PDT
Created attachment 401060 [details] Patch for landing
EWS
Comment 9 2020-06-04 12:45:06 PDT
Committed r262560: <https://trac.webkit.org/changeset/262560> All reviewed patches have been landed. Closing bug and clearing flags on attachment 401060 [details].
Note You need to log in before you can comment on or make changes to this bug.