Bug 218920

Summary: [macOS] Issue sandbox extension to the WebContent process for com.apple.lskdd
Product: WebKit Reporter: Per Arne Vollan <pvollan>
Component: WebKit Misc.Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, ggaren, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch
none
Patch none

Description Per Arne Vollan 2020-11-13 12:18:41 PST 
This is a Media related service, and a sandbox extension should be issued to the WebContent process based on GPU runtime settings.
Comment 1 Per Arne Vollan 2020-11-13 12:20:09 PST 
<rdar://problem/69168801>
Comment 2 Per Arne Vollan 2020-11-13 12:26:12 PST 
Created attachment 414078 [details]
Patch
Comment 3 Per Arne Vollan 2020-11-13 12:28:26 PST 
Created attachment 414079 [details]
Patch
Comment 4 Per Arne Vollan 2020-11-13 12:35:54 PST 
Created attachment 414082 [details]
Patch
Comment 5 Geoffrey Garen 2020-11-13 12:43:56 PST 
Comment on attachment 414082 [details]
Patch

r=me

When we enable GPU Process for media, we plan to deny access to lskdd and the other media related mach services. But before we deny access to a service, we prefer to gather telemetry on its use. How will we gather telemetry on the media related mach services before we deny them outright?
Comment 6 Per Arne Vollan 2020-11-13 12:55:47 PST 
(In reply to Geoffrey Garen from comment #5)
> Comment on attachment 414082 [details]
> Patch
> 
> r=me
> 
> When we enable GPU Process for media, we plan to deny access to lskdd and
> the other media related mach services. But before we deny access to a
> service, we prefer to gather telemetry on its use. How will we gather
> telemetry on the media related mach services before we deny them outright?

I think we should create a temporary rule, where we allow Media services, but with telemetry. This is what we currently do for GPU related IOKit classes.

Thanks for reviewing!
Comment 7 EWS 2020-11-13 14:14:21 PST 
Committed r269792: <https://trac.webkit.org/changeset/269792>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 414082 [details].