|Summary:||Adopt com.apple.security.cs.jit-write-allowlist on internal builds|
|Product:||WebKit||Reporter:||Saam Barati <sbarati>|
|Severity:||Normal||CC:||ews-watchlist, keith_miller, mark.lam, msaboff, pvollan, tzagallo, webkit-bug-importer|
|Version:||WebKit Nightly Build|
Description Saam Barati 2021-02-18 17:38:33 PST
It'll prevent various pthread permissions switching APIs from working. But we can only do that on internal builds where we use the fast permission switching macro. We can't do it for open source builds, where we rely on the pthread API.
Comment 7 Per Arne Vollan 2021-06-03 11:14:25 PDT
Comment on attachment 430446 [details] proposed patch. R=me. Would it be sufficient to only add the entitlement to the WebContent XPC service?
Comment 8 Mark Lam 2021-06-03 11:29:43 PDT
(In reply to Per Arne Vollan from comment #7) > Comment on attachment 430446 [details] > proposed patch. > > R=me. Would it be sufficient to only add the entitlement to the WebContent > XPC service? Thanks. For our purpose, the goal of the entitlement isn't to gain access to something. Instead, by adopting the entitlement, we disable access to various pthread permissions switching APIs. Hence, we do want to add this entitlement to all processes because we want to disable those APIs on all processes.
Comment 10 Per Arne Vollan 2021-06-16 15:43:53 PDT
Comment on attachment 431613 [details] proposed patch. R=me.