Bug 231594

Summary: Restrict "darwin-notification-post" to a minimal set in the WP sandbox
Product: WebKit Reporter: Per Arne Vollan <pvollan>
Component: WebKit Misc.Assignee: Per Arne Vollan <pvollan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, gavin.p, mazander, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
bfulgham: review+
Patch none

Description Per Arne Vollan 2021-10-12 10:34:36 PDT
Restrict "darwin-notification-post" to a minimal set in the WP sandbox on macOS and iOS.
Comment 1 Per Arne Vollan 2021-10-12 10:42:03 PDT
<rdar://66586792>
Comment 2 Per Arne Vollan 2021-10-13 09:08:58 PDT
Created attachment 441088 [details]
Patch
Comment 3 Brent Fulgham 2021-10-13 10:12:43 PDT
Comment on attachment 441088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=441088&action=review

r=me

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:1577
> +(allow darwin-notification-post (with telemetry)

Do we need to collect telemetry on the items we allow? Presumably we allow them because we know we need them?
Comment 4 Per Arne Vollan 2021-10-13 11:16:41 PDT
(In reply to Brent Fulgham from comment #3)
> Comment on attachment 441088 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=441088&action=review
> 
> r=me
> 
> > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:1577
> > +(allow darwin-notification-post (with telemetry)
> 
> Do we need to collect telemetry on the items we allow? Presumably we allow
> them because we know we need them?

Yes, that is a good point; I'll remove the telemetry.

Thanks for reviewing!
Comment 5 Per Arne Vollan 2021-10-13 11:19:33 PDT
Created attachment 441111 [details]
Patch
Comment 6 EWS 2021-10-13 12:05:44 PDT
Committed r284119 (242939@main): <https://commits.webkit.org/242939@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 441111 [details].