[macOS][GPUP] Remove sandbox write access to files

• Component: WebKit Misc.
• Status: RESOLVED FIXED

[Per Arne Vollan]

Based on telemetry, remove sandbox write access to files in the GPU process on macOS.

[Radar WebKit Bug Importer]

<rdar://problem/84620023>

[Per Arne Vollan]

Created attachment 442382 [details]
Patch

[Brent Fulgham]

Comment on attachment 442382 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=442382&action=review

r=me

> Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:-107
> -        (vnode-type REGULAR-FILE)))

Are we confident this isn't needed to support crash reporting?

[Per Arne Vollan]

(In reply to Brent Fulgham from comment #3)
> Comment on attachment 442382 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=442382&action=review
> 
> r=me
> 
> > Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:-107
> > -        (vnode-type REGULAR-FILE)))
> 
> Are we confident this isn't needed to support crash reporting?

I have tried terminating the WebContent process, which also has this rule, and no files are created in '/cores', so I believe we can remove this access.

Thanks for reviewing!

[EWS]

Tools/Scripts/svn-apply failed to apply attachment 442382 [details] to trunk.
Please resolve the conflicts and upload a new patch.

[Per Arne Vollan]

Created attachment 444069 [details]
Patch

[EWS]

Committed r285723 (244182@main): <https://commits.webkit.org/244182@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 444069 [details].