Bug 135134 - Correct sandbox profiles to fix some excess privileges
Summary: Correct sandbox profiles to fix some excess privileges
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Oliver Hunt
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-21 16:41 PDT by Oliver Hunt
Modified: 2014-07-21 17:17 PDT (History)
1 user (show)

See Also:

Attachments
Patch (6.05 KB, patch)
2014-07-21 16:50 PDT, Oliver Hunt 		ap: review+
ap: commit-queue-
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2014-07-21 16:41:56 PDT 
Correct sandbox profiles to fix some excess privileges
Comment 1 Oliver Hunt 2014-07-21 16:50:06 PDT 
Created attachment 235253 [details]
Patch
Comment 2 Alexey Proskuryakov 2014-07-21 17:05:58 PDT 
Comment on attachment 235253 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=235253&action=review

> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb:32
> +(allow file-read* file-write* (require-any (
> +    extension "com.apple.app-sandbox.read-write") (extension "com.apple.app-sandbox.read-write")))

This is nonsense - com.apple.app-sandbox.read-write is repeated twice. Please fix.

> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:40
> +    (require-any (extension "com.apple.webkit.read-write") (extension "com.apple.app-sandbox.read-write"))

I think that com.apple.webkit.read-write is here by some misunderstanding. Please remove, or at the very least, please add a FIXME about removing it.

> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:74
> +    (require-any (extension "com.apple.webkit.read-write") (extension "com.apple.app-sandbox.read-write"))

Ditto.
Comment 3 Oliver Hunt 2014-07-21 17:11:05 PDT 
Committed r171322: <http://trac.webkit.org/changeset/171322>
Comment 4 Darin Adler 2014-07-21 17:17:57 PDT 
(In reply to comment #3)
> Committed r171322: <http://trac.webkit.org/changeset/171322>

This contained the string “webkti” in a couple places.