We are getting some console spam due to Sandboxing blocking processes from using system-fctl (via Foundation) to mark various things as "hot" for caching purposes. We need to tell our sandbox profiles that this fctl operation is okay.
<rdar://problem/22920815>
Created attachment 271866 [details] Patch
Comment on attachment 271866 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=271866&action=review > Source/WebKit2/ChangeLog:4 > + https://bugs.webkit.org/show_bug.cgi?id=154503 Please add a radar link here. > Source/WebKit2/ChangeLog:16 > + * Resources/PlugInSandboxProfiles/com.apple.QuickTime Plugin.plugin.sb: > + * Resources/PlugInSandboxProfiles/com.apple.WebKit.plugin-common.sb: > + * Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb: > + * Resources/PlugInSandboxProfiles/com.microsoft.SilverlightPlugin.sb: > + * Resources/PlugInSandboxProfiles/com.oracle.java.JavaAppletPlugin.sb: Individual plugin profiles don't need to be modified, as they are always combined with com.apple.WebKit.plugin-common.sb. > Source/WebKit2/ChangeLog:17 > + * WebProcess/com.apple.WebProcess.sb.in: Is this needed in Networking and Databases processes? > Source/WebKit2/Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb:66 > +(allow system-fsctl (fsctl-command (_IO "h" 47))) > + > (allow network-bind (local ip)) > +(allow system-fsctl (fsctl-command (_IO "h" 47))) Why twice?
(In reply to comment #3) > > + * Resources/PlugInSandboxProfiles/com.oracle.java.JavaAppletPlugin.sb: > > Individual plugin profiles don't need to be modified, as they are always > combined with com.apple.WebKit.plugin-common.sb. Oh, excellent! I'll get rid of the redundancy. > > Source/WebKit2/ChangeLog:17 > > + * WebProcess/com.apple.WebProcess.sb.in: > > Is this needed in Networking and Databases processes? It doesn't seem to be, but I could easily see the Database process wanting to notify the caching system that certain files are 'hot'. So I'll add it to the Database process. The Networking process should not need this itself. > > Source/WebKit2/Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb:66 > > +(allow system-fsctl (fsctl-command (_IO "h" 47))) > > + > > (allow network-bind (local ip)) > > +(allow system-fsctl (fsctl-command (_IO "h" 47))) > > Why twice? :-(
Created attachment 271896 [details] Patch
Comment on attachment 271896 [details] Patch > The Networking process should not need this itself. Why not? It does caching, accesses keychains and preferences. sudo fs_usage com.apple.WebKit.Networking | grep /
Committed r196939: <http://trac.webkit.org/changeset/196939>
(In reply to comment #6) > Comment on attachment 271896 [details] > Patch > > > The Networking process should not need this itself. > > Why not? It does caching, accesses keychains and preferences. > > sudo fs_usage com.apple.WebKit.Networking | grep / You are right. I'll modify that as well.