Bug 189385 - [iOS] Move default mach-lookup deny to after common.sb is imported
Summary: [iOS] Move default mach-lookup deny to after common.sb is imported
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-09-06 16:46 PDT by Brent Fulgham
Modified: 2018-09-07 05:28 PDT (History)
5 users (show)

See Also:


Attachments
Patch (3.26 KB, patch)
2018-09-06 16:49 PDT, Brent Fulgham
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2018-09-06 16:46:49 PDT
The default deny rule in our iOS sandboxes happens before we import common.sb, which potentially allows more things than we would prefer in the WebContent, Storage, or Network processes.

Instead, we should first import 'common.sb', then deny all lookups so we can be sure we only enable the items we absolutely need to function.
Comment 1 Brent Fulgham 2018-09-06 16:47:05 PDT
<rdar://problem/43624193>
Comment 2 Brent Fulgham 2018-09-06 16:49:13 PDT
Created attachment 349092 [details]
Patch
Comment 3 Brent Fulgham 2018-09-06 16:49:43 PDT
I tested this manually on device to confirm proper function.
Comment 4 WebKit Commit Bot 2018-09-07 05:28:32 PDT
Comment on attachment 349092 [details]
Patch

Clearing flags on attachment: 349092

Committed r235781: <https://trac.webkit.org/changeset/235781>
Comment 5 WebKit Commit Bot 2018-09-07 05:28:34 PDT
All reviewed patches have been landed.  Closing bug.