Bug 205077 - [iOS] Deny mach lookup access to content filter service in the WebContent sandbox
Summary: [iOS] Deny mach lookup access to content filter service in the WebContent san...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Per Arne Vollan
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-12-10 12:24 PST by Per Arne Vollan
Modified: 2019-12-18 13:02 PST (History)
5 users (show)

See Also:


Attachments
Patch (16.18 KB, patch)
2019-12-10 13:40 PST, Per Arne Vollan
bfulgham: review+
Details | Formatted Diff | Diff
Patch (11.44 KB, patch)
2019-12-10 15:57 PST, Per Arne Vollan
no flags Details | Formatted Diff | Diff
Patch (14.31 KB, patch)
2019-12-11 11:12 PST, Per Arne Vollan
no flags Details | Formatted Diff | Diff
Patch (1.03 KB, patch)
2019-12-13 14:33 PST, Per Arne Vollan
no flags Details | Formatted Diff | Diff
Patch (1.03 KB, patch)
2019-12-13 15:25 PST, Per Arne Vollan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Per Arne Vollan 2019-12-10 12:24:37 PST
The WebContent process' sandbox should deny mach lookup to the content filter service. Instead an extension from the UI process should be consumed when needed.
Comment 1 Radar WebKit Bug Importer 2019-12-10 12:25:13 PST
<rdar://problem/57803795>
Comment 2 Per Arne Vollan 2019-12-10 13:40:10 PST
Created attachment 385302 [details]
Patch
Comment 3 Brent Fulgham 2019-12-10 14:35:38 PST
Comment on attachment 385302 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=385302&action=review

Looks good! r=me

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:969
> +        (global-name "com.apple.iphone.axserver-systemwide" "com.apple.tccd" "com.apple.AGXCompilerService" "com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI")))

Is there an equivalent process we use on macOS that we could treat the same way?
Comment 4 Per Arne Vollan 2019-12-10 15:57:05 PST
Created attachment 385312 [details]
Patch
Comment 5 Per Arne Vollan 2019-12-10 17:29:31 PST
(In reply to Brent Fulgham from comment #3)
> Comment on attachment 385302 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=385302&action=review
> 
> Looks good! r=me
> 
> > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:969
> > +        (global-name "com.apple.iphone.axserver-systemwide" "com.apple.tccd" "com.apple.AGXCompilerService" "com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI")))
> 
> Is there an equivalent process we use on macOS that we could treat the same
> way?

That’s a good point. I will try to find the equivalent service on macOS, so we can do the same there.

Thanks for reviewing!
Comment 6 Per Arne Vollan 2019-12-11 11:12:43 PST
Created attachment 385413 [details]
Patch
Comment 7 Per Arne Vollan 2019-12-11 11:15:35 PST
(In reply to Per Arne Vollan from comment #6)
> Created attachment 385413 [details]
> Patch

I uploaded another patch with a potential fix for the API test failure. Brent, are you OK with landing this, or would you like to do another review?
Comment 8 Brent Fulgham 2019-12-12 10:21:32 PST
Comment on attachment 385413 [details]
Patch

r=me
Comment 9 Per Arne Vollan 2019-12-12 10:37:21 PST
(In reply to Brent Fulgham from comment #8)
> Comment on attachment 385413 [details]
> Patch
> 
> r=me

Thanks for reviewing!
Comment 10 WebKit Commit Bot 2019-12-12 11:09:21 PST
Comment on attachment 385413 [details]
Patch

Clearing flags on attachment: 385413

Committed r253440: <https://trac.webkit.org/changeset/253440>
Comment 11 Per Arne Vollan 2019-12-13 14:33:05 PST
Created attachment 385644 [details]
Patch
Comment 12 Per Arne Vollan 2019-12-13 15:25:01 PST
Reopening to attach new patch.
Comment 13 Per Arne Vollan 2019-12-13 15:25:02 PST
Created attachment 385647 [details]
Patch
Comment 14 Brent Fulgham 2019-12-18 12:56:48 PST
(In reply to Per Arne Vollan from comment #13)
> Created attachment 385647 [details]
> Patch

Do you need to land this other patch, too? It's not marked for review.
Comment 15 Per Arne Vollan 2019-12-18 13:02:34 PST
(In reply to Brent Fulgham from comment #14)
> (In reply to Per Arne Vollan from comment #13)
> > Created attachment 385647 [details]
> > Patch
> 
> Do you need to land this other patch, too? It's not marked for review.

This was landed manually as a tvOS build fix.