Bug 205134 – [iOS] Deny mach lookup access to "*.apple-extension-service" in the WebContent process

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[Per Arne Vollan]

As part of sandbox hardening in the WebContent process on iOS, mach lookup access to "*.apple-extension-service” should be removed.

[Per Arne Vollan]

rdar://problem/56984257

[Per Arne Vollan]

Created attachment 385437 [details]
Patch

[Per Arne Vollan]

Created attachment 385439 [details]
Patch

[Brent Fulgham]

Comment on attachment 385439 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=385439&action=review

> LayoutTests/fast/sandbox/ios/sandbox-mach-lookup.html:10
> +}

Is it expected that Mac-wk1 and Mac-wk2 would run this iOS test sub-directory?

I guess we should add it to be skipped?

[Per Arne Vollan]

(In reply to Brent Fulgham from comment #4)
> Comment on attachment 385439 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=385439&action=review
> 
> > LayoutTests/fast/sandbox/ios/sandbox-mach-lookup.html:10
> > +}
> 
> Is it expected that Mac-wk1 and Mac-wk2 would run this iOS test
> sub-directory?
> 
> I guess we should add it to be skipped?

Ah, that is a good point :)

I will update the patch, thanks for reviewing!

[Per Arne Vollan]

Created attachment 385454 [details]
Patch

[Per Arne Vollan]

Created attachment 385516 [details]
Patch

[Brent Fulgham]

Comment on attachment 385516 [details]
Patch

r=me

[Per Arne Vollan]

(In reply to Brent Fulgham from comment #8)
> Comment on attachment 385516 [details]
> Patch
> 
> r=me

Thanks for reviewing :)

[WebKit Commit Bot]

Comment on attachment 385516 [details]
Patch

Rejecting attachment 385516 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'validate-changelog', '--check-oops', '--non-interactive', 385516, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/13290657

[Per Arne Vollan]

Created attachment 385536 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 385536 [details]
Patch

Rejecting attachment 385536 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-01', 'validate-changelog', '--check-oops', '--non-interactive', 385536, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in Source/WTF/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/13290990

[Per Arne Vollan]

Created attachment 385614 [details]
Patch

[Per Arne Vollan]

Created attachment 385615 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 385615 [details]
Patch

Clearing flags on attachment: 385615

Committed r253488: <https://trac.webkit.org/changeset/253488>