Bug 206114 - [iOS] Remove 'com.apple.diagnosticd' from WebContent process sandbox
Summary: [iOS] Remove 'com.apple.diagnosticd' from WebContent process sandbox
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on: 205292
Blocks:
  Show dependency treegraph
 
Reported: 2020-01-10 17:15 PST by Brent Fulgham
Modified: 2020-01-13 09:39 PST (History)
4 users (show)

See Also:


Attachments
Patch (5.20 KB, patch)
2020-01-10 17:25 PST, Brent Fulgham
pvollan: review+
bfulgham: commit-queue?
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2020-01-10 17:15:49 PST
In Bug 205292 we began dynamically adding a sandbox extension for 'com.apple.diagnosticd' when needed. We should remove the blanket permission from the sandbox.
Comment 1 Radar WebKit Bug Importer 2020-01-10 17:19:38 PST
<rdar://problem/58496791>
Comment 2 Brent Fulgham 2020-01-10 17:25:16 PST
Created attachment 387404 [details]
Patch
Comment 3 Brent Fulgham 2020-01-10 17:28:42 PST
Comment on attachment 387404 [details]
Patch

Tests pass on device.
Comment 4 Per Arne Vollan 2020-01-10 17:35:06 PST
Comment on attachment 387404 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=387404&action=review

> LayoutTests/fast/sandbox/ios/sandbox-mach-lookup.html:18
> +    shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.diagnosticd\")");

I expected this to be true, since we always issue the extension for internal builds, but perhaps I am mistaken?
Comment 5 Per Arne Vollan 2020-01-13 07:54:16 PST
Comment on attachment 387404 [details]
Patch

R=me. Perhaps you could consider removing the test, since I expect there to always be access to diagnostics in internal builds, because an extension is issued in this case.
Comment 6 Brent Fulgham 2020-01-13 09:38:20 PST
(In reply to Per Arne Vollan from comment #5)
> Comment on attachment 387404 [details]
> Patch
> 
> R=me. Perhaps you could consider removing the test, since I expect there to
> always be access to diagnostics in internal builds, because an extension is
> issued in this case.

Yes -- you are right. We can't write a test that will work in Open Source and Internal environments.
Comment 7 Brent Fulgham 2020-01-13 09:39:38 PST
Committed r254436: <https://trac.webkit.org/changeset/254436>