We no longer need access to the Mobile Asset service, and should deny access from the WebContent sandbox.
Created attachment 394017 [details] Patch
<rdar://problem/60650301>
Comment on attachment 394017 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394017&action=review R=me. > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:-119 > - (allow mach-lookup (with telemetry-backtrace) > - (global-name "com.apple.mobileassetd" "com.apple.mobileassetd.v2")) Should we deny (with telemetry-backtrace), in case there are some really rare cases of access we didn't catch?
Created attachment 394026 [details] Patch for landing
(In reply to Per Arne Vollan from comment #3) > Comment on attachment 394017 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=394017&action=review > > R=me. > > > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:-119 > > - (allow mach-lookup (with telemetry-backtrace) > > - (global-name "com.apple.mobileassetd" "com.apple.mobileassetd.v2")) > > Should we deny (with telemetry-backtrace), in case there are some really > rare cases of access we didn't catch? Good idea -- I've done so in the patch for cq.
Committed r258736: <https://trac.webkit.org/changeset/258736> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394026 [details].