Bug 209815 – [macOS] Add additional IPC permission needed by Security.framework

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Brent Fulgham]

WebKit's Network sandbox needs the ipc-posix-shm-write-create permission to properly interact with the 'com.apple.AppleDatabaseChanged' name.

[Brent Fulgham]

<rdar://problem/60892378>

[Brent Fulgham]

Created attachment 395052 [details]
Patch

[Per Arne Vollan]

Comment on attachment 395052 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395052&action=review

R=me.

> Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:359
> -(allow ipc-posix-shm-read* ipc-posix-shm-write-data
> +(allow ipc-posix-shm-read* ipc-posix-shm-write-create ipc-posix-shm-write-data
>         (ipc-posix-name "com.apple.AppleDatabaseChanged"))

Does older macOS versions still need ipc-posix-shm-write-data?

[Brent Fulgham]

Comment on attachment 395052 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395052&action=review

>> Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:359
>>         (ipc-posix-name "com.apple.AppleDatabaseChanged"))
> 
> Does older macOS versions still need ipc-posix-shm-write-data?

Yes -- this is entirely about needing to add *-create, not about taking anything else away.

It's possible we could have left the old rule for pre-10.15 systems, but I don't think the extra complexity in the sandbox is worth it.

[EWS]

Committed r259300: <https://trac.webkit.org/changeset/259300>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 395052 [details].