Bug 212720 – Revise sandbox to support network stack telemetry without sandbox violation reports

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Brent Fulgham]

Telemetry captured for various networking configurations has revealed a handful of mach service connections that should be allowed in the Network Process to support troubleshooting and field diagnostics.

This patch revises the sandbox to avoid logging these accesses during normal operation, and to silence the back-traces in cases where we expect these ports to be unavailable.

[Brent Fulgham]

<rdar://problem/63895783>

[Brent Fulgham]

Created attachment 400980 [details]
Patch

[Per Arne Vollan]

Comment on attachment 400980 [details]
Patch

Great! R=me.

[Per Arne Vollan]

Comment on attachment 400980 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:953
> +            "com.apple.osanalytics.osanalyticshelper"

You also need to add this to the extension rule, I think.

[Per Arne Vollan]

Comment on attachment 400980 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review

>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:953
>> +            "com.apple.osanalytics.osanalyticshelper"
> 
> You also need to add this to the extension rule, I think.

Scratch that, this is the extension rule :)

[Per Arne Vollan]

Comment on attachment 400980 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=400980&action=review

> Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:300
> +    (global-name "com.apple.aggregated")

Perhaps we could issue an extension for internal builds, since this was a service not allowed before?

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:513
> +    (global-name "com.apple.aggregated")

Ditto.

[EWS]

Tools/Scripts/svn-apply failed to apply attachment 400980 [details] to trunk.
Please resolve the conflicts and upload a new patch.

[Brent Fulgham]

Created attachment 401060 [details]
Patch for landing

[EWS]

Committed r262560: <https://trac.webkit.org/changeset/262560>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 401060 [details].