RESOLVED FIXED 232247
[macOS][GPUP] Remove sandbox write access to files 
https://bugs.webkit.org/show_bug.cgi?id=232247
Summary [macOS][GPUP] Remove sandbox write access to files
Per Arne Vollan
Reported 2021-10-25 10:29:53 PDT
Based on telemetry, remove sandbox write access to files in the GPU process on macOS.
Attachments
Patch (1.75 KB, patch)
2021-10-25 10:31 PDT, Per Arne Vollan 		bfulgham: review+
ews-feeder: commit-queue-
DetailsFormatted DiffDiff
Patch (1.64 KB, patch)
2021-11-12 08:10 PST, Per Arne Vollan 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2021-10-25 10:30:33 PDT
<rdar://problem/84620023>
Per Arne Vollan
Comment 2 2021-10-25 10:31:57 PDT
Created attachment 442382 [details] Patch
Brent Fulgham
Comment 3 2021-11-10 14:34:37 PST
Comment on attachment 442382 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=442382&action=review r=me > Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:-107 > - (vnode-type REGULAR-FILE))) Are we confident this isn't needed to support crash reporting?
Per Arne Vollan
Comment 4 2021-11-12 07:27:36 PST
(In reply to Brent Fulgham from comment #3) > Comment on attachment 442382 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=442382&action=review > > r=me > > > Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:-107 > > - (vnode-type REGULAR-FILE))) > > Are we confident this isn't needed to support crash reporting? I have tried terminating the WebContent process, which also has this rule, and no files are created in '/cores', so I believe we can remove this access. Thanks for reviewing!
EWS
Comment 5 2021-11-12 07:29:01 PST
Tools/Scripts/svn-apply failed to apply attachment 442382 [details] to trunk. Please resolve the conflicts and upload a new patch.
Per Arne Vollan
Comment 6 2021-11-12 08:10:12 PST
Created attachment 444069 [details] Patch
EWS
Comment 7 2021-11-12 08:39:07 PST
Committed r285723 (244182@main): <https://commits.webkit.org/244182@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 444069 [details].
Note You need to log in before you can comment on or make changes to this bug.