[iOS] Block access to unused resources in the Networking process' sandbox

[Per Arne Vollan]

Based on telemetry, block access to unused resources in the Networking process' sandbox on iOS.

[Radar WebKit Bug Importer]

<rdar://problem/85411927>

[Per Arne Vollan]

Created attachment 444254 [details]
Patch

[Per Arne Vollan]

Created attachment 444263 [details]
Patch

[Per Arne Vollan]

Created attachment 444280 [details]
Patch

[Brent Fulgham]

Comment on attachment 444280 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=444280&action=review

r=me

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:128
> +           (global-name "com.apple.symptomsd"))

Might be tidier to include this in the deny/with-telemetry on line 121.

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:175
>             (global-name "com.apple.nsurlsessiond"))

It's shocking to me that this isn't needed!

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:338
>          (subpath "/private/var/preferences/Logging"))

Could this be combined with the set on line 325 above (along with /private/var/db/timezone?)

[Per Arne Vollan]

Created attachment 444672 [details]
Patch

[Per Arne Vollan]

(In reply to Brent Fulgham from comment #5)
> Comment on attachment 444280 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=444280&action=review
> 
> r=me
> 
> > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:128
> > +           (global-name "com.apple.symptomsd"))
> 
> Might be tidier to include this in the deny/with-telemetry on line 121.
> 

Fixed.

> > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:175
> >             (global-name "com.apple.nsurlsessiond"))
> 
> It's shocking to me that this isn't needed!
> 

Yes, I agree, this is surprising. Telemetry and local testing suggests that the mach service is unused and can be denied. We still have telemetry enabled in the sandbox.

> > Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:338
> >          (subpath "/private/var/preferences/Logging"))
> 
> Could this be combined with the set on line 325 above (along with
> /private/var/db/timezone?)

Done.

Thanks for reviewing!

[EWS]

Committed r286004 (244401@main): <https://commits.webkit.org/244401@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 444672 [details].

[Per Arne Vollan]

Reopening to attach new patch.

[Per Arne Vollan]

Created attachment 444711 [details]
Patch

[EWS]

Committed r286022 (244411@main): <https://commits.webkit.org/244411@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 444711 [details].