Title: [286032] trunk/Source/WebKit
- Revision
- 286032
- Author
- [email protected]
- Date
- 2021-11-18 15:01:57 -0800 (Thu, 18 Nov 2021)
Log Message
Add syscall telemetry in the Networking process
https://bugs.webkit.org/show_bug.cgi?id=233203
<rdar://problem/85504351>
Reviewed by Brent Fulgham.
Add syscall telemetry in the Networking process on macOS and iOS.
* NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
* Scripts/process-entitlements.sh:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (286031 => 286032)
--- trunk/Source/WebKit/ChangeLog 2021-11-18 23:01:18 UTC (rev 286031)
+++ trunk/Source/WebKit/ChangeLog 2021-11-18 23:01:57 UTC (rev 286032)
@@ -1,3 +1,17 @@
+2021-11-18 Per Arne Vollan <[email protected]>
+
+ Add syscall telemetry in the Networking process
+ https://bugs.webkit.org/show_bug.cgi?id=233203
+ <rdar://problem/85504351>
+
+ Reviewed by Brent Fulgham.
+
+ Add syscall telemetry in the Networking process on macOS and iOS.
+
+ * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
+ * Scripts/process-entitlements.sh:
+
2021-11-18 Per Arne <[email protected]>
[macOS][GPUP] Remove access to mach services in sandbox
Modified: trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (286031 => 286032)
--- trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2021-11-18 23:01:18 UTC (rev 286031)
+++ trunk/Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2021-11-18 23:01:57 UTC (rev 286032)
@@ -569,3 +569,46 @@
SYS_ulock_wait
SYS_ulock_wake
SYS_workq_kernreturn)))
+
+#if HAVE(SANDBOX_MESSAGE_FILTERING)
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'mach-kernel-endpoint))
+ (allow mach-kernel-endpoint
+ (apply-message-filter
+ (allow mach-message-send (with telemetry)))))
+
+(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
+ (allow syscall-mach (with report) (with telemetry))
+ (allow syscall-mach
+ (machtrap-number
+ MSC__kernelrpc_mach_port_allocate_trap
+ MSC__kernelrpc_mach_port_construct_trap
+ MSC__kernelrpc_mach_port_deallocate_trap
+ MSC__kernelrpc_mach_port_destruct_trap
+ MSC__kernelrpc_mach_port_extract_member_trap
+ MSC__kernelrpc_mach_port_guard_trap
+ MSC__kernelrpc_mach_port_insert_member_trap
+ MSC__kernelrpc_mach_port_mod_refs_trap
+ MSC__kernelrpc_mach_port_request_notification_trap
+ MSC__kernelrpc_mach_port_type_trap
+ MSC__kernelrpc_mach_port_unguard_trap
+ MSC__kernelrpc_mach_vm_allocate_trap
+ MSC__kernelrpc_mach_vm_deallocate_trap
+ MSC__kernelrpc_mach_vm_map_trap
+ MSC__kernelrpc_mach_vm_protect_trap
+ MSC__kernelrpc_mach_vm_purgable_control_trap
+ MSC_host_create_mach_voucher_trap
+ MSC_host_self_trap
+ MSC_mach_generate_activity_id
+ MSC_mach_msg_trap
+ MSC_mach_reply_port
+ MSC_mach_voucher_extract_attr_recipe_trap
+ MSC_mk_timer_arm
+ MSC_mk_timer_cancel
+ MSC_mk_timer_create
+ MSC_semaphore_signal_trap
+ MSC_semaphore_wait_trap
+ MSC_swtch_pri
+ MSC_syscall_thread_switch
+ MSC_task_self_trap
+ MSC_thread_get_special_reply_port)))
+#endif // HAVE(SANDBOX_MESSAGE_FILTERING)
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (286031 => 286032)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb 2021-11-18 23:01:18 UTC (rev 286031)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb 2021-11-18 23:01:57 UTC (rev 286032)
@@ -736,3 +736,46 @@
SYS_write
SYS_write_nocancel
SYS_writev)))
+
+(when (defined? 'syscall-mach)
+ (allow syscall-mach (with report) (with telemetry))
+ (allow syscall-mach
+ (machtrap-number
+ MSC__kernelrpc_mach_port_allocate_trap
+ MSC__kernelrpc_mach_port_construct_trap
+ MSC__kernelrpc_mach_port_deallocate_trap
+ MSC__kernelrpc_mach_port_destruct_trap
+ MSC__kernelrpc_mach_port_extract_member_trap
+ MSC__kernelrpc_mach_port_guard_trap
+ MSC__kernelrpc_mach_port_insert_member_trap
+ MSC__kernelrpc_mach_port_insert_right_trap
+ MSC__kernelrpc_mach_port_mod_refs_trap
+ MSC__kernelrpc_mach_port_request_notification_trap
+ MSC__kernelrpc_mach_port_type_trap
+ MSC__kernelrpc_mach_port_unguard_trap
+ MSC__kernelrpc_mach_vm_allocate_trap
+ MSC__kernelrpc_mach_vm_deallocate_trap
+ MSC__kernelrpc_mach_vm_map_trap
+ MSC__kernelrpc_mach_vm_protect_trap
+ MSC__kernelrpc_mach_vm_purgable_control_trap
+ MSC_host_create_mach_voucher_trap
+ MSC_host_self_trap
+ MSC_mach_generate_activity_id
+ MSC_mach_msg_trap
+ MSC_mach_reply_port
+ MSC_mach_timebase_info_trap
+ MSC_mach_voucher_extract_attr_recipe_trap
+ MSC_mk_timer_arm
+ MSC_mk_timer_cancel
+ MSC_mk_timer_create
+ MSC_mk_timer_destroy
+ MSC_semaphore_signal_trap
+ MSC_semaphore_wait_trap
+ MSC_syscall_thread_switch
+ MSC_task_self_trap
+ MSC_thread_get_special_reply_port)))
+
+(when (defined? 'mach-kernel-endpoint)
+ (allow mach-kernel-endpoint
+ (apply-message-filter
+ (allow mach-message-send (with report) (with telemetry)))))
Modified: trunk/Source/WebKit/Scripts/process-entitlements.sh (286031 => 286032)
--- trunk/Source/WebKit/Scripts/process-entitlements.sh 2021-11-18 23:01:18 UTC (rev 286031)
+++ trunk/Source/WebKit/Scripts/process-entitlements.sh 2021-11-18 23:01:57 UTC (rev 286032)
@@ -114,6 +114,7 @@
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
then
+ plistbuddy Add :com.apple.private.security.message-filter bool YES
plistbuddy Add :com.apple.private.tcc.manager.check-by-audit-token array
plistbuddy Add :com.apple.private.tcc.manager.check-by-audit-token:0 string kTCCServiceWebKitIntelligentTrackingPrevention
fi
@@ -325,6 +326,7 @@
plistbuddy Add :com.apple.private.memorystatus bool YES
plistbuddy Add :com.apple.private.memory.ownership_transfer bool YES
plistbuddy Add :com.apple.private.network.socket-delegate bool YES
+ plistbuddy Add :com.apple.private.security.message-filter bool YES
plistbuddy Add :com.apple.private.webkit.use-xpc-endpoint bool YES
plistbuddy Add :com.apple.runningboard.assertions.webkit bool YES
@@ -406,6 +408,7 @@
plistbuddy Add :com.apple.private.memorystatus bool YES
plistbuddy Add :com.apple.private.network.socket-delegate bool YES
plistbuddy Add :com.apple.private.webkit.use-xpc-endpoint bool YES
+ plistbuddy Add :com.apple.private.security.message-filter bool YES
plistbuddy Add :com.apple.runningboard.assertions.webkit bool YES
plistbuddy Add :com.apple.private.tcc.manager.check-by-audit-token array
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
