[iOS] Correct process-info rules to restrict to self

brentfulgham · brentfulgham · commit 78249d490abc · 2021-04-10T01:55:26.000Z
https://bugs.webkit.org/show_bug.cgi?id=224383 <rdar://problem/66582454> Reviewed by Eric Carlson. The sandbox allows 'process-info' by default, so our allow rules have no real impact. We need to deny access first, as we do on macOS, so that the allow rules have meaning. I reviewed the macOS sandbox, and made sure the iOS sandbox allows the same items. * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb: Canonical link: https://commits.webkit.org/236360@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275789 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
@@ -1,3 +1,18 @@
+2021-04-09  Brent Fulgham  <bfulgham@apple.com>
+
+        [iOS] Correct process-info rules to restrict to self
+        https://bugs.webkit.org/show_bug.cgi?id=224383
+        <rdar://problem/66582454>
+
+        Reviewed by Eric Carlson.
+
+        The sandbox allows 'process-info' by default, so our allow rules have no real impact.
+        We need to deny access first, as we do on macOS, so that the allow rules have meaning.
+
+        I reviewed the macOS sandbox, and made sure the iOS sandbox allows the same items.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+
 2021-04-09  Wenson Hsieh  <wenson_hsieh@apple.com>
 
         Web process crashes if image extraction is requested for an element that is pending image extraction
diff --git a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb
@@ -1,4 +1,4 @@
-; Copyright (C) 2010-2020 Apple Inc. All rights reserved.
+; Copyright (C) 2010-2021 Apple Inc. All rights reserved.
 ;
 ; Redistribution and use in source and binary forms, with or without
 ; modification, are permitted provided that the following conditions
@@ -764,6 +764,8 @@
 
 (allow mach-task-name (target self))
 
+;;; process-info* defaults to allow; deny it and then allow operations we actually need.
+(deny process-info*)
 (allow process-info-pidinfo (target self))
 (allow process-info-pidfdinfo (target self))
 (allow process-info-pidfileportinfo (target self))
