Attachment 359765 Details for Bug 193454 – Patch

[patch] Patch

bug-193454-20190122123631.patch (text/plain), 1.31 KB, created by Per Arne Vollan on 2019-01-22 12:36:32 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Per Arne Vollan

Created: 2019-01-22 12:36:32 PST

Size: 1.31 KB

patch

obsolete

>Index: Source/WebKit/ChangeLog
>===================================================================
>--- Source/WebKit/ChangeLog	(revision 240255)
>+++ Source/WebKit/ChangeLog	(working copy)
>@@ -1,3 +1,16 @@
>+2019-01-22  Per Arne Vollan  <pvollan@apple.com>
>+
>+        [macOS] Adjust logging policy in WebKit's sandbox
>+        https://bugs.webkit.org/show_bug.cgi?id=193454
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add a rule to initially deny all calls, since the default is to allow every call.
>+        Later rules allow syscalls that we determined are needed for proper WebKit function.
>+        This reduces the API surface available to attackers.
>+
>+        * WebProcess/com.apple.WebProcess.sb.in:
>+
> 2019-01-22  Oriol Brufau  <obrufau@igalia.com>
> 
>         [css-logical] Implement flow-relative margin, padding and border shorthands
>Index: Source/WebKit/WebProcess/com.apple.WebProcess.sb.in
>===================================================================
>--- Source/WebKit/WebProcess/com.apple.WebProcess.sb.in	(revision 240255)
>+++ Source/WebKit/WebProcess/com.apple.WebProcess.sb.in	(working copy)
>@@ -825,6 +825,7 @@
> #endif // PLATFORM(MAC)
> 
> (when (defined? 'syscall-unix)
>+    (deny syscall-unix (with termination))
>     (allow syscall-unix
>         (syscall-number SYS_exit)
>         (syscall-number SYS_read)

Actions: View | Formatted Diff | Diff

Attachments on bug 193454: 359177 | 359185 | 359545 | 359746 | 359765