Bug 189385

Summary: [iOS] Move default mach-lookup deny to after common.sb is imported
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: WebKit2Assignee: Brent Fulgham <bfulgham>
Status: RESOLVED FIXED    
Severity: Normal CC: achristensen, bfulgham, commit-queue, eric.carlson, youennf
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Brent Fulgham 2018-09-06 16:46:49 PDT 
The default deny rule in our iOS sandboxes happens before we import common.sb, which potentially allows more things than we would prefer in the WebContent, Storage, or Network processes.

Instead, we should first import 'common.sb', then deny all lookups so we can be sure we only enable the items we absolutely need to function.
Comment 1 Brent Fulgham 2018-09-06 16:47:05 PDT 
<rdar://problem/43624193>
Comment 2 Brent Fulgham 2018-09-06 16:49:13 PDT 
Created attachment 349092 [details]
Patch
Comment 3 Brent Fulgham 2018-09-06 16:49:43 PDT 
I tested this manually on device to confirm proper function.
Comment 4 WebKit Commit Bot 2018-09-07 05:28:32 PDT 
Comment on attachment 349092 [details]
Patch

Clearing flags on attachment: 349092

Committed r235781: <https://trac.webkit.org/changeset/235781>
Comment 5 WebKit Commit Bot 2018-09-07 05:28:34 PDT 
All reviewed patches have been landed.  Closing bug.