Skip to content
Permalink
Browse files
[macOS] Disable permissive call logging in sandbox
https://bugs.webkit.org/show_bug.cgi?id=194061
<rdar://problem/47686253>

Reviewed by Brent Fulgham.

Strict call filtering should be reenabled.

* WebProcess/com.apple.WebProcess.sb.in:


Canonical link: https://commits.webkit.org/209456@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242141 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
pvollan committed Feb 27, 2019
1 parent a7d4b4a commit 5aeb4d67323e51bea1f2a98ea82bdb23c56cf1ba
Showing 2 changed files with 14 additions and 0 deletions.
@@ -1,3 +1,15 @@
2019-02-27 Per Arne Vollan <pvollan@apple.com>

[macOS] Disable permissive call logging in sandbox
https://bugs.webkit.org/show_bug.cgi?id=194061
<rdar://problem/47686253>

Reviewed by Brent Fulgham.

Strict call filtering should be reenabled.

* WebProcess/com.apple.WebProcess.sb.in:

2019-02-27 Chris Dumez <cdumez@apple.com>

[HTTPSUpgrade] Use open source database until the feature is ready
@@ -837,6 +837,7 @@
#endif // PLATFORM(MAC)

(when (defined? 'syscall-unix)
(deny syscall-unix (with send-signal SIGKILL))
(allow syscall-unix
(syscall-number SYS_exit)
(syscall-number SYS_read)
@@ -967,6 +968,7 @@
(syscall-number SYS_ulock_wait)
(syscall-number SYS_ulock_wake)
(syscall-number SYS_work_interval_ctl)
(syscall-number SYS_kdebug_typefilter)
)
)

0 comments on commit 5aeb4d6

Please sign in to comment.