Address kernel MIG sandbox telemetry #11777
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pvollan
added
the
WebKit Misc.
|
EWS run on previous version of this PR (hash 7cdd4ef)
|
pvollan
requested review from
cdumez,
geoffreygaren,
szewai,
johnwilander and
gavin-apple
pvollan
force-pushed
the
eng/Address-kernel-MIG-sandbox-telemetry
branch
from
7cdd4ef
to
275a1c4
Compare
|
EWS run on previous version of this PR (hash 275a1c4)
|
brentfulgham
approved these changes
Mar 21, 2023
| @@ -1002,14 +1002,17 @@ | |||
| (when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'mach-kernel-endpoint)) | |||
| (allow mach-kernel-endpoint | |||
| (apply-message-filter | |||
| (allow mach-message-send (with report) (with telemetry)) | |||
| (deny mach-message-send (with telemetry)) | |||
There was a problem hiding this comment.
Do we not want a report if we deny the message-send? Seems like if we are willing to pay the cost of telemetry, we should try to generate a report, too? Or do you think that will be a perf hit?
| @@ -694,10 +694,11 @@ | |||
| (when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'mach-kernel-endpoint)) | |||
| (allow mach-kernel-endpoint | |||
| (apply-message-filter | |||
| (allow mach-message-send (with report) (with telemetry)) | |||
| (deny mach-message-send (with telemetry)) | |||
There was a problem hiding this comment.
Ditto: Should we try to get a local report, in case we miss a telemetry window because of other logging?
pvollan
force-pushed
the
eng/Address-kernel-MIG-sandbox-telemetry
branch
from
275a1c4
to
c6fa833
Compare
|
EWS run on previous version of this PR (hash c6fa833)
|
That is a good point. I believe we still will get local reports, since that is the default action on a violation. Thanks for reviewing! |
pvollan
force-pushed
the
eng/Address-kernel-MIG-sandbox-telemetry
branch
from
c6fa833
to
e3caf66
Compare
|
EWS run on current version of this PR (hash e3caf66)
|
https://bugs.webkit.org/show_bug.cgi?id=254234 rdar://106829883 Reviewed by Brent Fulgham. Address kernel MIG sandbox telemetry in the GPU and Network process. This patch also enforces the filters. * Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in: * Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in: * Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb.in: Canonical link: https://commits.webkit.org/263551@main
webkit-commit-queue
force-pushed
the
eng/Address-kernel-MIG-sandbox-telemetry
branch
from
e3caf66
to
0850093
Compare
|
Committed 263551@main (0850093): https://commits.webkit.org/263551@main Reviewed commits have been landed. Closing PR #11777 and removing active labels. |
webkit-commit-queue
removed
the
merge-queue
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
0850093
e3caf66
🧪 mac-AS-debug-wk2