[iOS][WebContent] Block iopolicysys syscall in sandbox#52241
Merged
webkit-commit-queue merged 1 commit intoWebKit:mainfrom Oct 14, 2025
Merged
Conversation
pvollan
added
the
WebKit Process Model
Collaborator
|
EWS run on current version of this PR (hash 2118730) Details |
brentfulgham
approved these changes
Oct 13, 2025
Contributor
brentfulgham
left a comment
brentfulgham
left a comment
There was a problem hiding this comment.
Looks good. r=me.
Please consider filing a reminder bug to remove the telemetry once we're confident this change will stay permanently.
| (deny file-write-mount file-write-unmount) | ||
|
|
||
| (deny process-iopolicy-get (with telemetry)) | ||
| (deny process-iopolicy-set (with telemetry)) |
Contributor
There was a problem hiding this comment.
Should we file a bug to remind ourselves to remove this telemetry once we've captured enough live-on time?
Contributor
Author
There was a problem hiding this comment.
Good point! I'll file a bug for that.
Thanks for reviewing!
Contributor
Author
There was a problem hiding this comment.
pvollan
added
the
unsafe-merge-queue
https://bugs.webkit.org/show_bug.cgi?id=300630 rdar://162528753 Reviewed by Brent Fulgham. This syscall is rarely used, and the client is handling the blocking gracefully, so it can be blocked. * Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.Development.sb.in: * Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in: * Source/WebKit/Shared/Sandbox/iOS/webcontent-defines.sb: Canonical link: https://commits.webkit.org/301474@main
webkit-commit-queue
force-pushed
the
eng/iOS-WebContent-Block-iopolicysys-syscall-in-sandbox
branch
from
2118730 to
6b5ffb6
Compare
Collaborator
|
Committed 301474@main (6b5ffb6): https://commits.webkit.org/301474@main Reviewed commits have been landed. Closing PR #52241 and removing active labels. |
webkit-commit-queue
removed
the
unsafe-merge-queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
6b5ffb6
2118730