code.vuplus.com Git - vuplus_webkit/blob - Source/WebKit2/WebProcess/com.apple.WebProcess.sb

   1 (version 1)
   2 (deny default (with partial-symbolication))
   3 (allow ipc-posix-shm system-audit system-socket file-read-metadata)
   4
   5 (import "system.sb")
   6 (import "com.apple.corefoundation.sb")
   7
   8 ;; Distributed notifications, local pasteboard client
   9 (corefoundation)
  10
  11 ;; Utility functions for home directory relative path filters
  12 (define (home-regex home-relative-regex)
  13   (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
  14
  15 (define (home-subpath home-relative-subpath)
  16   (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
  17
  18 (define (home-literal home-relative-literal)
  19   (literal (string-append (param "HOME_DIR") home-relative-literal)))
  20
  21 ;; Read-only preferences and data
  22 (allow file-read*
  23        ;; Basic system paths
  24        (subpath "/Library/Dictionaries")
  25        (subpath "/Library/Fonts")
  26        (subpath "/Library/Frameworks")
  27        (subpath "/Library/Keychains")
  28        (subpath "/private/var/db/mds")
  29        (subpath "/private/var/db/DetachedSignatures")
  30        (regex #"^/private/etc/(hosts|group|passwd)$")
  31
  32        ;; System and user preferences
  33        (literal "/Library/Preferences/.GlobalPreferences.plist")
  34        (literal "/Library/Preferences/com.apple.crypto.plist")
  35        (literal "/Library/Preferences/com.apple.security.plist")
  36        (literal "/Library/Preferences/com.apple.security.common.plist")
  37        (literal "/Library/Preferences/com.apple.security.revocation.plist")
  38        (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$")
  39        (home-literal "/Library/Preferences/.GlobalPreferences.plist")
  40        (home-regex "/Library/Preferences/ByHost/\.GlobalPreferences\.")
  41        (home-regex "/Library/Preferences/ByHost/com\.apple\.networkConnect\.")
  42        (home-literal "/Library/Preferences/com.apple.ATS.plist")
  43        (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
  44        (home-literal "/Library/Preferences/com.apple.HIToolbox.plist")
  45        (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
  46        (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
  47        (home-literal "/Library/Preferences/com.apple.security.plist")
  48        (home-literal "/Library/Preferences/com.apple.security.revocation.plist")
  49        (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
  50        (home-regex "/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$")
  51
  52        ;; On-disk WebKit2 framework location, to account for debug installations
  53        ;; outside of /System/Library/Frameworks
  54        (subpath (param "WEBKIT2_FRAMEWORK_DIR"))
  55
  56        ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
  57        (home-subpath "/Library/Fonts")
  58
  59        ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
  60        (home-subpath "/Library/Audio/Plug-Ins/Components")
  61        (home-subpath "/Library/Preferences/QuickTime Preferences")
  62        (home-literal "/Library/Caches/com.apple.coreaudio.components.plist")
  63        (subpath "/Library/Audio/Plug-Ins/Components")
  64        (subpath "/Library/Audio/Plug-Ins/HAL")
  65        (subpath "/Library/Video/Plug-Ins")
  66        (subpath "/Library/QuickTime")
  67
  68        ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed.
  69        (home-literal "/Library/Preferences/com.apple.universalaccess.plist")
  70
  71        ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed.
  72        (home-subpath "/Library/Keyboard Layouts")
  73
  74        ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed.
  75        (home-subpath "/Library/Input Methods")
  76
  77        (home-subpath "/Library/Dictionaries"))
  78
  79 ;; This should be updated when <rdar://problem/9355830> is fixed.
  80 ;; Read-only extensions from UIProcess
  81 (if (defined? 'extension-class)
  82     (allow file-read* (extension "com.apple.app-sandbox.read")))
  83
  84 ;; Read-write extensions from UIProcess
  85 (allow file-read* file-write* (extension))
  86
  87 ;; Writable preferences and temporary files
  88 (allow file*
  89        (home-subpath "/Library/Caches/com.apple.WebProcess")
  90        (home-regex "/Library/Preferences/ByHost/com\.apple\.HIToolbox\.")
  91        (home-regex "/Library/Preferences/com\.apple\.WebProcess\.")
  92        (home-subpath "/Library/Keychains")
  93
  94        ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
  95        (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")
  96        (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))
  97
  98 (allow file-read-data
  99        ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
 100        (home-literal "/Library/Preferences"))
 101
 102 ;; Non-user Security mds caches
 103 (allow file*
 104     (subpath "/private/var/db/mds/system"))
 105
 106 ;; Darwin temporary files and Security mds caches, if present
 107 (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))
 108     (allow file* (subpath (string-append (param "DARWIN_USER_CACHE_DIR") "/mds"))))
 109 (if (positive? (string-length (param "DARWIN_USER_TEMP_DIR")))
 110     (allow file* (subpath (param "DARWIN_USER_TEMP_DIR"))))
 111
 112 ;; Database directory.
 113 (if (positive? (string-length (param "WEBKIT_DATABASE_DIR")))
 114     (allow file* (subpath (param "WEBKIT_DATABASE_DIR"))))
 115
 116 ;; LocalStorage directory.
 117 (if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR")))
 118     (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR"))))
 119
 120 ;; ApplicationCache directory.
 121 (if (positive? (string-length (param "WEBKIT_APPLICATION_CACHE_DIR")))
 122     (allow file* (subpath (param "WEBKIT_APPLICATION_CACHE_DIR"))))
 123
 124 ;; The NSURLCache directory.
 125 (if (positive? (string-length (param "NSURL_CACHE_DIR")))
 126     (allow file* (subpath (param "NSURL_CACHE_DIR"))))
 127
 128 ;; The bundle resource path of the UI process.
 129 (if (positive? (string-length (param "UI_PROCESS_BUNDLE_RESOURCE_DIR")))
 130     (allow file-read* (subpath (param "UI_PROCESS_BUNDLE_RESOURCE_DIR"))))
 131
 132 ;; IOKit user clients
 133 (allow iokit-open
 134        (iokit-connection "IOAccelerator")
 135        (iokit-user-client-class "IOAccelerationUserClient")
 136        (iokit-user-client-class "IOFramebufferSharedUserClient")
 137        (iokit-user-client-class "AppleGraphicsControlClient")
 138        (iokit-user-client-class "AGPMClient")
 139        (iokit-user-client-class "IOHIDParamUserClient")
 140        (iokit-user-client-class "RootDomainUserClient")
 141        (iokit-user-client-class "IOSurfaceRootUserClient")
 142        (iokit-user-client-class "IOSurfaceSendRight")
 143        (iokit-user-client-class "IOAudioControlUserClient")
 144        (iokit-user-client-class "IOAudioEngineUserClient"))
 145
 146 ;; Various services required by AppKit and other frameworks
 147 (allow mach-lookup
 148        (global-name "com.apple.CoreServices.coreservicesd")
 149        (global-name "com.apple.DiskArbitration.diskarbitrationd")
 150        (global-name "com.apple.FileCoordination")
 151        (global-name "com.apple.FontObjectsServer")
 152        (global-name "com.apple.FontServer")
 153        (global-name "com.apple.SecurityServer")
 154        (global-name "com.apple.SystemConfiguration.configd")
 155        (global-name "com.apple.SystemConfiguration.PPPController")
 156        (global-name "com.apple.audio.VDCAssistant")
 157        (global-name "com.apple.audio.audiohald")
 158        (global-name "com.apple.audio.coreaudiod")
 159        (global-name "com.apple.cookied")
 160        (global-name "com.apple.cvmsServ")
 161        (global-name "com.apple.networkd")
 162        (global-name "com.apple.dock.server")
 163        (global-name "com.apple.ocspd")
 164        (global-name "com.apple.pasteboard.1")
 165        (global-name "com.apple.system.opendirectoryd.api")
 166        (global-name "com.apple.window_proxies")
 167        (global-name "com.apple.windowserver.active")
 168
 169        ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
 170        (global-name "com.apple.metadata.mds"))
 171
 172 (allow system-socket (socket-domain AF_ROUTE))
 173 (allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
 174 (allow network-outbound
 175        ;; Kernel controls
 176        (control-name "com.apple.network.statistics")
 177        (control-name "com.apple.netsrc")
 178
 179        ;; Local mDNSResponder for DNS, arbitrary outbound TCP
 180        (literal "/private/var/run/mDNSResponder")
 181        (remote tcp))
 182
 183 ;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed.
 184 (allow mach-lookup (global-name "com.apple.pubsub.ipc"))
 185 (allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render"))
 186 (allow file-read*
 187        (home-literal "/Library/Preferences/com.apple.Safari.RSS.plist")
 188        (home-literal "/Library/Preferences/com.apple.Syndication.plist"))
 189
 190 ;; FIXME should be removed when <rdar://problem/9347205> + related radar in Safari is fixed
 191 (allow mach-lookup
 192        (global-name "org.h5l.kcm")
 193        (global-name "com.apple.system.logger")
 194        (global-name "com.apple.system.notification_center"))
 195 (allow network-outbound
 196        (remote udp))
 197 (allow file-read*
 198         (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Kerberos.plist"))
 199         (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.GSS.plist"))
 200         (literal (string-append (param "HOME_DIR") "/Library/Preferences/edu.mit.Kerberos"))
 201         (literal "/Library/Preferences/com.apple.Kerberos.plist")
 202         (literal "/Library/Preferences/com.apple.GSS.plist")
 203         (literal "/Library/Preferences/edu.mit.Kerberos")
 204         (literal "/private/etc/krb5.conf")
 205         (literal "/private/etc/services")
 206         (literal "/private/etc/host"))
 207
 208 ;; FIXME: Should be removed after <rdar://problem/9422957> is fixed
 209 (deny file-read* file-write* (with no-log)
 210       (home-literal "/Library/Caches/Cache.db"))