Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in

   1 (version 1)
   2 (deny default (with partial-symbolication))
   3 (allow ipc-posix-shm system-audit system-socket file-read-metadata)
   4
   5 (import "system.sb")
   6 (import "com.apple.corefoundation.sb")
   7
   8 ;; Distributed notifications, local pasteboard client
   9 (corefoundation)
  10
  11 ;; Utility functions for home directory relative path filters
  12 (define (home-regex home-relative-regex)
  13   (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
  14
  15 (define (home-subpath home-relative-subpath)
  16   (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
  17
  18 (define (home-literal home-relative-literal)
  19   (literal (string-append (param "HOME_DIR") home-relative-literal)))
  20
  21 ;; Read-only preferences and data
  22 (allow file-read*
  23        ;; Basic system paths
  24        (subpath "/Library/Dictionaries")
  25        (subpath "/Library/Fonts")
  26        (subpath "/Library/Frameworks")
  27        (subpath "/Library/Managed Preferences")
  28        (subpath "/private/var/db/mds")
  29        (subpath "/private/var/db/DetachedSignatures")
  30        (regex #"^/private/etc/(hosts|group|passwd)$")
  31
  32        ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
  33        (subpath "/Library/Keychains")
  34
  35        ;; System and user preferences
  36        (literal "/Library/Preferences/.GlobalPreferences.plist")
  37        (literal "/Library/Preferences/com.apple.crypto.plist")
  38        (literal "/Library/Preferences/com.apple.networkd.plist")
  39        (literal "/Library/Preferences/com.apple.security.plist")
  40        (literal "/Library/Preferences/com.apple.security.common.plist")
  41        (literal "/Library/Preferences/com.apple.security.revocation.plist")
  42        (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$")
  43        (home-literal "/Library/Preferences/.GlobalPreferences.plist")
  44        (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
  45        (home-regex #"/Library/Preferences/ByHost/com\.apple\.networkConnect\.")
  46        (home-literal "/Library/Preferences/com.apple.ATS.plist")
  47        (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
  48        (home-literal "/Library/Preferences/com.apple.HIToolbox.plist")
  49        (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
  50        (home-literal "/Library/Preferences/com.apple.QTKit.plist")
  51        (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
  52        (home-literal "/Library/Preferences/com.apple.security.plist")
  53        (home-literal "/Library/Preferences/com.apple.security.revocation.plist")
  54        (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
  55        (home-regex #"/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$")
  56
  57        ;; On-disk WebKit2 framework location, to account for debug installations
  58        ;; outside of /System/Library/Frameworks
  59        (subpath (param "WEBKIT2_FRAMEWORK_DIR"))
  60
  61        ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
  62        (home-subpath "/Library/Fonts")
  63
  64        ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
  65        (home-subpath "/Library/Audio/Plug-Ins/Components")
  66        (home-subpath "/Library/Preferences/QuickTime Preferences")
  67        (home-literal "/Library/Caches/com.apple.coreaudio.components.plist")
  68        (subpath "/Library/Audio/Plug-Ins/Components")
  69        (subpath "/Library/Audio/Plug-Ins/HAL")
  70        (subpath "/Library/Video/Plug-Ins")
  71        (subpath "/Library/QuickTime")
  72
  73        (home-subpath "/Library/Dictionaries"))
  74
  75 ;; This should be updated when <rdar://problem/9355830> is fixed.
  76 ;; Read-only extensions from UIProcess
  77 (if (defined? 'extension-class)
  78     (allow file-read* (extension "com.apple.app-sandbox.read")))
  79
  80 ;; Read-write extensions from UIProcess
  81 (allow file-read* file-write* (extension))
  82
  83 ;; Writable preferences and temporary files
  84 (allow file*
  85        (home-subpath "/Library/Caches/com.apple.WebProcess")
  86        (home-regex #"/Library/Preferences/ByHost/com\.apple\.HIToolbox\.")
  87        (home-regex #"/Library/Preferences/com\.apple\.WebProcess\.")
  88
  89        ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
  90        (home-subpath "/Library/Keychains"))
  91
  92 ;; Non-user Security mds caches
  93 (allow file*
  94     (subpath "/private/var/db/mds/system"))
  95
  96 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1080
  97 (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))
  98     (allow file* (subpath (param "DARWIN_USER_CACHE_DIR"))))
  99 #else
 100 (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))
 101     (allow file* (subpath (string-append (param "DARWIN_USER_CACHE_DIR") "/mds"))))
 102 #endif
 103
 104 (if (positive? (string-length (param "DARWIN_USER_TEMP_DIR")))
 105     (allow file* (subpath (param "DARWIN_USER_TEMP_DIR"))))
 106
 107 ;; Database directory.
 108 (if (positive? (string-length (param "WEBKIT_DATABASE_DIR")))
 109     (allow file* (subpath (param "WEBKIT_DATABASE_DIR"))))
 110
 111 ;; LocalStorage directory.
 112 (if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR")))
 113     (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR"))))
 114
 115 ;; ApplicationCache directory.
 116 (if (positive? (string-length (param "WEBKIT_APPLICATION_CACHE_DIR")))
 117     (allow file* (subpath (param "WEBKIT_APPLICATION_CACHE_DIR"))))
 118
 119 ;; The Web Inspector directory.
 120 (if (positive? (string-length (param "WEBKIT_WEB_INSPECTOR_DIR")))
 121     (allow file-read* (subpath (param "WEBKIT_WEB_INSPECTOR_DIR"))))
 122
 123 ;; The NSURLCache directory.
 124 (if (positive? (string-length (param "NSURL_CACHE_DIR")))
 125     (allow file* (subpath (param "NSURL_CACHE_DIR"))))
 126
 127 ;; The bundle resource path of the UI process.
 128 (if (positive? (string-length (param "UI_PROCESS_BUNDLE_RESOURCE_DIR")))
 129     (allow file-read* (subpath (param "UI_PROCESS_BUNDLE_RESOURCE_DIR"))))
 130
 131 ;; IOKit user clients
 132 (allow iokit-open
 133        (iokit-connection "IOAccelerator")
 134        (iokit-user-client-class "IOAccelerationUserClient")
 135        (iokit-user-client-class "IOFramebufferSharedUserClient")
 136        (iokit-user-client-class "AppleGraphicsControlClient")
 137        (iokit-user-client-class "AppleSNBFBUserClient")
 138        (iokit-user-client-class "AGPMClient")
 139        (iokit-user-client-class "IOHIDParamUserClient")
 140        (iokit-user-client-class "RootDomainUserClient")
 141        (iokit-user-client-class "IOSurfaceRootUserClient")
 142        (iokit-user-client-class "IOSurfaceSendRight")
 143        (iokit-user-client-class "IOAudioControlUserClient")
 144        (iokit-user-client-class "IOAudioEngineUserClient"))
 145
 146 ;; Various services required by AppKit and other frameworks
 147 (allow mach-lookup
 148        (global-name "com.apple.CoreServices.coreservicesd")
 149        (global-name "com.apple.DiskArbitration.diskarbitrationd")
 150        (global-name "com.apple.FileCoordination")
 151        (global-name "com.apple.FontObjectsServer")
 152        (global-name "com.apple.FontServer")
 153        (global-name "com.apple.SecurityServer")
 154        (global-name "com.apple.SystemConfiguration.configd")
 155        (global-name "com.apple.SystemConfiguration.PPPController")
 156        (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
 157        (global-name "com.apple.audio.VDCAssistant")
 158        (global-name "com.apple.audio.audiohald")
 159        (global-name "com.apple.audio.coreaudiod")
 160        (global-name "com.apple.cookied")
 161        (global-name "com.apple.cvmsServ")
 162        (global-name "com.apple.networkd")
 163        (global-name "com.apple.dock.server")
 164        (global-name "com.apple.ocspd")
 165        (global-name "com.apple.pasteboard.1")
 166        (global-name "com.apple.system.opendirectoryd.api")
 167        (global-name "com.apple.window_proxies")
 168        (global-name "com.apple.windowserver.active")
 169        (global-name "com.apple.cfnetwork.AuthBrokerAgent")
 170        (global-name "com.apple.PowerManagement.control")
 171
 172        ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
 173        (global-name "com.apple.metadata.mds"))
 174
 175 (allow system-socket (socket-domain AF_ROUTE))
 176 (allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
 177 (allow network-outbound
 178        ;; Kernel controls
 179        (control-name "com.apple.network.statistics")
 180        (control-name "com.apple.netsrc")
 181
 182        ;; Local mDNSResponder for DNS, arbitrary outbound TCP
 183        (literal "/private/var/run/mDNSResponder")
 184        (remote tcp))
 185
 186 ;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed.
 187 (allow mach-lookup (global-name "com.apple.pubsub.ipc"))
 188 (allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render"))
 189 (allow file-read*
 190        (home-literal "/Library/Preferences/com.apple.Safari.RSS.plist")
 191        (home-literal "/Library/Preferences/com.apple.Syndication.plist"))
 192
 193 ;; FIXME should be removed when <rdar://problem/9347205> + related radar in Safari is fixed
 194 (allow mach-lookup
 195        (global-name "org.h5l.kcm")
 196        (global-name "com.apple.system.logger")
 197        (global-name "com.apple.system.notification_center"))
 198 (allow network-outbound
 199        (remote udp))
 200 (allow file-read*
 201         (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Kerberos.plist"))
 202         (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.GSS.plist"))
 203         (literal (string-append (param "HOME_DIR") "/Library/Preferences/edu.mit.Kerberos"))
 204         (literal "/Library/Preferences/com.apple.Kerberos.plist")
 205         (literal "/Library/Preferences/com.apple.GSS.plist")
 206         (literal "/Library/Preferences/edu.mit.Kerberos")
 207         (literal "/private/etc/krb5.conf")
 208         (literal "/private/etc/services")
 209         (literal "/private/etc/host"))
 210
 211 (deny file-read* file-write* (with no-log)
 212        ;; FIXME: Should be removed after <rdar://problem/9422957> is fixed.
 213        (home-literal "/Library/Caches/Cache.db")
 214
 215        ;; FIXME: Should be removed after <rdar://problem/10463881> is fixed.
 216        (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")
 217        (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))