Bug 207276

Summary: Update sandbox to allow communication with dnssd service
Product: WebKit Reporter: Brent Fulgham <bfulgham>
Component: WebKit2Assignee: Brent Fulgham <bfulgham>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, commit-queue, pvollan, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Brent Fulgham 2020-02-05 10:12:46 PST 
Testing and telemetry indicates that we need access to the DNSSD mach service in our Network Process.
Comment 1 Brent Fulgham 2020-02-05 10:15:49 PST 
<rdar://problem/59158405>
Comment 2 Brent Fulgham 2020-02-05 10:16:44 PST 
Created attachment 389827 [details]
Patch
Comment 3 Per Arne Vollan 2020-02-05 11:17:52 PST 
Comment on attachment 389827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389827&action=review

> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:95
> +            (allow network-outbound (literal "/private/var/run/mDNSResponder"))
> +            (allow mach-lookup (global-name "com.apple.dnssd.service"))) ;; <rdar://problem/55562091>
> +        (begin
> +            (allow network-outbound (literal "/private/var/run/mDNSResponder"))
> +            (allow mach-lookup (global-name "com.apple.dnssd.service")))) ;; <rdar://problem/55562091>

Should this be outside 'if gizmo?'?
Comment 4 Brent Fulgham 2020-02-05 12:14:36 PST 
Comment on attachment 389827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389827&action=review

>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:95
>> +            (allow mach-lookup (global-name "com.apple.dnssd.service")))) ;; <rdar://problem/55562091>
> 
> Should this be outside 'if gizmo?'?

It is in the 'else' of the 'if gizmo?' clause, so it's correct.
Comment 5 Per Arne Vollan 2020-02-05 12:59:01 PST 
Comment on attachment 389827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389827&action=review

R=me.

>>> Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:95
>>> +            (allow mach-lookup (global-name "com.apple.dnssd.service")))) ;; <rdar://problem/55562091>
>> 
>> Should this be outside 'if gizmo?'?
> 
> It is in the 'else' of the 'if gizmo?' clause, so it's correct.

Ah, I see!
Comment 6 WebKit Commit Bot 2020-02-05 13:42:33 PST 
Comment on attachment 389827 [details]
Patch

Clearing flags on attachment: 389827

Committed r255852: <https://trac.webkit.org/changeset/255852>
Comment 7 WebKit Commit Bot 2020-02-05 13:42:35 PST 
All reviewed patches have been landed.  Closing bug.