<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[209280] trunk/Source/WebKit2</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/209280">209280</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2016-12-02 15:21:22 -0800 (Fri, 02 Dec 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[Mac] Update sandbox profiles to use modern syntax and avoid duplication
https://bugs.webkit.org/show_bug.cgi?id=165332
<rdar://problem/26898991>
Reviewed by Anders Carlsson.
Update the Mac sandbox profiles to reflect that modern Cocoa applications
communicate with cfprefsd, rather than plists on disk (and have done so
for the past several releases).
Get rid of some duplicated rules, as well as old compatibility rules that
are never triggered under supported operating systems.
* DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in:
* NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
* WebProcess/com.apple.WebProcess.sb.in:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2DatabaseProcessmaccomappleWebKitDatabasessbin">trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in</a></li>
<li><a href="#trunkSourceWebKit2NetworkProcessmaccomappleWebKitNetworkProcesssbin">trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in</a></li>
<li><a href="#trunkSourceWebKit2PluginProcessmaccomappleWebKitplugincommonsbin">trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in</a></li>
<li><a href="#trunkSourceWebKit2WebProcesscomappleWebProcesssbin">trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (209279 => 209280)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog 2016-12-02 23:07:41 UTC (rev 209279)
+++ trunk/Source/WebKit2/ChangeLog 2016-12-02 23:21:22 UTC (rev 209280)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2016-12-02 Brent Fulgham <bfulgham@apple.com>
+
+ [Mac] Update sandbox profiles to use modern syntax and avoid duplication
+ https://bugs.webkit.org/show_bug.cgi?id=165332
+ <rdar://problem/26898991>
+
+ Reviewed by Anders Carlsson.
+
+ Update the Mac sandbox profiles to reflect that modern Cocoa applications
+ communicate with cfprefsd, rather than plists on disk (and have done so
+ for the past several releases).
+
+ Get rid of some duplicated rules, as well as old compatibility rules that
+ are never triggered under supported operating systems.
+
+ * DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in:
+ * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+ * PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:
+ * WebProcess/com.apple.WebProcess.sb.in:
+
</ins><span class="cx"> 2016-12-02 Gustavo Sverzut Barbieri <barbieri@profusion.mobi>
</span><span class="cx">
</span><span class="cx"> Fix build break when disabling some features.
</span></span></pre></div>
<a id="trunkSourceWebKit2DatabaseProcessmaccomappleWebKitDatabasessbin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in (209279 => 209280)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in 2016-12-02 23:07:41 UTC (rev 209279)
+++ trunk/Source/WebKit2/DatabaseProcess/mac/com.apple.WebKit.Databases.sb.in 2016-12-02 23:21:22 UTC (rev 209280)
</span><span class="lines">@@ -37,12 +37,21 @@
</span><span class="cx"> (define (home-literal home-relative-literal)
</span><span class="cx"> (literal (string-append (param "HOME_DIR") home-relative-literal)))
</span><span class="cx">
</span><ins>+;; IOKit user clients
+(allow iokit-open
+ (iokit-user-client-class "RootDomainUserClient"))
+
</ins><span class="cx"> ;; Security framework
</span><span class="cx"> (allow mach-lookup
</span><span class="cx"> (global-name "com.apple.SecurityServer"))
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "com.apple.security"
+ "com.apple.security.revocation"))
</ins><span class="cx"> (allow file-read*
</span><span class="cx"> (subpath "/private/var/db/mds")
</span><span class="cx"> (literal "/private/var/db/DetachedSignatures")
</span><ins>+ ; The following are needed until <rdar://problem/11134688> is resolved.
</ins><span class="cx"> (literal "/Library/Preferences/com.apple.security.plist")
</span><span class="cx"> (literal "/Library/Preferences/com.apple.security.revocation.plist")
</span><span class="cx"> (home-literal "/Library/Preferences/com.apple.security.plist")
</span><span class="lines">@@ -55,16 +64,14 @@
</span><span class="cx"> (allow file* (subpath (param "DARWIN_USER_TEMP_DIR"))))
</span><span class="cx">
</span><span class="cx"> ;; Read-only preferences and data
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "kCFPreferencesAnyApplication"))
</ins><span class="cx"> (allow file-read*
</span><span class="cx"> ;; Basic system paths
</span><span class="cx"> (subpath "/Library/Frameworks")
</span><span class="cx"> (subpath "/Library/Managed Preferences")
</span><span class="cx">
</span><del>- ;; System and user preferences
- (literal "/Library/Preferences/.GlobalPreferences.plist")
- (home-literal "/Library/Preferences/.GlobalPreferences.plist")
- (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
-
</del><span class="cx"> ;; On-disk WebKit2 framework location, to account for debug installations
</span><span class="cx"> ;; outside of /System/Library/Frameworks
</span><span class="cx"> (subpath (param "WEBKIT2_FRAMEWORK_DIR")))
</span></span></pre></div>
<a id="trunkSourceWebKit2NetworkProcessmaccomappleWebKitNetworkProcesssbin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in (209279 => 209280)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2016-12-02 23:07:41 UTC (rev 209279)
+++ trunk/Source/WebKit2/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in 2016-12-02 23:21:22 UTC (rev 209280)
</span><span class="lines">@@ -38,6 +38,12 @@
</span><span class="cx"> (literal (string-append (param "HOME_DIR") home-relative-literal)))
</span><span class="cx">
</span><span class="cx"> ;; Read-only preferences and data
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "kCFPreferencesAnyApplication"
+ "com.apple.DownloadAssessment"
+ "com.apple.WebFoundation"
+ "com.apple.networkConnect"))
</ins><span class="cx"> (allow file-read*
</span><span class="cx"> ;; Basic system paths
</span><span class="cx"> (subpath "/Library/Frameworks")
</span><span class="lines">@@ -46,13 +52,7 @@
</span><span class="cx"> (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
</span><span class="cx">
</span><span class="cx"> ;; System and user preferences
</span><del>- (literal "/Library/Preferences/.GlobalPreferences.plist")
</del><span class="cx"> (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$")
</span><del>- (home-literal "/Library/Preferences/.GlobalPreferences.plist")
- (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
- (home-regex #"/Library/Preferences/ByHost/com\.apple\.networkConnect\.")
- (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
- (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
</del><span class="cx">
</span><span class="cx"> ;; On-disk WebKit2 framework location, to account for debug installations
</span><span class="cx"> ;; outside of /System/Library/Frameworks
</span><span class="lines">@@ -115,6 +115,13 @@
</span><span class="cx">
</span><span class="cx"> (allow file-read* file-write* (subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when <rdar://problem/9538414> is fixed.
</span><span class="cx">
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "com.apple.crypto"
+ "com.apple.security"
+ "com.apple.security.common"
+ "com.apple.security.revocation"))
+
</ins><span class="cx"> (allow file-read*
</span><span class="cx"> #if __MAC_OS_X_VERSION_MIN_REQUIRED < 101240
</span><span class="cx"> (subpath "/Library/Keychains")
</span><span class="lines">@@ -121,7 +128,8 @@
</span><span class="cx"> #endif
</span><span class="cx"> (subpath "/private/var/db/mds")
</span><span class="cx"> (literal "/private/var/db/DetachedSignatures")
</span><del>- (literal "/Library/Preferences/com.apple.crypto.plist")
</del><ins>+
+ ; The following are needed until <rdar://problem/11134688> is resolved.
</ins><span class="cx"> (literal "/Library/Preferences/com.apple.security.plist")
</span><span class="cx"> (literal "/Library/Preferences/com.apple.security.common.plist")
</span><span class="cx"> (literal "/Library/Preferences/com.apple.security.revocation.plist")
</span><span class="lines">@@ -146,13 +154,12 @@
</span><span class="cx"> (global-name "com.apple.system.notification_center"))
</span><span class="cx"> (allow network-outbound
</span><span class="cx"> (remote udp))
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "com.apple.GSS"
+ "com.apple.Kerberos"
+ "edu.mit.Kerberos"))
</ins><span class="cx"> (allow file-read*
</span><del>- (home-subpath "/Library/Preferences/com.apple.Kerberos.plist")
- (home-subpath "/Library/Preferences/com.apple.GSS.plist")
- (home-subpath "/Library/Preferences/edu.mit.Kerberos")
- (literal "/Library/Preferences/com.apple.Kerberos.plist")
- (literal "/Library/Preferences/com.apple.GSS.plist")
- (literal "/Library/Preferences/edu.mit.Kerberos")
</del><span class="cx"> (literal "/private/etc/krb5.conf")
</span><span class="cx"> (literal "/private/etc/services")
</span><span class="cx"> (literal "/private/etc/host")
</span></span></pre></div>
<a id="trunkSourceWebKit2PluginProcessmaccomappleWebKitplugincommonsbin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in (209279 => 209280)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in 2016-12-02 23:07:41 UTC (rev 209279)
+++ trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in 2016-12-02 23:21:22 UTC (rev 209280)
</span><span class="lines">@@ -78,33 +78,16 @@
</span><span class="cx"> (if (not (defined? 'os-version))
</span><span class="cx"> (define os-version (param "_OS_VERSION")))
</span><span class="cx">
</span><del>-;; Graphics
-(if (defined? 'system-graphics)
- (system-graphics)
- (begin
- (shared-preferences-read
- "com.apple.opengl"
- "com.nvidia.OpenGL")
- (allow mach-lookup (global-name "com.apple.cvmsServ"))
- (allow iokit-open
- (iokit-connection "IOAccelerator")
- (iokit-user-client-class "IOAccelerationUserClient")
- (iokit-user-client-class "IOSurfaceRootUserClient")
- (iokit-user-client-class "IOSurfaceSendRight")
- (iokit-user-client-class "IOFramebufferSharedUserClient")
- (iokit-user-client-class "AppleSNBFBUserClient")
- (iokit-user-client-class "AGPMClient")
- (iokit-user-client-class "AppleGraphicsControlClient")
- (iokit-user-client-class "AppleGraphicsPolicyClient"))))
</del><ins>+(system-graphics)
</ins><span class="cx">
</span><span class="cx"> ;; Read-only preferences
</span><span class="cx"> (shared-preferences-read
</span><span class="cx"> ".GlobalPreferences"
</span><ins>+ "com.apple.ATS"
</ins><span class="cx"> "com.apple.Bluetooth"
</span><span class="cx"> "com.apple.CoreGraphics"
</span><ins>+ "com.apple.HIToolbox"
</ins><span class="cx"> "com.apple.QuickTime"
</span><del>- "com.apple.HIToolbox"
- "com.apple.ATS"
</del><span class="cx"> "com.apple.driver.AppleBluetoothMultitouch.mouse"
</span><span class="cx"> "com.apple.driver.AppleBluetoothMultitouch.trackpad"
</span><span class="cx"> "com.apple.driver.AppleHIDMouse"
</span><span class="lines">@@ -250,21 +233,7 @@
</span><span class="cx"> (if (defined? 'mach-register)
</span><span class="cx"> (allow mach-register (global-name-regex #"^_oglprof_attach_<[0-9]+>$")))
</span><span class="cx">
</span><del>-;; Networking
-(if (defined? 'system-network)
- (system-network)
- (begin
- (allow file-read* (literal "/Library/Preferences/com.apple.networkd.plist"))
- (allow mach-lookup
- (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
- (global-name "com.apple.networkd"))
- (allow network-outbound
- (control-name "com.apple.netsrc")
- (control-name "com.apple.network.statistics"))
- (allow system-socket
- (require-all (socket-domain AF_SYSTEM)
- (socket-protocol 2)) ; SYSPROTO_CONTROL
- (socket-domain AF_ROUTE))))
</del><ins>+(system-network)
</ins><span class="cx">
</span><span class="cx"> (allow network-outbound
</span><span class="cx"> ;; Local mDNSResponder for DNS, arbitrary outbound TCP and UDP
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcesscomappleWebProcesssbin"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in (209279 => 209280)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in 2016-12-02 23:07:41 UTC (rev 209279)
+++ trunk/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in 2016-12-02 23:21:22 UTC (rev 209280)
</span><span class="lines">@@ -56,26 +56,6 @@
</span><span class="cx"> (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
</span><span class="cx">
</span><span class="cx"> ;; System and user preferences
</span><del>- (literal "/Library/Preferences/.GlobalPreferences.plist")
- (home-literal "/Library/Preferences/.GlobalPreferences.plist")
- (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
- (home-regex #"/Library/Preferences/ByHost/com\.apple\.HIToolbox\.")
- (home-regex #"/Library/Preferences/ByHost/com\.apple\.networkConnect\.")
- (home-literal "/Library/Preferences/com.apple.ATS.plist")
- (home-literal "/Library/Preferences/com.apple.CoreGraphics.plist")
- (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
- (home-literal "/Library/Preferences/com.apple.HIToolbox.plist")
- (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
- (home-literal "/Library/Preferences/com.apple.MultitouchSupport.plist") ;; FIXME: Remove when <rdar://problem/13011633> is fixed.
- (home-literal "/Library/Preferences/com.apple.QTKit.plist")
- (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
- (home-literal "/Library/Preferences/com.apple.avfoundation.plist")
- (home-literal "/Library/Preferences/com.apple.coremedia.plist")
- (home-literal "/Library/Preferences/com.apple.speech.voice.prefs.plist")
- (home-literal "/Library/Preferences/com.apple.systemsound.plist")
- (home-literal "/Library/Preferences/com.apple.universalaccess.plist")
- (home-literal "/Library/Preferences/com.apple.lookup.shared.plist")
- (home-regex #"/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$")
</del><span class="cx"> (home-literal "/.CFUserTextEncoding")
</span><span class="cx">
</span><span class="cx"> ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
</span><span class="lines">@@ -92,6 +72,38 @@
</span><span class="cx">
</span><span class="cx"> (home-subpath "/Library/Dictionaries"))
</span><span class="cx">
</span><ins>+;; Preferences support
+(allow user-preference-read
+ (preference-domain
+ "kCFPreferencesAnyApplication"
+ "com.apple.ATS"
+ "com.apple.CoreGraphics"
+ "com.apple.DownloadAssessment"
+ "com.apple.HIToolbox"
+ "com.apple.LaunchServices"
+ "com.apple.MultitouchSupport" ;; FIXME: Remove when <rdar://problem/13011633> is fixed.
+ "com.apple.QTKit"
+ "com.apple.ServicesMenu.Services" ;; Needed for NSAttributedString <rdar://problem/10844321>
+ "com.apple.WebFoundation"
+ "com.apple.avfoundation"
+ "com.apple.coremedia"
+ "com.apple.crypto"
+ "com.apple.driver.AppleBluetoothMultitouch.mouse"
+ "com.apple.driver.AppleBluetoothMultitouch.trackpad"
+ "com.apple.driver.AppleHIDMouse"
+ "com.apple.lookup.shared"
+ "com.apple.mediaaccessibility"
+ "com.apple.networkConnect"
+ "com.apple.security"
+ "com.apple.security.common"
+ "com.apple.security.revocation"
+ "com.apple.speech.voice.prefs"
+ "com.apple.systemsound"
+ "com.apple.universalaccess"
+ "edu.mit.Kerberos"
+ "pbs" ;; Needed for NSAttributedString <rdar://problem/10844321>
+))
+
</ins><span class="cx"> ;; On-disk WebKit2 framework location, to account for debug installations outside of /System/Library/Frameworks,
</span><span class="cx"> ;; and to allow issuing extensions.
</span><span class="cx"> (allow-read-directory-and-issue-read-extensions (param "WEBKIT2_FRAMEWORK_DIR"))
</span><span class="lines">@@ -121,8 +133,8 @@
</span><span class="cx"> (allow mach-register (global-name-regex #"^_oglprof_attach_<[0-9]+>$")))
</span><span class="cx">
</span><span class="cx"> ;; MediaAccessibility
</span><del>-(allow file-read* (home-literal "/Library/Preferences/com.apple.mediaaccessibility.plist"))
-(allow file-read* file-write* (home-literal "/Library/Preferences/com.apple.mediaaccessibility.public.plist"))
</del><ins>+(allow user-preference-read user-preference-write
+ (preference-domain "com.apple.mediaaccessibility.public"))
</ins><span class="cx">
</span><span class="cx"> (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))
</span><span class="cx"> (allow file* (subpath (param "DARWIN_USER_CACHE_DIR"))))
</span><span class="lines">@@ -170,6 +182,7 @@
</span><span class="cx"> #if __MAC_OS_X_VERSION_MIN_REQUIRED < 101200
</span><span class="cx"> (global-name "com.apple.FontServer")
</span><span class="cx"> #endif
</span><ins>+ (global-name "com.apple.PowerManagement.control")
</ins><span class="cx"> (global-name "com.apple.SystemConfiguration.configd")
</span><span class="cx"> (global-name "com.apple.SystemConfiguration.PPPController")
</span><span class="cx"> (global-name "com.apple.audio.SystemSoundServer-OSX")
</span><span class="lines">@@ -177,32 +190,31 @@
</span><span class="cx"> (global-name "com.apple.audio.audiohald")
</span><span class="cx"> (global-name "com.apple.audio.coreaudiod")
</span><span class="cx"> (global-name "com.apple.awdd")
</span><ins>+ (global-name "com.apple.cfnetwork.AuthBrokerAgent")
</ins><span class="cx"> (global-name "com.apple.cookied")
</span><ins>+ (global-name "com.apple.coreservices.launchservicesd")
</ins><span class="cx"> (global-name "com.apple.dock.server")
</span><span class="cx"> (global-name "com.apple.fonts")
</span><ins>+ (global-name "com.apple.iconservices")
+ (global-name "com.apple.iconservices.store")
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200
+ (global-name "com.apple.mediaremoted.xpc")
+#endif
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101100
+ (global-name "com.apple.nesessionmanager.flow-divert-token")
+#endif
+ (global-name "com.apple.speech.speechsynthesisd")
+ (global-name "com.apple.speech.synthesis.console")
</ins><span class="cx"> (global-name "com.apple.system.opendirectoryd.api")
</span><span class="cx"> (global-name "com.apple.tccd")
</span><span class="cx"> (global-name "com.apple.tccd.system")
</span><span class="cx"> (global-name "com.apple.window_proxies")
</span><span class="cx"> (global-name "com.apple.windowserver.active")
</span><del>- (global-name "com.apple.cfnetwork.AuthBrokerAgent")
- (global-name "com.apple.PowerManagement.control")
- (global-name "com.apple.speech.speechsynthesisd")
- (global-name "com.apple.speech.synthesis.console")
- (global-name "com.apple.coreservices.launchservicesd")
- (global-name "com.apple.iconservices")
- (global-name "com.apple.iconservices.store")
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101100
- (global-name "com.apple.nesessionmanager.flow-divert-token")
-#endif
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200
- (global-name "com.apple.mediaremoted.xpc")
-#endif
</del><span class="cx"> )
</span><span class="cx">
</span><span class="cx"> ;; Security framework
</span><span class="cx"> (allow mach-lookup
</span><del>- (global-name "com.apple.ctkd.token-client")
</del><ins>+ (global-name "com.apple.ctkd.token-client")
</ins><span class="cx"> (global-name "com.apple.ocspd")
</span><span class="cx"> (global-name "com.apple.securityd.xpc")
</span><span class="cx"> (global-name "com.apple.CoreAuthentication.agent.libxpc")
</span><span class="lines">@@ -220,7 +232,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> (subpath "/private/var/db/mds")
</span><span class="cx"> (literal "/private/var/db/DetachedSignatures")
</span><del>- (literal "/Library/Preferences/com.apple.crypto.plist")
</del><ins>+ ; The following are needed until <rdar://problem/11134688> is resolved.
</ins><span class="cx"> (literal "/Library/Preferences/com.apple.security.plist")
</span><span class="cx"> (literal "/Library/Preferences/com.apple.security.common.plist")
</span><span class="cx"> (literal "/Library/Preferences/com.apple.security.revocation.plist")
</span><span class="lines">@@ -251,10 +263,6 @@
</span><span class="cx"> (literal "/private/var/run/mDNSResponder")
</span><span class="cx"> (remote tcp))
</span><span class="cx">
</span><del>-;; Needed for NSAttributedString, <rdar://problem/10844321>.
-(allow file-read*
- (home-literal "/Library/Preferences/pbs.plist")
- (home-literal "/Library/Preferences/com.apple.ServicesMenu.Services.plist"))
</del><span class="cx"> (allow mach-lookup
</span><span class="cx"> (global-name "com.apple.pbs.fetch_services"))
</span><span class="cx">
</span><span class="lines">@@ -266,13 +274,12 @@
</span><span class="cx"> (global-name "com.apple.system.notification_center"))
</span><span class="cx"> (allow network-outbound
</span><span class="cx"> (remote udp))
</span><ins>+(allow user-preference-read
+ (preference-domain
+ "com.apple.Kerberos"
+ "com.apple.GSS"))
+
</ins><span class="cx"> (allow file-read*
</span><del>- (home-subpath "/Library/Preferences/com.apple.Kerberos.plist")
- (home-subpath "/Library/Preferences/com.apple.GSS.plist")
- (home-subpath "/Library/Preferences/edu.mit.Kerberos")
- (literal "/Library/Preferences/com.apple.Kerberos.plist")
- (literal "/Library/Preferences/com.apple.GSS.plist")
- (literal "/Library/Preferences/edu.mit.Kerberos")
</del><span class="cx"> (literal "/private/etc/krb5.conf")
</span><span class="cx"> (literal "/private/etc/services")
</span><span class="cx"> (literal "/private/etc/host")
</span><span class="lines">@@ -293,9 +300,10 @@
</span><span class="cx"> ;; Deny access needed for unnecessary NSApplication initialization.
</span><span class="cx"> ;; FIXME: This can be removed once <rdar://problem/13011633> is fixed.
</span><span class="cx"> (deny file-read* (with no-log)
</span><del>- (home-literal "/Library/Preferences/com.apple.speech.recognition.AppleSpeechRecognition.prefs.plist")
</del><span class="cx"> (subpath "/Library/InputManagers")
</span><span class="cx"> (home-subpath "/Library/InputManagers"))
</span><ins>+(deny user-preference-read (with no-log)
+ (preference-domain "com.apple.speech.recognition.AppleSpeechRecognition.prefs"))
</ins><span class="cx"> (deny mach-lookup (with no-log)
</span><span class="cx"> (global-name "com.apple.coreservices.appleevents")
</span><span class="cx"> (global-name "com.apple.pasteboard.1")
</span></span></pre>
</div>
</div>
</body>
</html>