8000 Only enable Lockdown mode telemetry for recent macOS versions. · WebKit/WebKit@3559f6b · GitHub
[go: up one dir, main page]
Skip to content

Commit 3559f6b

Browse files
pvollanpvollan
committed
Only enable Lockdown mode telemetry for recent macOS versions.
https://bugs.webkit.org/show_bug.cgi?id=250436 rdar://104058459 Reviewed by Eric Carlson. Only enable Lockdown mode telemetry for recent macOS versions. * Source/WTF/wtf/PlatformEnableCocoa.h: * Source/WebKit/WebProcess/com.apple.WebProcess.sb.in: Canonical link: https://commits.webkit.org/258769@main
1 parent fefa4f6 commit 3559f6b

File tree

2 files changed

+23
-5
lines changed

2 files changed

+23
-5
lines changed

‎Source/WTF/wtf/PlatformEnableCocoa.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -856,3 +856,7 @@
856856
#if !defined(ENABLE_MOBILE_GESTALT_DEVICE_NAME) && PLATFORM(IOS)
857857
#define ENABLE_MOBILE_GESTALT_DEVICE_NAME 1
858858
#endif
859+
860+
#if !defined(ENABLE_LOCKDOWN_MODE_TELEMETRY) && PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED > 120000
861+
#define ENABLE_LOCKDOWN_MODE_TELEMETRY 1
862+
#endif

‎Source/WebKit/WebProcess/com.apple.WebProcess.sb.in‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2005,13 +2005,18 @@
20052005

20062006
(allow syscall-unix (syscall-unix-common))
20072007

2008+
#if ENABLE(LOCKDOWN_MODE_TELEMETRY)
20082009
(with-filter (require-entitlement "com.apple.security.cs.allow-jit")
20092010
(allow syscall-unix (syscall-unix-blocked-in-lockdown-mode))
2010-
20112011
(when (equal? (param "CPU") "arm64")
20122012
(allow syscall-unix (syscall-unix-apple-silicon)))
2013-
20142013
(allow syscall-unix (syscalls-rarely-used)))
2014+
#else
2015+
(allow syscall-unix (syscall-unix-blocked-in-lockdown-mode))
2016+
(when (equal? (param "CPU") "arm64")
2017+
(allow syscall-unix (syscall-unix-apple-silicon)))
2018+
(allow syscall-unix (syscalls-rarely-used))
2019+
#endif
20152020

20162021
(when (defined? 'SYS_objc_bp_assist_cfg_np)
20172022
(allow syscall-unix (syscall-number SYS_objc_bp_assist_cfg_np)))
@@ -2026,11 +2031,13 @@
20262031
(allow syscall-unix (syscall-number SYS_quotactl)))
20272032
#endif
20282033

2034+
#if ENABLE(LOCKDOWN_MODE_TELEMETRY)
20292035
(with-filter (require-not (require-entitlement "com.apple.security.cs.allow-jit"))
20302036
(allow syscall-unix (with report) (with telemetry) (syscall-unix-blocked-in-lockdown-mode))
20312037
(allow syscall-unix (with report) (with telemetry) (syscalls-rarely-used))
20322038
(when (equal? (param "CPU") "arm64")
20332039
(allow syscall-unix (with report) (with telemetry) (syscall-unix-apple-silicon))))
2040+
#endif
20342041

20352042
#if HAVE(ADDITIONAL_APPLE_CAMERA_SERVICE)
20362043
(if (equal? (param "CPU") "arm64")
@@ -2149,11 +2156,15 @@
21492156
(allow mach-kernel-endpoint
21502157
(apply-message-filter
21512158
(deny mach-message-send)
2152-
(allow mach-message-send (kernel-mig-routines-common))
2159+
#if ENABLE(LOCKDOWN_MODE_TELEMETRY)
21532160
(with-filter (require-entitlement "com.apple.security.cs.allow-jit")
21542161
(allow mach-message-send (kernel-mig-routines-blocked-in-lockdown-mode)))
21552162
(with-filter (require-not (require-entitlement "com.apple.security.cs.allow-jit"))
2156-
(allow mach-message-send (with report) (with telemetry) (kernel-mig-routines-blocked-in-lockdown-mode))))))
2163+
(allow mach-message-send (with report) (with telemetry) (kernel-mig-routines-blocked-in-lockdown-mode)))
2164+
#else
2165+
(allow mach-message-send (kernel-mig-routines-blocked-in-lockdown-mode))
2166+
#endif
2167+
(allow mach-message-send (kernel-mig-routines-common)))))
21572168

21582169
(define (syscall-mach-common) (machtrap-number
21592170
MSC__kernelrpc_mach_port_allocate_trap
@@ -2202,11 +2213,14 @@
22022213
(when (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (defined? 'syscall-mach))
22032214
(deny syscall-mach)
22042215
(allow syscall-mach (syscall-mach-common))
2216+
#if ENABLE(LOCKDOWN_MODE_TELEMETRY)
22052217
(with-filter (require-entitlement "com.apple.security.cs.allow-jit")
22062218
(allow syscall-mach (syscall-mach-blocked-in-lockdown-mode)))
22072219
(with-filter (require-not (require-entitlement "com.apple.security.cs.allow-jit"))
22082220
(allow syscall-mach (with report) (with telemetry) (syscall-mach-blocked-in-lockdown-mode)))
2209-
2221+
#else
2222+
(allow syscall-mach (syscall-mach-blocked-in-lockdown-mode))
2223+
#endif
22102224
(when (defined? 'MSC_mach_msg2_trap)
22112225
(allow syscall-mach (machtrap-number MSC_mach_msg2_trap))))
22122226
#endif // HAVE(SANDBOX_MESSAGE_FILTERING)

0 commit comments

Comments
 (0)
0