[iOS WK2] Add extension read permission to network sandbox profile

[WebKit-https.git] / Source / WebKit2 / Resources / SandboxProfiles / ios / com.apple.WebKit.Networking.sb

diff --git a/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb b/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
index 83144cb..dc8d963 100644 (file)
--- a/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
+++ b/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
@@ -28,27 +28,15 @@
 (import "common.sb")
 (import "removed-dev-nodes.sb")
 
-;; Access CFNetwork shared cookies
-;; This is too generous -- <rdar://problem/17496756>
-(apple-cookie-access 'with-read-write)
-
-;; Sandbox extensions
-(allow file-read* (container-subpath "Library/")
-       (extension "com.apple.webkit.read"))
-
 ;; Access to client's cache folder & re-vending to CFNetwork.
-(allow file-read* file-write* (require-all (container-subpath "Library/")
-       (extension "com.apple.nsurlstorage.extension-cache")))
-(allow file-issue-extension  (require-all ((container-subpath "Library/")
-       (extension-class "com.apple.nsurlstorage.extension-cache")))
+;; FIXME: Remove the webkti specific extension classes <rdar://problem/17755931>
+(allow file-issue-extension (require-all
+    (extension "com.apple.app-sandbox.read-write")
+    (extension-class "com.apple.nsurlstorage.extension-cache")))
 
 ;; App sandbox extensions
-(allow file-read* file-write* (require-all (container-subpath "Library/")
-       (extension "com.apple.app-sandbox.read-write")))
-
-;; Access to own cache & temp folders.
-(allow file-read* file-write* (require-all (container-subpath "")
-       (extension "com.apple.webkit.read-write")))
+(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
+(allow file-read* (extension "com.apple.app-sandbox.read"))
 
 ;; IOKit user clients
 (allow iokit-open
@@ -58,12 +46,13 @@
 (allow mach-lookup
        (global-name "com.apple.PowerManagement.control"))
 
-(network-client)
+(network-client (remote tcp))
 
 ;; Security framework
 (allow mach-lookup
-       (global-name "com.apple.ocspd")
-       (global-name "com.apple.securityd"))
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.securityd")
+    (global-name "com.apple.accountsd.accountmanager"))
 
 (deny file-write-create
        (vnode-type SYMLINK))