[iOS WK2] Add extension read permission to network sandbox profile

[WebKit-https.git] / Source / WebKit2 / Resources / SandboxProfiles / ios / com.apple.WebKit.Networking.sb

diff --git a/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb b/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
index 879c520..dc8d963 100644 (file)
--- a/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
+++ b/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb
@@ -22,7 +22,37 @@
 ; THE POSSIBILITY OF SUCH DAMAGE.
 
 (version 1)
-(allow default)
+(deny default (with partial-symbolication))
+(allow system-audit file-read-metadata)
 
 (import "common.sb")
 (import "removed-dev-nodes.sb")
+
+;; Access to client's cache folder & re-vending to CFNetwork.
+;; FIXME: Remove the webkti specific extension classes <rdar://problem/17755931>
+(allow file-issue-extension (require-all
+    (extension "com.apple.app-sandbox.read-write")
+    (extension-class "com.apple.nsurlstorage.extension-cache")))
+
+;; App sandbox extensions
+(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
+(allow file-read* (extension "com.apple.app-sandbox.read"))
+
+;; IOKit user clients
+(allow iokit-open
+       (iokit-user-client-class "RootDomainUserClient"))
+
+;; Various services required by CFNetwork and other frameworks
+(allow mach-lookup
+       (global-name "com.apple.PowerManagement.control"))
+
+(network-client (remote tcp))
+
+;; Security framework
+(allow mach-lookup
+    (global-name "com.apple.ocspd")
+    (global-name "com.apple.securityd")
+    (global-name "com.apple.accountsd.accountmanager"))
+
+(deny file-write-create
+       (vnode-type SYMLINK))