Relax keychain access to permit users to permanently allow client certificates
authorbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Sep 2017 23:36:59 +0000 (23:36 +0000)
committerbfulgham@apple.com <bfulgham@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Sep 2017 23:36:59 +0000 (23:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=175857
<rdar://problem/32293867>

Reviewed by Alex Christensen.

Further relax the write permissions on the user's Keychain directory to support local certificates.

* NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221647 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit/ChangeLog
Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in
Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

index 6413290..bf72d5a 100644 (file)
@@ -1,3 +1,16 @@
+2017-09-05  Brent Fulgham  <bfulgham@apple.com>
+
+        Relax keychain access to permit users to permanently allow client certificates
+        https://bugs.webkit.org/show_bug.cgi?id=175857
+        <rdar://problem/32293867>
+
+        Reviewed by Alex Christensen.
+
+        Further relax the write permissions on the user's Keychain directory to support local certificates.
+
+        * NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2017-09-05  Youenn Fablet  <youenn@apple.com>
 
         Cache Storage Engine should not mix different origin caches
index c99d634..b8e9442 100644 (file)
 
 ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
 ;; Restrict AppSandboxed processes from creating /Library/Keychains, but allow access to the contents of /Library/Keychains:
-(allow file-read-data file-read-metadata file-write-create file-write-data
+(allow file-read-data file-read-metadata file-write*
     (subpath "/Library/Keychains")
     (home-subpath "/Library/Keychains"))
 
index 0ad2708..a51a743 100644 (file)
 
 ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
 ;; Restrict AppSandboxed processes from creating /Library/Keychains, but allow access to the contents of /Library/Keychains:
-(allow file-read-data file-read-metadata file-write-create file-write-data
+(allow file-read-data file-read-metadata file-write*
     (subpath "/Library/Keychains"))
 
 ;; Do permit creating per-user keychains