← Back to branch summary

~ubuntu-branches/ubuntu/raring/qtwebkit-source/raring-proposed

« back to all changes in this revision

Viewing changes to Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in

  • Committer: Package Import Robot
  • Author(s): Jonathan Riddell
  • Date: 2013-02-18 14:24:18 UTC
  • Revision ID: package-import@ubuntu.com-20130218142418-eon0jmjg3nj438uy
Tags: upstream-2.3
Import upstream version 2.3

Show diffs side-by-side

added added

removed removed

Lines of Context:
Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in
 
1
(version 1)
 
2
(deny default (with partial-symbolication))
 
3
(allow ipc-posix-shm system-audit system-socket file-read-metadata)
 
4
 
 
5
(import "system.sb")
 
6
 
 
7
;; Utility functions for home directory relative path filters
 
8
(define (home-regex home-relative-regex)
 
9
  (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
 
10
 
 
11
(define (home-subpath home-relative-subpath)
 
12
  (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
 
13
 
 
14
(define (home-literal home-relative-literal)
 
15
  (literal (string-append (param "HOME_DIR") home-relative-literal)))
 
16
 
 
17
;; Read-only preferences and data
 
18
(allow file-read*
 
19
       ;; Basic system paths
 
20
       (subpath "/Library/Frameworks")
 
21
       (subpath "/private/var/db/mds")
 
22
 
 
23
       ;; System and user preferences
 
24
       (literal "/Library/Preferences/.GlobalPreferences.plist")
 
25
       (literal "/Library/Preferences/com.apple.Bluetooth.plist")
 
26
       (literal "/Library/Preferences/com.apple.QuickTime.plist")
 
27
       (regex #"^/Library/Preferences/com\.apple\.security")
 
28
       (home-literal "/.CFUserTextEncoding")
 
29
       (home-subpath "/Library/Audio")
 
30
       (home-subpath "/Library/ColorPickers")
 
31
       (home-subpath "/Library/ColorSync")
 
32
       (home-subpath "/Library/Components")
 
33
       (home-subpath "/Library/Input Methods")
 
34
       (home-subpath "/Library/KeyBindings")
 
35
       (home-subpath "/Library/Keyboard Layouts")
 
36
       (home-subpath "/Library/Fonts")
 
37
       (home-subpath "/Library/PDF Services")
 
38
       (home-literal "/Library/Preferences/.GlobalPreferences.plist")
 
39
       (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
 
40
       (home-regex #"/Library/Preferences/ByHost/com\.apple\.Bluetooth\.")
 
41
       (home-literal "/Library/Preferences/com.apple.ATS.plist")
 
42
       (home-literal "/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.mouse.plist")
 
43
       (home-literal "/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.trackpad.plist")
 
44
       (home-literal "/Library/Preferences/com.apple.driver.AppleHIDMouse.plist")
 
45
       (home-literal "/Library/Preferences/com.apple.inputmethodkit.plist")
 
46
       (home-literal "/Library/Preferences/com.apple.iWork.Pages.plist")
 
47
       (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
 
48
       (home-literal "/Library/Preferences/com.apple.MultitouchSupport.plist")
 
49
       (home-literal "/Library/Preferences/com.apple.opengl.plist")
 
50
       (home-literal "/Library/Preferences/com.apple.security.plist")
 
51
       (home-literal "/Library/Preferences/com.apple.security_common.plist")
 
52
       (home-literal "/Library/Preferences/com.apple.speech.voice.prefs.plist")
 
53
       (home-literal "/Library/Preferences/com.apple.speech.synthesis.general.prefs.plist")
 
54
       (home-literal "/Library/Preferences/com.apple.systemsound.plist")
 
55
       (home-literal "/Library/Preferences/com.apple.universalaccess.plist")
 
56
       (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
 
57
       (home-literal "/Library/Preferences/com.nvidia.OpenGL.plist")
 
58
       (home-literal "/Library/Preferences/pbs.plist")
 
59
       (home-literal "/Library/Preferences/com.apple.ServicesMenu.Services.plist")
 
60
       (home-literal "/Library/Preferences/QuickTime Preferences")
 
61
 
 
62
       (home-literal "/Library/Caches/com.apple.coreaudio.components.plist")
 
63
 
 
64
       (subpath "/Library/Audio/Plug-Ins/Components")
 
65
       (home-subpath "/Library/Audio/Plug-Ins/Components")
 
66
       (subpath "/Library/Audio/Plug-Ins/HAL")
 
67
       (subpath "/Library/QuickTime")
 
68
       (home-subpath "/Library/QuickTime")
 
69
       (subpath "/Library/Video/Plug-Ins")
 
70
 
 
71
       (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
 
72
 
 
73
       (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
 
74
 
 
75
       ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
 
76
       (subpath "/Library/Keychains")
 
77
)
 
78
 
 
79
;; Read-write preferences and data
 
80
(allow file*
 
81
       (home-regex #"/Library/Preferences/com\.apple\.WebKit\.PluginProcess\.plist")
 
82
 
 
83
       (home-subpath "/Library/Caches/QuickTime")
 
84
 
 
85
       ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
 
86
       (home-subpath "/Library/Keychains"))
 
87
 
 
88
;; IOKit user clients
 
89
(allow iokit-open
 
90
       (iokit-connection "IOAccelerator")
 
91
       (iokit-user-client-class "AGPMClient")
 
92
       (iokit-user-client-class "AppleGraphicsControlClient")
 
93
       (iokit-user-client-class "AppleSNBFBUserClient")
 
94
       (iokit-user-client-class "IOAccelerationUserClient")
 
95
       (iokit-user-client-class "IOAudioControlUserClient")
 
96
       (iokit-user-client-class "IOAudioEngineUserClient")
 
97
       (iokit-user-client-class "IOFramebufferSharedUserClient")
 
98
       (iokit-user-client-class "IOHIDParamUserClient")
 
99
       (iokit-user-client-class "IOSurfaceRootUserClient")
 
100
       (iokit-user-client-class "IOSurfaceSendRight")
 
101
       (iokit-user-client-class "RootDomainUserClient"))
 
102
 
 
103
;; Various services required by AppKit and other frameworks
 
104
(allow mach-lookup
 
105
       (global-name "com.apple.CoreServices.coreservicesd")
 
106
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
 
107
       (global-name "com.apple.FileCoordination")
 
108
       (global-name "com.apple.FontObjectsServer")
 
109
       (global-name "com.apple.FontServer")
 
110
       (global-name "com.apple.ImageCaptureExtension2.presence")
 
111
       (global-name "com.apple.SecurityServer")
 
112
       (global-name "com.apple.SystemConfiguration.configd")
 
113
       (global-name "com.apple.SystemConfiguration.PPPController")
 
114
       (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
 
115
       (global-name "com.apple.audio.VDCAssistant")
 
116
       (global-name "com.apple.audio.audiohald")
 
117
       (global-name "com.apple.audio.coreaudiod")
 
118
       (global-name "com.apple.cmio.VDCAssistant")
 
119
       (global-name "com.apple.cookied") ;; FIXME: <rdar://problem/10790768> Limit access to cookies.
 
120
       (global-name "com.apple.cvmsServ")
 
121
       (global-name "com.apple.networkd")
 
122
       (global-name "com.apple.ocspd")
 
123
       (global-name "com.apple.pasteboard.1")
 
124
       (global-name "com.apple.window_proxies")
 
125
       (global-name "com.apple.windowserver.active")
 
126
       (global-name "com.apple.cfnetwork.AuthBrokerAgent")
 
127
       (global-name "com.apple.PowerManagement.control")
 
128
       (global-name-regex #"_OpenStep$")
 
129
)
 
130
 
 
131
;; Networking
 
132
(allow system-socket (socket-domain AF_ROUTE))
 
133
(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
 
134
(allow network-outbound
 
135
       ;; Kernel controls
 
136
       (control-name "com.apple.network.statistics")
 
137
       (control-name "com.apple.netsrc")
 
138
 
 
139
       ;; Local mDNSResponder for DNS, arbitrary outbound TCP
 
140
       (literal "/private/var/run/mDNSResponder")
 
141
       (remote tcp))
 
142
 
 
143
(allow mach-lookup
 
144
       (global-name "com.apple.tsm.uiserver")
 
145
       (local-name "com.apple.tsm.portname")
 
146
)
 
147
 
 
148
;; Open and Save panels
 
149
(define (apply-read-and-issue-extension op path-filter)
 
150
       (op file-read* path-filter)
 
151
       (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
 
152
(define (apply-write-and-issue-extension op path-filter)
 
153
       (op file-write* path-filter)
 
154
       (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
 
155
(define (read-write-and-issue-extensions path-filter)
 
156
       (apply-read-and-issue-extension allow path-filter)
 
157
       (apply-write-and-issue-extension allow path-filter))
 
158
(allow qtn-user
 
159
       (extension "com.apple.app-sandbox.read-write"))
 
160
(read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write"))
 
161
 
 
162
;; Printing
 
163
(allow network-outbound (literal "/private/var/run/cupsd"))
 
164
(allow mach-lookup
 
165
       (global-name "com.apple.printuitool.agent")
 
166
       (global-name "com.apple.printtool.agent")
 
167
       (global-name "com.apple.printtool.daemon"))
 
168
(allow file-read*
 
169
       (home-literal "/.cups/lpoptions")
 
170
       (home-literal "/.cups/client.conf")
 
171
       (literal "/private/etc/cups/client.conf")
 
172
       (literal "/private/etc/cups/lpoptions")
 
173
       (subpath "/private/etc/cups/ppd")
 
174
       (subpath "/private/var/run/cupsd")
 
175
       (home-literal "/Library/Preferences/org.cups.PrintingPrefs.plist"))
 
176
 
 
177
;; Text Services Manager
 
178
(allow iokit-set-properties (iokit-property "CapsLockDelayOverride"))
 
179
 
 
180
;; Image Capture (used by print preview dialog)
 
181
(allow appleevent-send (appleevent-destination "com.apple.imagecaptureextension2"))
 
182
 
 
183
;; Silently block access to some files
 
184
(deny file-read* file-write* (with no-log)
 
185
       (home-regex #"/Library/Preferences/com\.apple\.internetconfigpriv\.plist")
 
186
       (home-regex #"/Library/Preferences/com\.apple\.internetconfig\.plist")
 
187
 
 
188
       ;; FIXME: Should be removed after <rdar://problem/9422957> is fixed.
 
189
       (home-literal "/Library/Caches/Cache.db")
 
190
 
 
191
       ;; FIXME: Should be removed after <rdar://problem/10463881> is fixed.
 
192
       (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")
 
193
       (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))
 
194