WebKit Bugzilla
Attachment 343014 Details for
Bug 184991
: We should cache the compiled sandbox profile in a data vault
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
cache sandbox
cache_sandbox.patch (text/plain), 44.44 KB, created by
Ben Richards
on 2018-06-18 20:34:52 PDT
(
hide
)
Description:
cache sandbox
Filename:
MIME Type:
Creator:
Ben Richards
Created:
2018-06-18 20:34:52 PDT
Size:
44.44 KB
patch
obsolete
>diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog >index a9c791b242b..f640a9ca387 100644 >--- a/Source/WTF/ChangeLog >+++ b/Source/WTF/ChangeLog >@@ -1,3 +1,12 @@ >+2018-06-18 Ben Richards <benton_richards@apple.com> >+ >+ Added codes for initialize sandbox >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * wtf/SystemTracing.h: >+ > 2018-06-18 Jiewen Tan <jiewen_tan@apple.com> > > Add a graceful exit for AuthenticationManager::initializeConnection >diff --git a/Source/WTF/wtf/SystemTracing.h b/Source/WTF/wtf/SystemTracing.h >index b52be8d3868..105196ec487 100644 >--- a/Source/WTF/wtf/SystemTracing.h >+++ b/Source/WTF/wtf/SystemTracing.h >@@ -96,6 +96,8 @@ enum TracePointCode { > CommitLayerTreeEnd, > ProcessLaunchStart, > ProcessLaunchEnd, >+ InitializeSandboxStart, >+ InitializeSandboxEnd, > }; > > #ifdef __cplusplus >diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog >index 34429f3a236..7b7e785a0fa 100644 >--- a/Source/WebKit/ChangeLog >+++ b/Source/WebKit/ChangeLog >@@ -1,3 +1,36 @@ >+2018-06-18 Ben Richards <benton_richards@apple.com> >+ >+ Added compiled sandbox caching >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * Configurations/Network-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX.entitlements. >+ * Configurations/NetworkService.xcconfig: >+ * Configurations/Storage-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX.entitlements. >+ * Configurations/StorageService.xcconfig: >+ * Configurations/WebContent-OSX.entitlements: >+ * Configurations/WebKit.xcconfig: >+ * NetworkProcess/NetworkProcess.h: >+ * PluginProcess/PluginProcess.h: >+ * Shared/ChildProcess.h: >+ * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h: >+ (WebKit::XPCServiceInitializer): >+ * Shared/mac/ChildProcessMac.mm: >+ (WebKit::verboseLog): >+ (WebKit::getFileContents): >+ (WebKit::getProcessStorageClass): >+ (WebKit::getSandboxHeader): >+ (WebKit::getSandboxDirectory): >+ (WebKit::getSandboxFilename): >+ (WebKit::compileAndCacheSandboxProfile): >+ (WebKit::applyCachedSandbox): >+ (WebKit::applySandbox): >+ (WebKit::ChildProcess::initializeSandbox): >+ * StorageProcess/StorageProcess.h: >+ * WebKit.xcodeproj/project.pbxproj: >+ * WebProcess/WebProcess.h: >+ > 2018-06-18 Jiewen Tan <jiewen_tan@apple.com> > > Add a graceful exit for AuthenticationManager::initializeConnection >diff --git a/Source/WebKit/Configurations/Network-OSX.entitlements b/Source/WebKit/Configurations/Network-OSX.entitlements >new file mode 100644 >index 00000000000..03270566fc5 >--- /dev/null >+++ b/Source/WebKit/Configurations/Network-OSX.entitlements >@@ -0,0 +1,8 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+ <key>com.apple.rootless.storage.WebKitNetworkingSandbox</key> >+ <true/> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/NetworkService.xcconfig b/Source/WebKit/Configurations/NetworkService.xcconfig >index 5b602d60d8d..907a787c866 100644 >--- a/Source/WebKit/Configurations/NetworkService.xcconfig >+++ b/Source/WebKit/Configurations/NetworkService.xcconfig >@@ -32,6 +32,7 @@ WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvos = Network-iOS; > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvsimulator = Network-iOS; > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_iphoneminimalsimulator = Network-iOS-minimalsimulator; > >+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = Configurations/Network-OSX.entitlements; > OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS); > > PRODUCT_NAME = com.apple.WebKit.Networking; >diff --git a/Source/WebKit/Configurations/Storage-OSX.entitlements b/Source/WebKit/Configurations/Storage-OSX.entitlements >new file mode 100644 >index 00000000000..bbb392e80f9 >--- /dev/null >+++ b/Source/WebKit/Configurations/Storage-OSX.entitlements >@@ -0,0 +1,8 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+ <key>com.apple.rootless.storage.WebKitStorageSandbox</key> >+ <true/> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/StorageService.xcconfig b/Source/WebKit/Configurations/StorageService.xcconfig >index 75761d808af..c857586f773 100644 >--- a/Source/WebKit/Configurations/StorageService.xcconfig >+++ b/Source/WebKit/Configurations/StorageService.xcconfig >@@ -25,6 +25,7 @@ > > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Databases-iOS; > >+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = Configurations/Storage-OSX.entitlements; > OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS); > > PRODUCT_NAME = $(WK_STORAGE_SERVICE_PRODUCT_NAME); >diff --git a/Source/WebKit/Configurations/WebContent-OSX.entitlements b/Source/WebKit/Configurations/WebContent-OSX.entitlements >index d35e43ae588..c2354c41a37 100644 >--- a/Source/WebKit/Configurations/WebContent-OSX.entitlements >+++ b/Source/WebKit/Configurations/WebContent-OSX.entitlements >@@ -4,5 +4,7 @@ > <dict> > <key>com.apple.security.cs.allow-jit</key> > <true/> >+ <key>com.apple.rootless.storage.WebKitWebContentSandbox</key> >+ <true/> > </dict> > </plist> >diff --git a/Source/WebKit/Configurations/WebKit.xcconfig b/Source/WebKit/Configurations/WebKit.xcconfig >index 79f44e0517b..6d250e4fa34 100644 >--- a/Source/WebKit/Configurations/WebKit.xcconfig >+++ b/Source/WebKit/Configurations/WebKit.xcconfig >@@ -82,6 +82,9 @@ WK_MOBILE_CORE_SERVICES_LDFLAGS_cocoatouch = -framework MobileCoreServices; > WK_MOBILE_GESTALT_LDFLAGS = $(WK_MOBILE_GESTALT_LDFLAGS_$(WK_COCOA_TOUCH)); > WK_MOBILE_GESTALT_LDFLAGS_cocoatouch = -lMobileGestalt; > >+WK_LIBSANDBOX_LDFLAGS = $(WK_LIBSANDBOX_LDFLAGS_$(WK_PLATFORM_NAME)); >+WK_LIBSANDBOX_LDFLAGS_macosx = -lsandbox; >+ > WK_OPENGL_LDFLAGS = $(WK_OPENGL_LDFLAGS_$(WK_PLATFORM_NAME)); > WK_OPENGL_LDFLAGS_iphoneos = -framework OpenGLES; > WK_OPENGL_LDFLAGS_iphoneminimalsimulator = -framework OpenGL; >@@ -112,7 +115,7 @@ WK_UIKIT_LDFLAGS_cocoatouch = -framework UIKit; > WK_URL_FORMATTING_LDFLAGS = $(WK_URL_FORMATTING_LDFLAGS_$(WK_HAVE_URL_FORMATTING)); > WK_URL_FORMATTING_LDFLAGS_YES = -framework URLFormatting; > >-FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS); >+FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBSANDBOX_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS); > > // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols. > UNEXPORTED_SYMBOL_LDFLAGS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-unexported_symbol -Wl,__Znwm -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSEDn -Wl,-unexported_symbol, -Wl,__ZNKSt3__18functionIFvN7WebCore12PolicyActionEEEclES2_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEE4swapERS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED1Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED2Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSERKS4_ -Wl,-unexported_symbol, -Wl,__ZTVNSt3__117bad_function_callE; >diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.h b/Source/WebKit/NetworkProcess/NetworkProcess.h >index be349319b1a..4c815a56fc8 100644 >--- a/Source/WebKit/NetworkProcess/NetworkProcess.h >+++ b/Source/WebKit/NetworkProcess/NetworkProcess.h >@@ -80,6 +80,7 @@ class NetworkProcess : public ChildProcess, private DownloadManager::Client { > friend NeverDestroyed<DownloadManager>; > public: > static NetworkProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::NetworkType; > > template <typename T> > T* supplement() >diff --git a/Source/WebKit/PluginProcess/PluginProcess.h b/Source/WebKit/PluginProcess/PluginProcess.h >index d5081b061cd..9a8812d9f98 100644 >--- a/Source/WebKit/PluginProcess/PluginProcess.h >+++ b/Source/WebKit/PluginProcess/PluginProcess.h >@@ -49,6 +49,7 @@ class PluginProcess : public ChildProcess > > public: > static PluginProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::PluginType; > > void removeWebProcessConnection(WebProcessConnection*); > >diff --git a/Source/WebKit/Shared/ChildProcess.h b/Source/WebKit/Shared/ChildProcess.h >index b35c9f2e3f3..4f3f794ed64 100644 >--- a/Source/WebKit/Shared/ChildProcess.h >+++ b/Source/WebKit/Shared/ChildProcess.h >@@ -39,22 +39,19 @@ > namespace WebKit { > > class SandboxInitializationParameters; >- >-struct ChildProcessInitializationParameters { >- String uiProcessName; >- String clientIdentifier; >- std::optional<WebCore::ProcessIdentifier> processIdentifier; >- IPC::Connection::Identifier connectionIdentifier; >- HashMap<String, String> extraInitializationData; >-#if PLATFORM(COCOA) >- OSObjectPtr<xpc_object_t> priorityBoostMessage; >-#endif >-}; >+struct ChildProcessInitializationParameters; > > class ChildProcess : protected IPC::Connection::Client, public IPC::MessageSender { > WTF_MAKE_NONCOPYABLE(ChildProcess); > > public: >+ enum class ProcessType { >+ WebContentType, >+ NetworkType, >+ StorageType, >+ PluginType >+ }; >+ > void initialize(const ChildProcessInitializationParameters&); > > // disable and enable termination of the process. when disableTermination is called, the >@@ -147,6 +144,18 @@ private: > #endif > }; > >+struct ChildProcessInitializationParameters { >+ String uiProcessName; >+ String clientIdentifier; >+ std::optional<WebCore::ProcessIdentifier> processIdentifier; >+ IPC::Connection::Identifier connectionIdentifier; >+ HashMap<String, String> extraInitializationData; >+ ChildProcess::ProcessType processType; >+#if PLATFORM(COCOA) >+ OSObjectPtr<xpc_object_t> priorityBoostMessage; >+#endif >+}; >+ > } // namespace WebKit > > #endif // ChildProcess_h >diff --git a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >index 209e20a7549..e62c3a7b3df 100644 >--- a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >+++ b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >@@ -112,6 +112,8 @@ void XPCServiceInitializer(OSObjectPtr<xpc_connection_t> connection, xpc_object_ > Thread::setGlobalMaxQOSClass(QOS_CLASS_UTILITY); > #endif > >+ parameters.processType = XPCServiceType::processType; >+ > XPCServiceType::singleton().initialize(parameters); > } > >diff --git a/Source/WebKit/Shared/mac/ChildProcessMac.mm b/Source/WebKit/Shared/mac/ChildProcessMac.mm >index aed5b9fd709..6831d9ee082 100644 >--- a/Source/WebKit/Shared/mac/ChildProcessMac.mm >+++ b/Source/WebKit/Shared/mac/ChildProcessMac.mm >@@ -31,6 +31,7 @@ > #import "CodeSigning.h" > #import "QuarantineSPI.h" > #import "SandboxInitializationParameters.h" >+#import "SandboxUtilities.h" > #import "WKFoundation.h" > #import "XPCServiceEntryPoint.h" > #import <WebCore/FileSystem.h> >@@ -40,12 +41,23 @@ > #import <pwd.h> > #import <stdlib.h> > #import <sysexits.h> >+#import <wtf/DataLog.h> > #import <wtf/Scope.h> >+#import <wtf/SystemTracing.h> >+#import <wtf/WallTime.h> > #import <wtf/spi/darwin/SandboxSPI.h> > > #if USE(APPLE_INTERNAL_SDK) >+#import <pal/crypto/CryptoDigest.h> >+#import <rootless.h> >+extern "C" { >+#import <sandbox/libsandbox.h> >+} >+#import <sys/sysctl.h> > #include <HIServices/ProcessesPriv.h> >-#endif >+#endif // USE(APPLE_INTERNAL_SDK) >+ >+#define VERBOSE_LOGGING false > > typedef bool (^LSServerConnectionAllowedBlock) ( CFDictionaryRef optionsRef ); > extern "C" void _LSSetApplicationLaunchServicesServerConnectionStatus(uint64_t flags, LSServerConnectionAllowedBlock block); >@@ -57,6 +69,36 @@ using namespace WebCore; > > namespace WebKit { > >+#if USE(APPLE_INTERNAL_SDK) >+using SandboxProfile = typename std::remove_pointer<sandbox_profile_t>::type; >+ >+struct CachedSandboxHeader { >+ uint32_t versionNumber; >+ uint32_t sandboxHeaderSize; >+ uint32_t sandboxBuiltinSize; // If a builtin doesn't exist, this is UINT_MAX >+ uint32_t sandboxDataSize; >+ char osVersion[10]; >+}; >+// The file is layed out on disk like: >+// byte 0 >+// CachedFileHeader <- sizeof(CachedFileHeader) bytes >+// SandboxHeader <- sandboxHeaderSize bytes >+// [SandboxBuiltin] optional. Present if sanboxBuiltinSize is not UINT_MAX. If present, sandboxBuiltinSize bytes. >+// SandboxData <- sandboxDataSize bytes >+// byte N >+ >+struct SandboxInfo { >+ String directoryPath; >+ String filePath; >+ String profilePath; >+ sandbox_params_t params; >+ Vector<uint8_t> header; >+ ChildProcess::ProcessType processType; >+}; >+ >+static constexpr uint32_t CachedSandboxVersionNumber = 0; >+#endif // USE(APPLE_INTERNAL_SDK) >+ > static void initializeTimerCoalescingPolicy() > { > // Set task_latency and task_throughput QOS tiers as appropriate for a visible application. >@@ -110,14 +152,439 @@ static OSStatus enableSandboxStyleFileQuarantine() > #endif > } > >+template<typename... Types> >+void verboseLog(const Types&... values) >+{ >+ dataLogLnIf(VERBOSE_LOGGING, values...); >+} >+ >+#if USE(APPLE_INTERNAL_SDK) >+static std::optional<Vector<char>> getFileContents(const String& path) >+{ >+ FileSystem::PlatformFileHandle handle = openFile(path, FileSystem::FileOpenMode::Read); >+ >+ if (handle == FileSystem::invalidPlatformFileHandle) { >+ verboseLog("Can't get file handle for path: ", path); >+ return std::nullopt; >+ } >+ >+ auto closeFileOnExit = makeScopeExit([&] { >+ FileSystem::closeFile(handle); >+ }); >+ >+ long long fileSize; >+ if (!FileSystem::getFileSize(handle, fileSize)) { >+ verboseLog("Could not get size for file: ", path); >+ return std::nullopt; >+ } >+ RELEASE_ASSERT(fileSize >= 0); >+ >+ Vector<char> contents(safeCast<size_t>(fileSize)); >+ int bytesRead = FileSystem::readFromFile(handle, contents.data(), safeCast<size_t>(fileSize)); >+ if (safeCast<int>(fileSize) != bytesRead) { >+ verboseLog("Could not read the file: ", path); >+ return std::nullopt; >+ } >+ >+ return WTFMove(contents); >+}; >+ >+static inline constexpr const char* getProcessStorageClass(ChildProcess::ProcessType type) >+{ >+ switch (type) { >+ case ChildProcess::ProcessType::WebContentType: >+ return "WebKitWebContentSandbox"; >+ case ChildProcess::ProcessType::NetworkType: >+ return "WebKitNetworkingSandbox"; >+ case ChildProcess::ProcessType::StorageType: >+ return "WebKitStorageSandbox"; >+ case ChildProcess::ProcessType::PluginType: >+ return "WebKitPluginSandbox"; >+ } >+} >+ >+static std::optional<Vector<uint8_t>> getSandboxHeader(const SandboxInitializationParameters& params, const SandboxInfo& info) >+{ >+ // Compute the sandbox header size. >+ Checked<size_t> headerSize = 0; >+ for (size_t i = 0; i < params.count(); ++i) { >+ const char* name = params.name(i); >+ const char* value = params.value(i); >+ if (sandbox_set_param(info.params, name, value)) >+ CRASH(); >+ headerSize += strlen(name) + 1; >+ headerSize += strlen(value) + 1; >+ } >+ >+ Vector<char> profileContents; >+ if (auto fileContents = getFileContents(info.profilePath)) >+ profileContents = WTFMove(*fileContents); >+ else >+ return std::nullopt; >+ >+ headerSize += profileContents.size(); >+ >+ // Write out the sandbox header. >+ Vector<uint8_t> sandboxHeader(headerSize.unsafeGet()); >+ >+ size_t cursor = 0; >+ for (size_t i = 0; i < params.count(); ++i) { >+ auto appendCString = [&] (const char* value) { >+ size_t length = strlen(value); >+ RELEASE_ASSERT(cursor + length < sandboxHeader.size()); >+ memcpy(sandboxHeader.data() + cursor, value, length); >+ cursor += length; >+ RELEASE_ASSERT(cursor + 1 <= sandboxHeader.size()); >+ sandboxHeader[cursor] = bitwise_cast<uint8_t>(':'); >+ ++cursor; >+ }; >+ >+ const char* name = params.name(i); >+ appendCString(name); >+ const char* value = params.value(i); >+ appendCString(value); >+ } >+ >+ memcpy(sandboxHeader.data() + cursor, profileContents.data(), profileContents.size()); >+ cursor += profileContents.size(); >+ RELEASE_ASSERT(cursor == sandboxHeader.size()); >+ >+ return WTFMove(sandboxHeader); >+} >+ >+static inline String getSandboxDirectory(ChildProcess::ProcessType processType) >+{ >+ char darwinUserCacheDir[PATH_MAX]; >+ { >+ char temp[PATH_MAX]; >+ if (!confstr(_CS_DARWIN_USER_CACHE_DIR, temp, sizeof(temp))) { >+ WTFLogAlways("%s: couldn't retrieve private cache directory path: %d\n", getprogname(), errno); >+ exit(EX_NOPERM); >+ } >+ if (!realpath(temp, darwinUserCacheDir)) >+ CRASH(); >+ } >+ >+ String sandboxDirectory = darwinUserCacheDir; // OOPS: Do we want to just use the one w/ client identifier appended to it? >+ switch (processType) { >+ case ChildProcess::ProcessType::WebContentType: >+ sandboxDirectory.append("/com.apple.WebKit.WebContent.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::NetworkType: >+ sandboxDirectory.append("/com.apple.WebKit.Networking.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::StorageType: >+ sandboxDirectory.append("/com.apple.WebKit.Storage.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::PluginType: >+ sandboxDirectory.append("/com.apple.WebKit.Plugin.Sandbox"); >+ break; >+ } >+ >+ return sandboxDirectory; >+} >+ >+static inline String getSandboxFilename(const SandboxInfo& info) >+{ >+ String sandboxFile = info.directoryPath; >+ sandboxFile.append("/CompiledSandbox+"); >+ >+ auto crypto = PAL::CryptoDigest::create(PAL::CryptoDigest::Algorithm::SHA_1); >+ crypto->addBytes(info.header.data(), info.header.size()); >+ Vector<uint8_t> hash = crypto->computeHash(); >+ >+ char* hashAsString = static_cast<char*>(fastMalloc(hash.size() * 2 + 1)); >+ auto freeHashAsStringOnExit = makeScopeExit([=] { >+ fastFree(hashAsString); >+ }); >+ char* ptr = hashAsString; >+ >+ for (uint8_t byte : hash) { >+ snprintf(ptr, 3, "%02x", byte); >+ ptr += 2; >+ } >+ *ptr = '\0'; >+ RELEASE_ASSERT(static_cast<uintptr_t>(ptr - hashAsString) == hash.size() * 2); >+ sandboxFile.append(hashAsString); >+ >+ return sandboxFile; >+} >+ >+static SandboxProfile* compileAndCacheSandboxProfile(const SandboxInfo& info) >+{ >+ const char* storageClass = getProcessStorageClass(info.processType); >+ >+ bool hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes); >+ if (!hasSandboxDirectory) { >+ CString sandboxPath = FileSystem::fileSystemRepresentation(info.directoryPath); >+ bool madeDirectory = !(rootless_mkdir_datavault(sandboxPath.data(), 0700, storageClass)); >+ if (madeDirectory) >+ verboseLog("Made rootless directory: ", sandboxPath); >+ else >+ verboseLog("Could not make rootless directory, errno: ", errno); >+ >+ if (madeDirectory) { >+ ASSERT(FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes)); >+ verboseLog("Created sandbox directory: ", info.directoryPath); >+ hasSandboxDirectory = true; >+ } else { >+ // We may have raced with someone else making it. That's ok. >+ hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes); >+ } >+ } >+ >+ if (!hasSandboxDirectory) { >+ verboseLog("Bailing because we don't have a sandbox directory"); >+ return nullptr; >+ } >+ >+ // Make sure directory is a datavault >+ CString directoryPath = FileSystem::fileSystemRepresentation(info.directoryPath); >+ if (rootless_check_datavault_flag(directoryPath.data(), storageClass)) { >+ // Directory isn't a datavault, let's convert it to one >+ if (rootless_convert_to_datavault(directoryPath.data(), storageClass)) { >+ verboseLog("Couldn't convert existing directory to datavault"); >+ return nullptr; >+ } >+ } >+ >+ char* error = nullptr; >+ CString profilePath = FileSystem::fileSystemRepresentation(info.profilePath); >+ SandboxProfile* sandboxProfile = sandbox_compile_file(profilePath.data(), info.params, &error); >+ if (!sandboxProfile) { >+ WTFLogAlways("%s: Couldn't compile WebContent sandbox %s\n", getprogname(), error); >+ CRASH(); >+ } >+ >+ Checked<size_t> fileSize = 0; >+ fileSize += sizeof(CachedSandboxHeader); >+ fileSize += info.header.size(); >+ if (sandboxProfile->builtin) >+ fileSize += strlen(sandboxProfile->builtin); >+ fileSize += sandboxProfile->size; >+ >+ CachedSandboxHeader header { >+ CachedSandboxVersionNumber, >+ safeCast<uint32_t>(info.header.size()), >+ sandboxProfile->builtin ? safeCast<uint32_t>(strlen(sandboxProfile->builtin)) : std::numeric_limits<uint32_t>::max(), >+ safeCast<uint32_t>(sandboxProfile->size), >+ "" >+ }; >+ >+ // Set header os version number >+ size_t osVersionSize = sizeof(header.osVersion); >+ if (sysctlbyname("kern.osversion", header.osVersion, &osVersionSize, NULL, 0)) { >+ verboseLog("Couldn't get osversion"); >+ return nullptr; >+ } >+ >+ Vector<char> fileContents(fileSize.unsafeGet()); >+ >+ // Write out our file content into a temporary vector. >+ { >+ size_t cursor = 0; >+ >+ RELEASE_ASSERT(cursor + sizeof(CachedSandboxHeader) <= fileContents.size()); >+ memcpy(fileContents.data() + cursor, &header, sizeof(CachedSandboxHeader)); >+ cursor += sizeof(CachedSandboxHeader); >+ >+ RELEASE_ASSERT(cursor + info.header.size() <= fileContents.size()); >+ memcpy(fileContents.data() + cursor, info.header.data(), info.header.size()); >+ cursor += info.header.size(); >+ >+ if (sandboxProfile->builtin) { >+ size_t length = strlen(sandboxProfile->builtin); >+ RELEASE_ASSERT(cursor + length <= fileContents.size()); >+ memcpy(fileContents.data() + cursor, sandboxProfile->builtin, length); >+ cursor += length; >+ } >+ >+ RELEASE_ASSERT(cursor + sandboxProfile->size == fileContents.size()); >+ memcpy(fileContents.data() + cursor, sandboxProfile->data, sandboxProfile->size); >+ } >+ >+ FileSystem::PlatformFileHandle tempHandle; >+ String tempFileString; >+ CString tempFilePath; >+ for (unsigned i = 0; true; ++i) { >+ tempFileString = info.directoryPath; >+ tempFileString.append("/tempfile"); >+ if (i) >+ tempFileString.append(String::number(i)); >+ tempFilePath = FileSystem::fileSystemRepresentation(tempFileString); >+ if (tempFilePath.isNull()) >+ return nullptr; >+ tempHandle = open(tempFilePath.data(), (O_WRONLY | O_CREAT | O_EXCL), 0666); >+ if (tempHandle != FileSystem::invalidPlatformFileHandle) >+ break; >+ if (errno != EEXIST) >+ return nullptr; >+ verboseLog("errno is EEXIST, looping back and trying again: ", tempFileString); >+ } >+ >+ bool didRenameFile = false; >+ ASSERT(tempHandle != FileSystem::invalidPlatformFileHandle); >+ int writeSize = FileSystem::writeToFile(tempHandle, bitwise_cast<const char*>(fileContents.data()), safeCast<int>(fileContents.size())); >+ if (writeSize == safeCast<int>(fileContents.size())) { >+ // Rename the temp file to the expected file. We do it this way because this is an atomic operation. >+ // OOPS: What is the behavior if this happens concurrently to read when the file already exists? >+ CString sandboxFilePath = FileSystem::fileSystemRepresentation(info.filePath); >+ if (!sandboxFilePath.isNull()) { >+ verboseLog("Renaming from: '", tempFilePath, "' to: '", info.filePath, "'"); >+ if (!rename(tempFilePath.data(), sandboxFilePath.data())) { >+ didRenameFile = true; >+ verboseLog("Rename succeeded"); >+ } else >+ verboseLog("Rename failed: ", errno); >+ } >+ } else >+ verboseLog("Did not successfully write file temp file: ", tempFilePath); >+ >+ FileSystem::closeFile(tempHandle); >+ >+ if (!didRenameFile) >+ FileSystem::deleteFile(tempFileString); >+ >+ return sandboxProfile; >+} >+ >+static bool applyCachedSandbox(const SandboxInfo& info) >+{ >+ Vector<char> compiledFile; >+ if (auto maybeCompiledFile = getFileContents(info.filePath)) >+ compiledFile = WTFMove(*maybeCompiledFile); >+ else >+ return false; >+ >+ size_t cursor = 0; >+ auto readHeader = [&] (CachedSandboxHeader& value) { >+ if (cursor + sizeof(CachedSandboxHeader) > compiledFile.size()) >+ return false; >+ memcpy(&value, compiledFile.data() + cursor, sizeof(CachedSandboxHeader)); >+ cursor += sizeof(CachedSandboxHeader); >+ return true; >+ }; >+ >+ CachedSandboxHeader header; >+ if (!readHeader(header)) { >+ verboseLog("Cached file is smaller than sizeof(CachedFileHeader)"); >+ return false; >+ } >+ >+ char osVersion[sizeof(CachedSandboxHeader::osVersion)]; >+ size_t osVersionSize = sizeof(osVersion); >+ if (sysctlbyname("kern.osversion", osVersion, &osVersionSize, NULL, 0)) { >+ verboseLog("couldn't get os version number"); >+ return false; >+ } >+ >+ if (strncmp(header.osVersion, osVersion, osVersionSize)) { >+ verboseLog("cached sandbox is from old operating system, deleting old file and recompiling"); >+ FileSystem::deleteFile(info.filePath); >+ return false; >+ } >+ >+ if (header.versionNumber != CachedSandboxVersionNumber) { >+ verboseLog("cached file has old version number: ", header.versionNumber); >+ return false; >+ } >+ >+ size_t expectedFileSize = sizeof(CachedSandboxHeader) + header.sandboxHeaderSize + header.sandboxDataSize; >+ bool haveBuiltin = header.sandboxBuiltinSize != std::numeric_limits<uint32_t>::max(); >+ if (haveBuiltin) >+ expectedFileSize += header.sandboxBuiltinSize; >+ >+ if (compiledFile.size() != expectedFileSize) { >+ verboseLog("Cached file has wrong file size."); >+ return false; >+ } >+ >+ if (header.sandboxHeaderSize != info.header.size()) { >+ verboseLog("header size different from cached header size"); >+ return false; >+ } >+ >+ if (memcmp(info.header.data(), compiledFile.data() + cursor, info.header.size())) { >+ verboseLog("Header and cached header do not have the same contents."); >+ return false; >+ } >+ cursor += info.header.size(); >+ >+ SandboxProfile profile; >+ profile.builtin = nullptr; >+ profile.size = header.sandboxDataSize; >+ if (haveBuiltin) { >+ profile.builtin = static_cast<char*>(fastMalloc(header.sandboxBuiltinSize + 1)); >+ memcpy(profile.builtin, compiledFile.data() + cursor, header.sandboxBuiltinSize); >+ profile.builtin[header.sandboxBuiltinSize] = '\0'; >+ cursor += header.sandboxBuiltinSize; >+ } >+ auto freeBuiltinOnExit = makeScopeExit([&] { >+ if (profile.builtin) >+ fastFree(profile.builtin); >+ }); >+ profile.data = bitwise_cast<unsigned char*>(compiledFile.data()) + cursor; >+ RELEASE_ASSERT(cursor + profile.size == compiledFile.size()); >+ >+ if (sandbox_apply(&profile)) { >+ WTFLogAlways("could not apply cached sandbox"); >+ return false; >+ } >+ >+ verboseLog("Applied cached sandbox successfully"); >+ return true; >+} >+ >+static bool applySandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters, const String& defaultProfilePath) >+{ >+ SandboxInfo info; >+ info.processType = parameters.processType; >+ >+ if (sandboxParameters.mode() != SandboxInitializationParameters::UseDefaultSandboxProfilePath >+ && sandboxParameters.mode() != SandboxInitializationParameters::UseOverrideSandboxProfilePath) >+ return false; >+ >+ info.profilePath = sandboxParameters.mode() == SandboxInitializationParameters::UseDefaultSandboxProfilePath ? defaultProfilePath : sandboxParameters.overrideSandboxProfilePath(); >+ if (info.profilePath.isEmpty()) >+ return false; >+ >+ info.params = sandbox_create_params(); >+ auto freeParamsOnExit = makeScopeExit([&] { >+ sandbox_free_params(info.params); >+ }); >+ >+ if (auto header = getSandboxHeader(sandboxParameters, info)) >+ info.header = WTFMove(*header); >+ else >+ return false; >+ >+ info.directoryPath = getSandboxDirectory(info.processType); >+ info.filePath = getSandboxFilename(info); >+ >+ if (applyCachedSandbox(info)) >+ return true; >+ >+ SandboxProfile* sandboxProfile = compileAndCacheSandboxProfile(info); >+ if (!sandboxProfile) >+ return false; >+ >+ auto freeSandboxOnExit = makeScopeExit([&] { >+ sandbox_free_profile(sandboxProfile); >+ }); >+ >+ if (sandbox_apply(sandboxProfile)) { >+ verboseLog("could not apply compiled sandbox!"); >+ WTFLogAlways("%s: Couldn't apply compiled sandbox profile, errno: %d\n", getprogname(), errno); >+ exit(EX_NOPERM); >+ } >+ >+ return true; >+} >+#endif // USE(APPLE_INTERNAL_SDK) >+ > void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters) > { >-#if WK_API_ENABLED >- NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")]; >-#else >- NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")]; >-#endif >- String defaultProfilePath = [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"]; >+ TraceScope traceScope(InitializeSandboxStart, InitializeSandboxEnd); > > if (sandboxParameters.userDirectorySuffix().isNull()) { > auto userDirectorySuffix = parameters.extraInitializationData.find("user-directory-suffix"); >@@ -150,6 +617,12 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& > exit(EX_NOPERM); > } > setenv("TMPDIR", temporaryDirectory, 1); >+ >+#if WK_API_ENABLED >+ NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")]; >+#else >+ NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")]; >+#endif > > sandboxParameters.addPathParameter("WEBKIT2_FRAMEWORK_DIR", [[webKit2Bundle bundlePath] stringByDeletingLastPathComponent]); > sandboxParameters.addConfDirectoryParameter("DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR); >@@ -169,47 +642,59 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& > String path = String::fromUTF8(pwd.pw_dir); > path.append("/Library"); > >+ String libraryPath = path; >+ > sandboxParameters.addPathParameter("HOME_LIBRARY_DIR", FileSystem::fileSystemRepresentation(path).data()); > > path.append("/Preferences"); > > sandboxParameters.addPathParameter("HOME_LIBRARY_PREFERENCES_DIR", FileSystem::fileSystemRepresentation(path).data()); > >- switch (sandboxParameters.mode()) { >- case SandboxInitializationParameters::UseDefaultSandboxProfilePath: >- case SandboxInitializationParameters::UseOverrideSandboxProfilePath: { >- String sandboxProfilePath = sandboxParameters.mode() == SandboxInitializationParameters::UseDefaultSandboxProfilePath ? defaultProfilePath : sandboxParameters.overrideSandboxProfilePath(); >- if (!sandboxProfilePath.isEmpty()) { >- CString profilePath = FileSystem::fileSystemRepresentation(sandboxProfilePath); >- char* errorBuf; >+ String defaultProfilePath = [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"]; >+#if USE(APPLE_INTERNAL_SDK) >+ auto startTime = WallTime::now(); >+ if (applySandbox(parameters, sandboxParameters, defaultProfilePath)) { >+ auto endTime = WallTime::now(); >+ verboseLog("Apply time: ", (endTime - startTime).milliseconds()); >+ } else { >+#endif >+ switch (sandboxParameters.mode()) { >+ case SandboxInitializationParameters::UseDefaultSandboxProfilePath: >+ case SandboxInitializationParameters::UseOverrideSandboxProfilePath: { >+ String sandboxProfilePath = sandboxParameters.mode() == SandboxInitializationParameters::UseDefaultSandboxProfilePath ? defaultProfilePath : sandboxParameters.overrideSandboxProfilePath(); >+ if (!sandboxProfilePath.isEmpty()) { >+ CString profilePath = FileSystem::fileSystemRepresentation(sandboxProfilePath); >+ char* errorBuf; > #pragma clang diagnostic push > #pragma clang diagnostic ignored "-Wdeprecated-declarations" >- if (sandbox_init_with_parameters(profilePath.data(), SANDBOX_NAMED_EXTERNAL, sandboxParameters.namedParameterArray(), &errorBuf)) { >+ if (sandbox_init_with_parameters(profilePath.data(), SANDBOX_NAMED_EXTERNAL, sandboxParameters.namedParameterArray(), &errorBuf)) { > #pragma clang diagnostic pop >- WTFLogAlways("%s: Couldn't initialize sandbox profile [%s], error '%s'\n", getprogname(), profilePath.data(), errorBuf); >+ WTFLogAlways("%s: Couldn't initialize sandbox profile [%s], error '%s'\n", getprogname(), profilePath.data(), errorBuf); >+ for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i) >+ WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i)); >+ exit(EX_NOPERM); >+ } >+ } >+ >+ break; >+ } >+ case SandboxInitializationParameters::UseSandboxProfile: { >+ char* errorBuf; >+#pragma clang diagnostic push >+#pragma clang diagnostic ignored "-Wdeprecated-declarations" >+ if (sandbox_init_with_parameters(sandboxParameters.sandboxProfile().utf8().data(), 0, sandboxParameters.namedParameterArray(), &errorBuf)) { >+#pragma clang diagnostic pop"WebKitPluginSandbox" WTFLogAlways("%s: Couldn't initialize sandbox profile, error '%s'\n", getprogname(), errorBuf); > for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i) > WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i)); > exit(EX_NOPERM); > } >- } > >- break; >- } >- case SandboxInitializationParameters::UseSandboxProfile: { >- char* errorBuf; >-#pragma clang diagnostic push >-#pragma clang diagnostic ignored "-Wdeprecated-declarations" >- if (sandbox_init_with_parameters(sandboxParameters.sandboxProfile().utf8().data(), 0, sandboxParameters.namedParameterArray(), &errorBuf)) { >-#pragma clang diagnostic pop >- WTFLogAlways("%s: Couldn't initialize sandbox profile, error '%s'\n", getprogname(), errorBuf); >- for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i) >- WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i)); >- exit(EX_NOPERM); >+ break; > } >- >- break; >- } >+ } >+#if USE(APPLE_INTERNAL_SDK) > } >+#endif > > // This will override LSFileQuarantineEnabled from Info.plist unless sandbox quarantine is globally disabled. > OSStatus error = enableSandboxStyleFileQuarantine(); >@@ -225,7 +710,7 @@ void ChildProcess::stopNSAppRunLoop() > ASSERT([NSApp isRunning]); > [NSApp stop:nil]; > >- NSEvent *event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0]; >+ NSEvent* event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0]; > [NSApp postEvent:event atStart:true]; > } > #endif >diff --git a/Source/WebKit/StorageProcess/StorageProcess.h b/Source/WebKit/StorageProcess/StorageProcess.h >index aee510042be..42271d9f138 100644 >--- a/Source/WebKit/StorageProcess/StorageProcess.h >+++ b/Source/WebKit/StorageProcess/StorageProcess.h >@@ -71,6 +71,8 @@ class StorageProcess : public ChildProcess > friend NeverDestroyed<StorageProcess>; > public: > static StorageProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::StorageType; >+ > ~StorageProcess(); > > WorkQueue& queue() { return m_queue.get(); } >diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj >index 6a50721ee22..d01273088f8 100644 >--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj >+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj >@@ -3336,6 +3336,8 @@ > 41897ED51F415D850016FA42 /* CacheStorageEngineConnection.messages.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = CacheStorageEngineConnection.messages.in; sourceTree = "<group>"; }; > 41897ED61F415D860016FA42 /* CacheStorageEngine.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = CacheStorageEngine.cpp; sourceTree = "<group>"; }; > 419ACF9B1F981D26009F1A83 /* WebServiceWorkerFetchTaskClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebServiceWorkerFetchTaskClient.h; sourceTree = "<group>"; }; >+ 41AA59D420D2F94000F3471A /* Storage-OSX.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "Storage-OSX.entitlements"; sourceTree = "<group>"; }; >+ 41AA59D520D2FA5300F3471A /* Network-OSX.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "Network-OSX.entitlements"; sourceTree = "<group>"; }; > 41AC86811E042E5300303074 /* WebRTCResolver.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; lineEnding = 0; name = WebRTCResolver.messages.in; path = Network/webrtc/WebRTCResolver.messages.in; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = "<none>"; }; > 41B28B081F83AD3E00FB52AC /* RTCPacketOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RTCPacketOptions.h; sourceTree = "<group>"; }; > 41B28B091F83AD3E00FB52AC /* RTCPacketOptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RTCPacketOptions.cpp; sourceTree = "<group>"; }; >@@ -5061,6 +5063,7 @@ > 1A4F976C100E7B6600637A18 /* FeatureDefines.xcconfig */, > 37119A7D20CCB64E002C6DC9 /* Network-iOS-minimalsimulator.entitlements */, > 7C0BB9A918DCDF5A0006C086 /* Network-iOS.entitlements */, >+ 41AA59D520D2FA5300F3471A /* Network-OSX.entitlements */, > BC8283AB16B4BEAD00A278FE /* NetworkService.xcconfig */, > A1EDD2DB1884B96400BBFE98 /* PluginProcessShim.xcconfig */, > BC8283F216B4FC5300A278FE /* PluginService.32.xcconfig */, >@@ -5069,6 +5072,7 @@ > 37E83D401B37D27B002079EE /* SandboxProfiles.xcconfig */, > A1EDD2DC1884B9B500BBFE98 /* SecItemShim.xcconfig */, > 5183B3931379F85C00E8754E /* Shim.xcconfig */, >+ 41AA59D420D2F94000F3471A /* Storage-OSX.entitlements */, > 51A60B29180CCD9000F3BF50 /* StorageService.xcconfig */, > 1A4F976E100E7B6600637A18 /* Version.xcconfig */, > 37119A7E20CCB64E002C6DC9 /* WebContent-iOS-minimalsimulator.entitlements */, >@@ -10358,13 +10362,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Unlock keychain"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10376,13 +10376,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Unlock keychain"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10394,13 +10390,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Remove stale entitlement file"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10412,13 +10404,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Remove stale entitlement file"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10430,14 +10418,10 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > "$(TEMP_FILE_DIR)/$(FULL_PRODUCT_NAME).xcent", > ); > name = "Process WebContent entitlements"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10449,14 +10433,10 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > "$(TEMP_FILE_DIR)/$(FULL_PRODUCT_NAME).xcent", > ); > name = "Process WebContent entitlements"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >diff --git a/Source/WebKit/WebProcess/WebProcess.h b/Source/WebKit/WebProcess/WebProcess.h >index b8520acd2bd..be56f4e7b4c 100644 >--- a/Source/WebKit/WebProcess/WebProcess.h >+++ b/Source/WebKit/WebProcess/WebProcess.h >@@ -108,6 +108,7 @@ struct WebsiteDataStoreParameters; > class WebProcess : public ChildProcess { > public: > static WebProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::WebContentType; > > template <typename T> > T* supplement() >diff --git a/Tools/ChangeLog b/Tools/ChangeLog >index c65cefb4ea4..cc0b0dae7ea 100644 >--- a/Tools/ChangeLog >+++ b/Tools/ChangeLog >@@ -1,3 +1,12 @@ >+2018-06-18 Ben Richards <benton_richards@apple.com> >+ >+ Added codes for initialize sandbox >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * Tracing/SystemTracePoints.plist: >+ > 2018-06-18 Zan Dobersek <zdobersek@igalia.com> > > [webkitpy] WPTRunner should remove any metadata content before (re)generating it >diff --git a/Tools/Tracing/SystemTracePoints.plist b/Tools/Tracing/SystemTracePoints.plist >index e9e1776965b..0e1a6783866 100644 >--- a/Tools/Tracing/SystemTracePoints.plist >+++ b/Tools/Tracing/SystemTracePoints.plist >@@ -300,6 +300,18 @@ > <key>CodeEnd</key> > <string>14004</string> > </dict> >+ <dict> >+ <key>Name</key> >+ <string>Initialize Sandbox</string> >+ <key>Type</key> >+ <string>Interval</string> >+ <key>Component</key> >+ <string>47</string> >+ <key>CodeBegin</key> >+ <string>14005</string> >+ <key>CodeEnd</key> >+ <string>14006</string> >+ </dict> > </array> > </dict> > </array>
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=343014">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Flags:
ews-watchlist
:
commit-queue-
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 184991
:
338858
|
338915
|
338951
|
338955
|
338963
|
338968
|
339519
|
342768
|
342781
|
342796
|
342947
|
342973
|
342997
|
343006
|
343012
|
343014
|
343025
|
343051
|
343063
|
343073
|
343094
|
343110
|
343126
|
343354
|
343356
|
343456
|
343554
|
343574
|
343651
|
343655
|
343771
|
343774
|
343776
|
343804
|
344130
|
344805
|
344832
|
345206
|
345287
|
345311
|
345327
|
345377
|
345392
|
345405
|
345588
|
345598
|
346440
|
346558
|
346743
|
346810
|
346841
|
347144
|
347170