WebKit Bugzilla
Attachment 343356 Details for
Bug 184991
: We should cache the compiled sandbox profile in a data vault
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
cache sandbox
cache_sandbox.patch (text/plain), 50.61 KB, created by
Ben Richards
on 2018-06-22 12:50:14 PDT
(
hide
)
Description:
cache sandbox
Filename:
MIME Type:
Creator:
Ben Richards
Created:
2018-06-22 12:50:14 PDT
Size:
50.61 KB
patch
obsolete
>diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog >index 63c500aa2cf..31f3aa09470 100644 >--- a/Source/WTF/ChangeLog >+++ b/Source/WTF/ChangeLog >@@ -1,3 +1,13 @@ >+2018-06-22 Ben Richards <benton_richards@apple.com> >+ >+ Added trace points for sandbox initialization and exposed functions needed for sandbox caching >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * wtf/SystemTracing.h: >+ * wtf/spi/darwin/SandboxSPI.h: >+ > 2018-06-20 Yusuke Suzuki <utatane.tea@gmail.com> > > [GTK][WPE][Nicosia] Add name for Nicosia Painting Threads >diff --git a/Source/WTF/wtf/SystemTracing.h b/Source/WTF/wtf/SystemTracing.h >index b52be8d3868..105196ec487 100644 >--- a/Source/WTF/wtf/SystemTracing.h >+++ b/Source/WTF/wtf/SystemTracing.h >@@ -96,6 +96,8 @@ enum TracePointCode { > CommitLayerTreeEnd, > ProcessLaunchStart, > ProcessLaunchEnd, >+ InitializeSandboxStart, >+ InitializeSandboxEnd, > }; > > #ifdef __cplusplus >diff --git a/Source/WTF/wtf/spi/darwin/SandboxSPI.h b/Source/WTF/wtf/spi/darwin/SandboxSPI.h >index fa18c9ea639..1c3c59523d9 100644 >--- a/Source/WTF/wtf/spi/darwin/SandboxSPI.h >+++ b/Source/WTF/wtf/spi/darwin/SandboxSPI.h >@@ -42,6 +42,18 @@ enum sandbox_filter_type { > > WTF_EXTERN_C_BEGIN > >+typedef struct { >+ char* builtin; >+ unsigned char* data; >+ size_t size; >+} *sandbox_profile_t; >+ >+typedef struct { >+ const char **params; >+ size_t size; >+ size_t available; >+} *sandbox_params_t; >+ > extern const char *const APP_SANDBOX_READ; > extern const char *const APP_SANDBOX_READ_WRITE; > extern const enum sandbox_filter_type SANDBOX_CHECK_NO_REPORT; >@@ -54,6 +66,12 @@ int sandbox_container_path_for_pid(pid_t, char *buffer, size_t bufsize); > int sandbox_extension_release(int64_t extension_handle); > int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); > int64_t sandbox_extension_consume(const char *extension_token); >+sandbox_params_t sandbox_create_params(void); >+int sandbox_set_param(sandbox_params_t, const char *key, const char *value); >+void sandbox_free_params(sandbox_params_t); >+sandbox_profile_t sandbox_compile_file(const char *path, sandbox_params_t, char **error); >+void sandbox_free_profile(sandbox_profile_t); >+int sandbox_apply(sandbox_profile_t); > > WTF_EXTERN_C_END > >diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog >index 02a8eef5f3c..703758e929c 100644 >--- a/Source/WebKit/ChangeLog >+++ b/Source/WebKit/ChangeLog >@@ -1,3 +1,51 @@ >+2018-06-22 Ben Richards <benton_richards@apple.com> >+ >+ Added compiled sandbox caching >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * Configurations/Network-OSX-restricted.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements. >+ * Configurations/Network-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements. >+ * Configurations/NetworkService.xcconfig: >+ * Configurations/Storage-OSX-restricted.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements. >+ * Configurations/Storage-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements. >+ * Configurations/StorageService.xcconfig: >+ * Configurations/WebContent-OSX-restricted.entitlements: >+ * Configurations/WebKit.xcconfig: >+ * NetworkProcess/NetworkProcess.h: >+ * PluginProcess/PluginProcess.h: >+ * Shared/ChildProcess.h: >+ * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h: >+ (WebKit::XPCServiceInitializer): >+ * Shared/SandboxInitializationParameters.h: >+ (WebKit::SandboxInitializationParameters::setOverrideSandboxProfilePath): >+ (WebKit::SandboxInitializationParameters::overrideSandboxProfilePath const): >+ (WebKit::SandboxInitializationParameters::setSandboxProfile): >+ (WebKit::SandboxInitializationParameters::sandboxProfile const): >+ (): Deleted. >+ * Shared/mac/ChildProcessMac.mm: >+ (WebKit::SandboxInfo::SandboxInfo): >+ (WebKit::verboseLog): >+ (WebKit::fileContents): >+ (WebKit::processStorageClass): >+ (WebKit::sandboxHeader): >+ (WebKit::sandboxDirectory): >+ (WebKit::sandboxFilePath): >+ (WebKit::ensureSandboxCacheDirectory): >+ (WebKit::compileAndCacheSandboxProfile): >+ (WebKit::applyCachedSandbox): >+ (WebKit::sandboxProfilePath): >+ (WebKit::applySandbox): >+ (WebKit::initializeSandboxParameters): >+ (WebKit::ChildProcess::initializeSandbox): >+ (WebKit::ChildProcess::stopNSAppRunLoop): >+ * Shared/mac/SandboxInitialiationParametersMac.mm: >+ (WebKit::SandboxInitializationParameters::SandboxInitializationParameters): >+ * StorageProcess/StorageProcess.h: >+ * WebKit.xcodeproj/project.pbxproj: >+ * WebProcess/WebProcess.h: >+ > 2018-06-21 Chris Dumez <cdumez@apple.com> > > Unreviewed, rolling out r232995. >diff --git a/Source/WebKit/Configurations/Network-OSX-restricted.entitlements b/Source/WebKit/Configurations/Network-OSX-restricted.entitlements >new file mode 100644 >index 00000000000..03270566fc5 >--- /dev/null >+++ b/Source/WebKit/Configurations/Network-OSX-restricted.entitlements >@@ -0,0 +1,8 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+ <key>com.apple.rootless.storage.WebKitNetworkingSandbox</key> >+ <true/> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/Network-OSX.entitlements b/Source/WebKit/Configurations/Network-OSX.entitlements >new file mode 100644 >index 00000000000..6631ffa6f24 >--- /dev/null >+++ b/Source/WebKit/Configurations/Network-OSX.entitlements >@@ -0,0 +1,6 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/NetworkService.xcconfig b/Source/WebKit/Configurations/NetworkService.xcconfig >index 5b602d60d8d..51b203e82ef 100644 >--- a/Source/WebKit/Configurations/NetworkService.xcconfig >+++ b/Source/WebKit/Configurations/NetworkService.xcconfig >@@ -32,6 +32,10 @@ WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvos = Network-iOS; > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvsimulator = Network-iOS; > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_iphoneminimalsimulator = Network-iOS-minimalsimulator; > >+NETWORK_ENTITLEMENTS_RESTRICTED_NO = Configurations/Network-OSX.entitlements; >+NETWORK_ENTITLEMENTS_RESTRICTED_YES = Configurations/Network-OSX-restricted.entitlements; >+ >+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = $(NETWORK_ENTITLEMENTS_RESTRICTED_$(WK_USE_RESTRICTED_ENTITLEMENTS)); > OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS); > > PRODUCT_NAME = com.apple.WebKit.Networking; >diff --git a/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements b/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements >new file mode 100644 >index 00000000000..bbb392e80f9 >--- /dev/null >+++ b/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements >@@ -0,0 +1,8 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+ <key>com.apple.rootless.storage.WebKitStorageSandbox</key> >+ <true/> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/Storage-OSX.entitlements b/Source/WebKit/Configurations/Storage-OSX.entitlements >new file mode 100644 >index 00000000000..6631ffa6f24 >--- /dev/null >+++ b/Source/WebKit/Configurations/Storage-OSX.entitlements >@@ -0,0 +1,6 @@ >+<?xml version="1.0" encoding="UTF-8"?> >+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> >+<plist version="1.0"> >+<dict> >+</dict> >+</plist> >diff --git a/Source/WebKit/Configurations/StorageService.xcconfig b/Source/WebKit/Configurations/StorageService.xcconfig >index 75761d808af..e1b01c17922 100644 >--- a/Source/WebKit/Configurations/StorageService.xcconfig >+++ b/Source/WebKit/Configurations/StorageService.xcconfig >@@ -25,6 +25,10 @@ > > WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Databases-iOS; > >+STORAGE_ENTITLEMENTS_RESTRICTED_NO = Configurations/Storage-OSX.entitlements; >+STORAGE_ENTITLEMENTS_RESTRICTED_YES = Configurations/Storage-OSX-restricted.entitlements; >+ >+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = $(STORAGE_ENTITLEMENTS_RESTRICTED_$(WK_USE_RESTRICTED_ENTITLEMENTS)); > OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS); > > PRODUCT_NAME = $(WK_STORAGE_SERVICE_PRODUCT_NAME); >diff --git a/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements b/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements >index 2ad5067206a..3d4bc8c840a 100644 >--- a/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements >+++ b/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements >@@ -7,5 +7,7 @@ > <string>kTCCServiceCamera</string> > <string>kTCCServiceMicrophone</string> > </array> >+ <key>com.apple.rootless.storage.WebKitWebContentSandbox</key> >+ <true/> > </dict> > </plist> >diff --git a/Source/WebKit/Configurations/WebKit.xcconfig b/Source/WebKit/Configurations/WebKit.xcconfig >index 79f44e0517b..6d250e4fa34 100644 >--- a/Source/WebKit/Configurations/WebKit.xcconfig >+++ b/Source/WebKit/Configurations/WebKit.xcconfig >@@ -82,6 +82,9 @@ WK_MOBILE_CORE_SERVICES_LDFLAGS_cocoatouch = -framework MobileCoreServices; > WK_MOBILE_GESTALT_LDFLAGS = $(WK_MOBILE_GESTALT_LDFLAGS_$(WK_COCOA_TOUCH)); > WK_MOBILE_GESTALT_LDFLAGS_cocoatouch = -lMobileGestalt; > >+WK_LIBSANDBOX_LDFLAGS = $(WK_LIBSANDBOX_LDFLAGS_$(WK_PLATFORM_NAME)); >+WK_LIBSANDBOX_LDFLAGS_macosx = -lsandbox; >+ > WK_OPENGL_LDFLAGS = $(WK_OPENGL_LDFLAGS_$(WK_PLATFORM_NAME)); > WK_OPENGL_LDFLAGS_iphoneos = -framework OpenGLES; > WK_OPENGL_LDFLAGS_iphoneminimalsimulator = -framework OpenGL; >@@ -112,7 +115,7 @@ WK_UIKIT_LDFLAGS_cocoatouch = -framework UIKit; > WK_URL_FORMATTING_LDFLAGS = $(WK_URL_FORMATTING_LDFLAGS_$(WK_HAVE_URL_FORMATTING)); > WK_URL_FORMATTING_LDFLAGS_YES = -framework URLFormatting; > >-FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS); >+FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBSANDBOX_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS); > > // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols. > UNEXPORTED_SYMBOL_LDFLAGS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-unexported_symbol -Wl,__Znwm -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSEDn -Wl,-unexported_symbol, -Wl,__ZNKSt3__18functionIFvN7WebCore12PolicyActionEEEclES2_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEE4swapERS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED1Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED2Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSERKS4_ -Wl,-unexported_symbol, -Wl,__ZTVNSt3__117bad_function_callE; >diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.h b/Source/WebKit/NetworkProcess/NetworkProcess.h >index be349319b1a..4c815a56fc8 100644 >--- a/Source/WebKit/NetworkProcess/NetworkProcess.h >+++ b/Source/WebKit/NetworkProcess/NetworkProcess.h >@@ -80,6 +80,7 @@ class NetworkProcess : public ChildProcess, private DownloadManager::Client { > friend NeverDestroyed<DownloadManager>; > public: > static NetworkProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::NetworkType; > > template <typename T> > T* supplement() >diff --git a/Source/WebKit/PluginProcess/PluginProcess.h b/Source/WebKit/PluginProcess/PluginProcess.h >index d5081b061cd..9a8812d9f98 100644 >--- a/Source/WebKit/PluginProcess/PluginProcess.h >+++ b/Source/WebKit/PluginProcess/PluginProcess.h >@@ -49,6 +49,7 @@ class PluginProcess : public ChildProcess > > public: > static PluginProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::PluginType; > > void removeWebProcessConnection(WebProcessConnection*); > >diff --git a/Source/WebKit/Shared/ChildProcess.h b/Source/WebKit/Shared/ChildProcess.h >index b35c9f2e3f3..4f3f794ed64 100644 >--- a/Source/WebKit/Shared/ChildProcess.h >+++ b/Source/WebKit/Shared/ChildProcess.h >@@ -39,22 +39,19 @@ > namespace WebKit { > > class SandboxInitializationParameters; >- >-struct ChildProcessInitializationParameters { >- String uiProcessName; >- String clientIdentifier; >- std::optional<WebCore::ProcessIdentifier> processIdentifier; >- IPC::Connection::Identifier connectionIdentifier; >- HashMap<String, String> extraInitializationData; >-#if PLATFORM(COCOA) >- OSObjectPtr<xpc_object_t> priorityBoostMessage; >-#endif >-}; >+struct ChildProcessInitializationParameters; > > class ChildProcess : protected IPC::Connection::Client, public IPC::MessageSender { > WTF_MAKE_NONCOPYABLE(ChildProcess); > > public: >+ enum class ProcessType { >+ WebContentType, >+ NetworkType, >+ StorageType, >+ PluginType >+ }; >+ > void initialize(const ChildProcessInitializationParameters&); > > // disable and enable termination of the process. when disableTermination is called, the >@@ -147,6 +144,18 @@ private: > #endif > }; > >+struct ChildProcessInitializationParameters { >+ String uiProcessName; >+ String clientIdentifier; >+ std::optional<WebCore::ProcessIdentifier> processIdentifier; >+ IPC::Connection::Identifier connectionIdentifier; >+ HashMap<String, String> extraInitializationData; >+ ChildProcess::ProcessType processType; >+#if PLATFORM(COCOA) >+ OSObjectPtr<xpc_object_t> priorityBoostMessage; >+#endif >+}; >+ > } // namespace WebKit > > #endif // ChildProcess_h >diff --git a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >index 209e20a7549..e62c3a7b3df 100644 >--- a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >+++ b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h >@@ -112,6 +112,8 @@ void XPCServiceInitializer(OSObjectPtr<xpc_connection_t> connection, xpc_object_ > Thread::setGlobalMaxQOSClass(QOS_CLASS_UTILITY); > #endif > >+ parameters.processType = XPCServiceType::processType; >+ > XPCServiceType::singleton().initialize(parameters); > } > >diff --git a/Source/WebKit/Shared/SandboxInitializationParameters.h b/Source/WebKit/Shared/SandboxInitializationParameters.h >index a619b700423..0395c2fdd30 100644 >--- a/Source/WebKit/Shared/SandboxInitializationParameters.h >+++ b/Source/WebKit/Shared/SandboxInitializationParameters.h >@@ -54,7 +54,7 @@ public: > const char* name(size_t index) const; > const char* value(size_t index) const; > >- enum ProfileSelectionMode { >+ enum class ProfileSelectionMode { > UseDefaultSandboxProfilePath, > UseOverrideSandboxProfilePath, > UseSandboxProfile >@@ -64,25 +64,25 @@ public: > > void setOverrideSandboxProfilePath(const String& path) > { >- m_profileSelectionMode = UseOverrideSandboxProfilePath; >+ m_profileSelectionMode = ProfileSelectionMode::UseOverrideSandboxProfilePath; > m_overrideSandboxProfilePathOrSandboxProfile = path; > } > > const String& overrideSandboxProfilePath() const > { >- ASSERT(m_profileSelectionMode == UseOverrideSandboxProfilePath); >+ ASSERT(m_profileSelectionMode == ProfileSelectionMode::UseOverrideSandboxProfilePath); > return m_overrideSandboxProfilePathOrSandboxProfile; > } > > void setSandboxProfile(const String& profile) > { >- m_profileSelectionMode = UseSandboxProfile; >+ m_profileSelectionMode = ProfileSelectionMode::UseSandboxProfile; > m_overrideSandboxProfilePathOrSandboxProfile = profile; > } > > const String& sandboxProfile() const > { >- ASSERT(m_profileSelectionMode == UseSandboxProfile); >+ ASSERT(m_profileSelectionMode == ProfileSelectionMode::UseSandboxProfile); > return m_overrideSandboxProfilePathOrSandboxProfile; > } > >diff --git a/Source/WebKit/Shared/mac/ChildProcessMac.mm b/Source/WebKit/Shared/mac/ChildProcessMac.mm >index aed5b9fd709..485e3bfc65f 100644 >--- a/Source/WebKit/Shared/mac/ChildProcessMac.mm >+++ b/Source/WebKit/Shared/mac/ChildProcessMac.mm >@@ -31,21 +31,31 @@ > #import "CodeSigning.h" > #import "QuarantineSPI.h" > #import "SandboxInitializationParameters.h" >+#import "SandboxUtilities.h" > #import "WKFoundation.h" > #import "XPCServiceEntryPoint.h" > #import <WebCore/FileSystem.h> > #import <WebCore/SystemVersion.h> > #import <mach/mach.h> > #import <mach/task.h> >+#import <pal/crypto/CryptoDigest.h> > #import <pwd.h> > #import <stdlib.h> >+#import <sys/sysctl.h> > #import <sysexits.h> >+#import <wtf/DataLog.h> > #import <wtf/Scope.h> >+#import <wtf/SystemTracing.h> >+#import <wtf/WallTime.h> > #import <wtf/spi/darwin/SandboxSPI.h> >+#import <wtf/text/Base64.h> > > #if USE(APPLE_INTERNAL_SDK) >+#import <rootless.h> > #include <HIServices/ProcessesPriv.h> >-#endif >+#endif // USE(APPLE_INTERNAL_SDK) >+ >+#define VERBOSE_LOGGING false > > typedef bool (^LSServerConnectionAllowedBlock) ( CFDictionaryRef optionsRef ); > extern "C" void _LSSetApplicationLaunchServicesServerConnectionStatus(uint64_t flags, LSServerConnectionAllowedBlock block); >@@ -57,6 +67,40 @@ using namespace WebCore; > > namespace WebKit { > >+using SandboxProfile = typename std::remove_pointer<sandbox_profile_t>::type; >+ >+struct CachedSandboxHeader { >+ uint32_t versionNumber; >+ char osVersion[10]; >+ uint32_t headerSize; >+ uint32_t builtinSize; // If a builtin doesn't exist, this is UINT_MAX >+ uint32_t dataSize; >+}; >+// The file is layed out on disk like: >+// byte 0 >+// CachedSandboxHeader <- sizeof(CachedSandboxHeader) bytes >+// SandboxHeader <- CachedSandboxHeader::sandboxHeaderSize bytes >+// [SandboxBuiltin] optional. Present if CachedSandboxHeader::sanboxBuiltinSize is not UINT_MAX. If present, sandboxBuiltinSize bytes. >+// SandboxData <- CachedSandboxHeader::sandboxDataSize bytes >+// byte N >+ >+struct SandboxInfo { >+ String directoryPath; >+ String filePath; >+ String profilePath; >+ sandbox_params_t sandboxParameters; >+ Vector<uint8_t> header; >+ ChildProcess::ProcessType processType; >+ const SandboxInitializationParameters &initializationParameters; >+ >+ SandboxInfo(const SandboxInitializationParameters ¶meters) >+ : initializationParameters(parameters) >+ { >+ } >+}; >+ >+static constexpr uint32_t CachedSandboxVersionNumber = 0; >+ > static void initializeTimerCoalescingPolicy() > { > // Set task_latency and task_throughput QOS tiers as appropriate for a visible application. >@@ -110,15 +154,433 @@ static OSStatus enableSandboxStyleFileQuarantine() > #endif > } > >-void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters) >+template<typename... Types> >+void verboseLog(const Types&... values) >+{ >+ dataLogLnIf(VERBOSE_LOGGING, values...); >+} >+ >+static std::optional<Vector<char>> fileContents(const String& path) >+{ >+ FileSystem::PlatformFileHandle handle = openFile(path, FileSystem::FileOpenMode::Read); >+ >+ if (handle == FileSystem::invalidPlatformFileHandle) { >+ verboseLog("Can't get file handle for path: ", path); >+ return std::nullopt; >+ } >+ >+ auto closeFileOnExit = makeScopeExit([&] { >+ FileSystem::closeFile(handle); >+ }); >+ >+ long long fileSize; >+ if (!FileSystem::getFileSize(handle, fileSize)) { >+ verboseLog("Could not get size for file: ", path); >+ return std::nullopt; >+ } >+ RELEASE_ASSERT(fileSize >= 0); >+ >+ Vector<char> contents(safeCast<size_t>(fileSize)); >+ int bytesRead = FileSystem::readFromFile(handle, contents.data(), safeCast<size_t>(fileSize)); >+ if (safeCast<int>(fileSize) != bytesRead) { >+ verboseLog("Could not read the file: ", path); >+ return std::nullopt; >+ } >+ >+ return WTFMove(contents); >+} >+ >+#if USE(APPLE_INTERNAL_SDK) >+// These strings must match the last segment of the "com.apple.rootless.storage.<this part must match>" entry in each >+// process's restricted entitlements file (ex. Configurations/Networking-OSX-restricted.entitlements). >+static constexpr const char* processStorageClass(ChildProcess::ProcessType type) >+{ >+ switch (type) { >+ case ChildProcess::ProcessType::WebContentType: >+ return "WebKitWebContentSandbox"; >+ case ChildProcess::ProcessType::NetworkType: >+ return "WebKitNetworkingSandbox"; >+ case ChildProcess::ProcessType::StorageType: >+ return "WebKitStorageSandbox"; >+ case ChildProcess::ProcessType::PluginType: >+ return "WebKitPluginSandbox"; >+ } >+} >+#endif // USE(APPLE_INTERNAL_SDK) >+ >+static std::optional<Vector<uint8_t>> sandboxHeader(const SandboxInitializationParameters& initializationParameters, const SandboxInfo& info) >+{ >+ // Compute the sandbox header size. >+ Vector<CString> headerPieces; >+ Checked<size_t> headerSize = 0; >+ for (size_t i = 0; i < initializationParameters.count(); ++i) { >+ headerPieces.append(initializationParameters.name(i)); >+ auto& name = headerPieces.last(); >+ headerPieces.append(initializationParameters.value(i)); >+ auto& value = headerPieces.last(); >+ >+ if (name.isNull() || value.isNull()) >+ return std::nullopt; >+ if (sandbox_set_param(info.sandboxParameters, name.data(), value.data())) { >+ WTFLogAlways("%s: Couldn't set sandbox parameter, errno: %d\n", getprogname(), errno); >+ CRASH(); >+ } >+ >+ headerSize += name.length() + 1; >+ headerSize += value.length() + 1; >+ } >+ >+ Vector<char> profileContents; >+ if (auto contents = fileContents(info.profilePath)) >+ profileContents = WTFMove(*contents); >+ else >+ return std::nullopt; >+ headerSize += profileContents.size(); >+ >+ // Write out the sandbox header. >+ Vector<uint8_t> header(headerSize.unsafeGet()); >+ for (auto& piece : headerPieces) { >+ header.append(piece.data(), piece.length()); >+ header.append(':'); >+ } >+ header.append(bitwise_cast<uint8_t *>(profileContents.data()), profileContents.size()); >+ >+ return WTFMove(header); >+} >+ >+static inline String sandboxDirectory(ChildProcess::ProcessType processType) >+{ >+ char darwinUserCacheDir[PATH_MAX + 1]; >+ { >+ char temp[PATH_MAX + 1]; >+ if (!confstr(_CS_DARWIN_USER_CACHE_DIR, temp, sizeof(temp))) { >+ WTFLogAlways("%s: couldn't retrieve private cache directory path: %d\n", getprogname(), errno); >+ exit(EX_NOPERM); >+ } >+ if (!realpath(temp, darwinUserCacheDir)) >+ CRASH(); >+ } >+ >+ String directory = darwinUserCacheDir; >+ switch (processType) { >+ case ChildProcess::ProcessType::WebContentType: >+ directory.append("/com.apple.WebKit.WebContent.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::NetworkType: >+ directory.append("/com.apple.WebKit.Networking.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::StorageType: >+ directory.append("/com.apple.WebKit.Storage.Sandbox"); >+ break; >+ case ChildProcess::ProcessType::PluginType: >+ directory.append("/com.apple.WebKit.Plugin.Sandbox"); >+ break; >+ } >+ >+#if !(USE(APPLE_INTERNAL_SDK)) >+ // Add .OpenSource suffix so that non-internal builds don't try to access a data vault used by system Safari >+ directory.append(".OpenSource"); >+#endif // USE(APPLE_INTERNAL_SDK) >+ >+ return directory; >+} >+ >+static inline String sandboxFilePath(const SandboxInfo& info) >+{ >+ String sandboxFile = info.directoryPath; >+ sandboxFile.append("/CompiledSandbox+"); >+ >+ // Make the filename semi-unique based on the contents of the header >+ auto crypto = PAL::CryptoDigest::create(PAL::CryptoDigest::Algorithm::SHA_1); >+ crypto->addBytes(info.header.data(), info.header.size()); >+ Vector<uint8_t> hash = crypto->computeHash(); >+ String readableHash = base64Encode(hash, WTF::Base64URLPolicy); >+ readableHash.replace('/', '_'); >+ >+ sandboxFile.append(readableHash); >+ return sandboxFile; >+} >+ >+static bool ensureSandboxCacheDirectory(const SandboxInfo& info) >+{ >+#if USE(APPLE_INTERNAL_SDK) >+ const char* storageClass = processStorageClass(info.processType); >+#endif // USE(APPLE_INTERNAL_SDK) >+ >+ bool hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes); >+ if (!hasSandboxDirectory) { >+#if USE(APPLE_INTERNAL_SDK) >+ CString directoryPath = FileSystem::fileSystemRepresentation(info.directoryPath); >+ if (directoryPath.isNull()) >+ return false; >+ bool madeDirectory = !rootless_mkdir_datavault(directoryPath.data(), 0700, storageClass); >+#else >+ bool madeDirectory = FileSystem::makeAllDirectories(info.directoryPath); >+#endif >+ if (madeDirectory) { >+ ASSERT(FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes)); >+ verboseLog("Created sandbox directory: ", info.directoryPath); >+ hasSandboxDirectory = true; >+ } else { >+ // We may have raced with someone else making it. That's ok. >+ hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes); >+ } >+ } >+ >+ if (!hasSandboxDirectory) { >+ verboseLog("Bailing because we don't have a sandbox directory"); >+ return false; >+ } >+ >+#if USE(APPLE_INTERNAL_SDK) >+ // Make sure directory is a datavault >+ CString directoryPath = FileSystem::fileSystemRepresentation(info.directoryPath); >+ if (directoryPath.isNull()) >+ return false; >+ if (rootless_check_datavault_flag(directoryPath.data(), storageClass)) { >+ // Directory isn't a datavault, let's convert it to one >+ if (rootless_convert_to_datavault(directoryPath.data(), storageClass)) { >+ verboseLog("Couldn't convert existing directory to datavault"); >+ return false; >+ } >+ } >+#endif >+ >+ return true; >+} >+ >+static SandboxProfile* compileAndCacheSandboxProfile(const SandboxInfo& info) >+{ >+ // Make sure the data vault/directory we want to cache in is good to go >+ if (!ensureSandboxCacheDirectory(info)) >+ return nullptr; >+ >+ // Create a sandbox profile that must be freed by the caller of this function >+ char* error = nullptr; >+ CString profilePath = FileSystem::fileSystemRepresentation(info.profilePath); >+ if (profilePath.isNull()) >+ return nullptr; >+ SandboxProfile* sandboxProfile = sandbox_compile_file(profilePath.data(), info.sandboxParameters, &error); >+ if (!sandboxProfile) { >+ WTFLogAlways("%s: Couldn't compile WebContent sandbox %s\n", getprogname(), error); >+ CRASH(); >+ } >+ >+ // Begin building our file to cache >+ CachedSandboxHeader cachedHeader { >+ CachedSandboxVersionNumber, >+ "", >+ safeCast<uint32_t>(info.header.size()), >+ sandboxProfile->builtin ? safeCast<uint32_t>(strlen(sandboxProfile->builtin)) : std::numeric_limits<uint32_t>::max(), >+ safeCast<uint32_t>(sandboxProfile->size) >+ }; >+ >+ // Make sure to set header OS version >+ size_t osVersionSize = sizeof(CachedSandboxHeader::osVersion); >+ if (sysctlbyname("kern.osversion", cachedHeader.osVersion, &osVersionSize, NULL, 0)) { >+ verboseLog("Couldn't get osversion"); >+ return nullptr; >+ } >+ >+ // Write contents into a temporary vector >+ Vector<char> fileContents; >+ fileContents.append(bitwise_cast<uint8_t *>(&cachedHeader), sizeof(CachedSandboxHeader)); >+ fileContents.append(info.header.data(), info.header.size()); >+ if (sandboxProfile->builtin) >+ fileContents.append(sandboxProfile->builtin, cachedHeader.builtinSize); >+ fileContents.append(sandboxProfile->data, cachedHeader.dataSize); >+ >+ // Find a temporary filename to write to >+ FileSystem::PlatformFileHandle tempHandle; >+ String tempFileString; >+ CString tempFilePath; >+ for (unsigned i = 0; true; ++i) { >+ tempFileString = info.directoryPath; >+ tempFileString.append("/tempfile"); >+ if (i) >+ tempFileString.append(String::number(i)); >+ tempFilePath = FileSystem::fileSystemRepresentation(tempFileString); >+ if (tempFilePath.isNull()) >+ return nullptr; >+ tempHandle = open(tempFilePath.data(), (O_WRONLY | O_CREAT | O_EXCL), 0666); >+ if (tempHandle != FileSystem::invalidPlatformFileHandle) >+ break; >+ if (errno != EEXIST) >+ return nullptr; >+ verboseLog("errno is EEXIST, looping back and trying again: ", tempFileString); >+ } >+ ASSERT(tempHandle != FileSystem::invalidPlatformFileHandle); >+ >+ // Attempt to rename the temporary file to its proper name (this operation is atomic) >+ bool didRenameFile = false; >+ int writeSize = FileSystem::writeToFile(tempHandle, bitwise_cast<const char*>(fileContents.data()), safeCast<int>(fileContents.size())); >+ if (writeSize == safeCast<int>(fileContents.size())) { >+ CString sandboxFilePath = FileSystem::fileSystemRepresentation(info.filePath); >+ if (!sandboxFilePath.isNull()) { >+ // According to POSIX complience requirements, this should not only rename the temporary >+ // file but also overwrite any existing file with the same name atomically. >+ if (!rename(tempFilePath.data(), sandboxFilePath.data())) { >+ didRenameFile = true; >+ verboseLog("Rename succeeded"); >+ } else >+ verboseLog("Rename failed: ", errno); >+ } >+ } else >+ verboseLog("Did not successfully write file temp file: ", tempFilePath); >+ >+ // Clean up >+ FileSystem::closeFile(tempHandle); >+ if (!didRenameFile) >+ FileSystem::deleteFile(tempFileString); >+ >+ return sandboxProfile; >+} >+ >+static bool applyCachedSandbox(const SandboxInfo& info) >+{ >+ Vector<char> cachedSandboxContents; >+ if (auto contents = fileContents(info.filePath)) >+ cachedSandboxContents = WTFMove(*contents); >+ else >+ return false; >+ >+ // Make sure cachedSandboxContents aren't too small to contain CachedSandboxHeader >+ if (sizeof(CachedSandboxHeader) > cachedSandboxContents.size()) >+ return false; >+ >+ // Read CachedSandboxHeader from top of file >+ CachedSandboxHeader cachedSandboxHeader; >+ memcpy(&cachedSandboxHeader, cachedSandboxContents.data(), sizeof(CachedSandboxHeader)); >+ >+ // Verify cached sandbox was compiled for the same OS version >+ char *osVersionBuffer; >+ CString osVersion = CString::newUninitialized(sizeof(CachedSandboxHeader::osVersion), osVersionBuffer); >+ size_t osVersionSize = osVersion.length(); >+ if (sysctlbyname("kern.osversion", osVersionBuffer, &osVersionSize, NULL, 0)) { >+ verboseLog("Couldn't get os version number"); >+ return false; >+ } >+ if (osVersion != cachedSandboxHeader.osVersion) { >+ verboseLog("Cached sandbox is from old OS version"); >+ return false; >+ } >+ >+ // Make sure the sandbox versions match >+ if (cachedSandboxHeader.versionNumber != CachedSandboxVersionNumber) { >+ verboseLog("cached file has old version number: ", cachedSandboxHeader.versionNumber); >+ return false; >+ } >+ >+ // Make sure the cached sandbox is the correct size >+ size_t expectedFileSize = sizeof(CachedSandboxHeader) + cachedSandboxHeader.headerSize + cachedSandboxHeader.dataSize; >+ bool haveBuiltin = cachedSandboxHeader.builtinSize != std::numeric_limits<uint32_t>::max(); >+ if (haveBuiltin) >+ expectedFileSize += cachedSandboxHeader.builtinSize; >+ if (cachedSandboxContents.size() != expectedFileSize) { >+ verboseLog("Cached file has wrong file size."); >+ return false; >+ } >+ if (cachedSandboxHeader.headerSize != info.header.size()) { >+ verboseLog("Sandbox profile header size different from cached header size"); >+ return false; >+ } >+ >+ // Make sure the computed header and the cached header are the same as a final check >+ const char* sandboxHeaderPointer = cachedSandboxContents.data() + sizeof(CachedSandboxHeader); >+ const char* sandboxBuiltinPointer = sandboxHeaderPointer + cachedSandboxHeader.headerSize; >+ const char* sandboxDataPointer = haveBuiltin ? sandboxBuiltinPointer + cachedSandboxHeader.builtinSize : sandboxBuiltinPointer; >+ >+ if (memcmp(info.header.data(), sandboxHeaderPointer, info.header.size())) { >+ verboseLog("Header and cached header do not have the same contents."); >+ return false; >+ } >+ >+ // Start loading a SandboxProfile from the file contents >+ SandboxProfile profile; >+ CString builtin; >+ profile.builtin = nullptr; >+ profile.size = cachedSandboxHeader.dataSize; >+ if (haveBuiltin) { >+ builtin = CString::newUninitialized(cachedSandboxHeader.builtinSize, profile.builtin); >+ if (builtin.isNull()) >+ return false; >+ memcpy(profile.builtin, sandboxBuiltinPointer, cachedSandboxHeader.builtinSize); >+ } >+ profile.data = bitwise_cast<unsigned char*>(sandboxDataPointer); >+ >+ if (sandbox_apply(&profile)) { >+ WTFLogAlways("Could not apply cached sandbox"); >+ return false; >+ } >+ >+ return true; >+} >+ >+static inline String sandboxProfilePath(const SandboxInitializationParameters& parameters) > { > #if WK_API_ENABLED >- NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")]; >+ const static NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")]; > #else >- NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")]; >+ const static NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")]; > #endif >- String defaultProfilePath = [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"]; > >+ switch (parameters.mode()) { >+ case SandboxInitializationParameters::ProfileSelectionMode::UseDefaultSandboxProfilePath: >+ return [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"]; >+ case SandboxInitializationParameters::ProfileSelectionMode::UseOverrideSandboxProfilePath: >+ return parameters.overrideSandboxProfilePath(); >+ case SandboxInitializationParameters::ProfileSelectionMode::UseSandboxProfile: >+ return parameters.sandboxProfile(); >+ } >+} >+ >+static bool applySandbox(const ChildProcessInitializationParameters& parameters, const SandboxInitializationParameters& sandboxParameters) >+{ >+ SandboxInfo info(sandboxParameters); >+ info.processType = parameters.processType; >+ info.profilePath = sandboxProfilePath(sandboxParameters); >+ info.directoryPath = sandboxDirectory(info.processType); >+ info.sandboxParameters = sandbox_create_params(); >+ >+ auto freeParamsOnExit = makeScopeExit([&] { >+ sandbox_free_params(info.sandboxParameters); >+ }); >+ >+ if (info.profilePath.isEmpty()) >+ return false; >+ >+ if (auto header = sandboxHeader(sandboxParameters, info)) { >+ // Order here is important! Header must be set before calling sandboxFilename(info) >+ info.header = WTFMove(*header); >+ info.filePath = sandboxFilePath(info); >+ } else >+ return false; >+ >+ // Try to find a cached version of the sandbox and apply it >+ if (applyCachedSandbox(info)) >+ return true; >+ >+ // We failed to find a valid sandbox on the fs so let's compile and cache one for the next process >+ SandboxProfile* sandboxProfile = nullptr; >+ sandboxProfile = compileAndCacheSandboxProfile(info); >+ if (!sandboxProfile) >+ return false; >+ auto freeSandboxOnExit = makeScopeExit([&] { >+ sandbox_free_profile(sandboxProfile); >+ }); >+ >+ if (sandbox_apply(sandboxProfile)) { >+ verboseLog("Could not apply compiled sandbox!"); >+ WTFLogAlways("%s: Couldn't apply compiled sandbox profile, errno: %d\n", getprogname(), errno); >+ exit(EX_NOPERM); >+ } >+ >+ return true; >+} >+ >+static void initializeSandboxParameters(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters) >+{ >+ // Verify user directory suffix > if (sandboxParameters.userDirectorySuffix().isNull()) { > auto userDirectorySuffix = parameters.extraInitializationData.find("user-directory-suffix"); > if (userDirectorySuffix != parameters.extraInitializationData.end()) >@@ -132,6 +594,7 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& > } > } > >+ // Set OS version parameter > Vector<String> osVersionParts; > String osSystemMarketingVersion = systemMarketingVersion(); > osSystemMarketingVersion.split('.', false, osVersionParts); >@@ -144,13 +607,19 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& > > // Use private temporary and cache directories. > setenv("DIRHELPER_USER_DIR_SUFFIX", FileSystem::fileSystemRepresentation(sandboxParameters.userDirectorySuffix()).data(), 1); >- char temporaryDirectory[PATH_MAX]; >+ char temporaryDirectory[PATH_MAX + 1]; > if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryDirectory, sizeof(temporaryDirectory))) { > WTFLogAlways("%s: couldn't retrieve private temporary directory path: %d\n", getprogname(), errno); > exit(EX_NOPERM); > } > setenv("TMPDIR", temporaryDirectory, 1); > >+#if WK_API_ENABLED >+ NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")]; >+#else >+ NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")]; >+#endif >+ > sandboxParameters.addPathParameter("WEBKIT2_FRAMEWORK_DIR", [[webKit2Bundle bundlePath] stringByDeletingLastPathComponent]); > sandboxParameters.addConfDirectoryParameter("DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR); > sandboxParameters.addConfDirectoryParameter("DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR); >@@ -165,50 +634,25 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& > } > > sandboxParameters.addPathParameter("HOME_DIR", pwd.pw_dir); >- > String path = String::fromUTF8(pwd.pw_dir); > path.append("/Library"); >- >+ String libraryPath = path; > sandboxParameters.addPathParameter("HOME_LIBRARY_DIR", FileSystem::fileSystemRepresentation(path).data()); >- > path.append("/Preferences"); >- > sandboxParameters.addPathParameter("HOME_LIBRARY_PREFERENCES_DIR", FileSystem::fileSystemRepresentation(path).data()); >+} > >- switch (sandboxParameters.mode()) { >- case SandboxInitializationParameters::UseDefaultSandboxProfilePath: >- case SandboxInitializationParameters::UseOverrideSandboxProfilePath: { >- String sandboxProfilePath = sandboxParameters.mode() == SandboxInitializationParameters::UseDefaultSandboxProfilePath ? defaultProfilePath : sandboxParameters.overrideSandboxProfilePath(); >- if (!sandboxProfilePath.isEmpty()) { >- CString profilePath = FileSystem::fileSystemRepresentation(sandboxProfilePath); >- char* errorBuf; >-#pragma clang diagnostic push >-#pragma clang diagnostic ignored "-Wdeprecated-declarations" >- if (sandbox_init_with_parameters(profilePath.data(), SANDBOX_NAMED_EXTERNAL, sandboxParameters.namedParameterArray(), &errorBuf)) { >-#pragma clang diagnostic pop >- WTFLogAlways("%s: Couldn't initialize sandbox profile [%s], error '%s'\n", getprogname(), profilePath.data(), errorBuf); >- for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i) >- WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i)); >- exit(EX_NOPERM); >- } >- } >+void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters) >+{ >+ TraceScope traceScope(InitializeSandboxStart, InitializeSandboxEnd); > >- break; >- } >- case SandboxInitializationParameters::UseSandboxProfile: { >- char* errorBuf; >-#pragma clang diagnostic push >-#pragma clang diagnostic ignored "-Wdeprecated-declarations" >- if (sandbox_init_with_parameters(sandboxParameters.sandboxProfile().utf8().data(), 0, sandboxParameters.namedParameterArray(), &errorBuf)) { >-#pragma clang diagnostic pop >- WTFLogAlways("%s: Couldn't initialize sandbox profile, error '%s'\n", getprogname(), errorBuf); >- for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i) >- WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i)); >- exit(EX_NOPERM); >- } >+ initializeSandboxParameters(parameters, sandboxParameters); > >- break; >- } >+ // Try to apply the sandbox >+ if (!applySandbox(parameters, sandboxParameters)) { >+ // Something is really wrong, we can't continue without our sandbox >+ WTFLogAlways("%s: Unable to apply sandbox\n", getprogname()); >+ CRASH(); > } > > // This will override LSFileQuarantineEnabled from Info.plist unless sandbox quarantine is globally disabled. >@@ -225,7 +669,7 @@ void ChildProcess::stopNSAppRunLoop() > ASSERT([NSApp isRunning]); > [NSApp stop:nil]; > >- NSEvent *event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0]; >+ NSEvent* event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0]; > [NSApp postEvent:event atStart:true]; > } > #endif >diff --git a/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm b/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm >index 6cb4c88a70c..634909da999 100644 >--- a/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm >+++ b/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm >@@ -29,7 +29,7 @@ > namespace WebKit { > > SandboxInitializationParameters::SandboxInitializationParameters() >- : m_profileSelectionMode(UseDefaultSandboxProfilePath) >+ : m_profileSelectionMode(ProfileSelectionMode::UseDefaultSandboxProfilePath) > { > } > >diff --git a/Source/WebKit/StorageProcess/StorageProcess.h b/Source/WebKit/StorageProcess/StorageProcess.h >index aee510042be..42271d9f138 100644 >--- a/Source/WebKit/StorageProcess/StorageProcess.h >+++ b/Source/WebKit/StorageProcess/StorageProcess.h >@@ -71,6 +71,8 @@ class StorageProcess : public ChildProcess > friend NeverDestroyed<StorageProcess>; > public: > static StorageProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::StorageType; >+ > ~StorageProcess(); > > WorkQueue& queue() { return m_queue.get(); } >diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj >index 6a50721ee22..d01273088f8 100644 >--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj >+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj >@@ -3336,6 +3336,8 @@ > 41897ED51F415D850016FA42 /* CacheStorageEngineConnection.messages.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = CacheStorageEngineConnection.messages.in; sourceTree = "<group>"; }; > 41897ED61F415D860016FA42 /* CacheStorageEngine.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = CacheStorageEngine.cpp; sourceTree = "<group>"; }; > 419ACF9B1F981D26009F1A83 /* WebServiceWorkerFetchTaskClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebServiceWorkerFetchTaskClient.h; sourceTree = "<group>"; }; >+ 41AA59D420D2F94000F3471A /* Storage-OSX.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "Storage-OSX.entitlements"; sourceTree = "<group>"; }; >+ 41AA59D520D2FA5300F3471A /* Network-OSX.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = "Network-OSX.entitlements"; sourceTree = "<group>"; }; > 41AC86811E042E5300303074 /* WebRTCResolver.messages.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; lineEnding = 0; name = WebRTCResolver.messages.in; path = Network/webrtc/WebRTCResolver.messages.in; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = "<none>"; }; > 41B28B081F83AD3E00FB52AC /* RTCPacketOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RTCPacketOptions.h; sourceTree = "<group>"; }; > 41B28B091F83AD3E00FB52AC /* RTCPacketOptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RTCPacketOptions.cpp; sourceTree = "<group>"; }; >@@ -5061,6 +5063,7 @@ > 1A4F976C100E7B6600637A18 /* FeatureDefines.xcconfig */, > 37119A7D20CCB64E002C6DC9 /* Network-iOS-minimalsimulator.entitlements */, > 7C0BB9A918DCDF5A0006C086 /* Network-iOS.entitlements */, >+ 41AA59D520D2FA5300F3471A /* Network-OSX.entitlements */, > BC8283AB16B4BEAD00A278FE /* NetworkService.xcconfig */, > A1EDD2DB1884B96400BBFE98 /* PluginProcessShim.xcconfig */, > BC8283F216B4FC5300A278FE /* PluginService.32.xcconfig */, >@@ -5069,6 +5072,7 @@ > 37E83D401B37D27B002079EE /* SandboxProfiles.xcconfig */, > A1EDD2DC1884B9B500BBFE98 /* SecItemShim.xcconfig */, > 5183B3931379F85C00E8754E /* Shim.xcconfig */, >+ 41AA59D420D2F94000F3471A /* Storage-OSX.entitlements */, > 51A60B29180CCD9000F3BF50 /* StorageService.xcconfig */, > 1A4F976E100E7B6600637A18 /* Version.xcconfig */, > 37119A7E20CCB64E002C6DC9 /* WebContent-iOS-minimalsimulator.entitlements */, >@@ -10358,13 +10362,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Unlock keychain"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10376,13 +10376,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Unlock keychain"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10394,13 +10390,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Remove stale entitlement file"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10412,13 +10404,9 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > ); > name = "Remove stale entitlement file"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10430,14 +10418,10 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > "$(TEMP_FILE_DIR)/$(FULL_PRODUCT_NAME).xcent", > ); > name = "Process WebContent entitlements"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >@@ -10449,14 +10433,10 @@ > buildActionMask = 2147483647; > files = ( > ); >- inputFileListPaths = ( >- ); > inputPaths = ( > "$(TEMP_FILE_DIR)/$(FULL_PRODUCT_NAME).xcent", > ); > name = "Process WebContent entitlements"; >- outputFileListPaths = ( >- ); > outputPaths = ( > ); > runOnlyForDeploymentPostprocessing = 0; >diff --git a/Source/WebKit/WebProcess/WebProcess.h b/Source/WebKit/WebProcess/WebProcess.h >index b8520acd2bd..be56f4e7b4c 100644 >--- a/Source/WebKit/WebProcess/WebProcess.h >+++ b/Source/WebKit/WebProcess/WebProcess.h >@@ -108,6 +108,7 @@ struct WebsiteDataStoreParameters; > class WebProcess : public ChildProcess { > public: > static WebProcess& singleton(); >+ static constexpr ProcessType processType = ProcessType::WebContentType; > > template <typename T> > T* supplement() >diff --git a/Tools/ChangeLog b/Tools/ChangeLog >index 8f64e78cf94..d7f6d7039c0 100644 >--- a/Tools/ChangeLog >+++ b/Tools/ChangeLog >@@ -1,3 +1,12 @@ >+2018-06-22 Ben Richards <benton_richards@apple.com> >+ >+ Added trace points for sandbox initialize >+ https://bugs.webkit.org/show_bug.cgi?id=184991 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * Tracing/SystemTracePoints.plist: >+ > 2018-06-21 Daniel Bates <dabates@apple.com> > > EWS for security bugs >diff --git a/Tools/Tracing/SystemTracePoints.plist b/Tools/Tracing/SystemTracePoints.plist >index e9e1776965b..0e1a6783866 100644 >--- a/Tools/Tracing/SystemTracePoints.plist >+++ b/Tools/Tracing/SystemTracePoints.plist >@@ -300,6 +300,18 @@ > <key>CodeEnd</key> > <string>14004</string> > </dict> >+ <dict> >+ <key>Name</key> >+ <string>Initialize Sandbox</string> >+ <key>Type</key> >+ <string>Interval</string> >+ <key>Component</key> >+ <string>47</string> >+ <key>CodeBegin</key> >+ <string>14005</string> >+ <key>CodeEnd</key> >+ <string>14006</string> >+ </dict> > </array> > </dict> > </array>
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=343356">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Flags:
ews-watchlist
:
commit-queue-
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 184991
:
338858
|
338915
|
338951
|
338955
|
338963
|
338968
|
339519
|
342768
|
342781
|
342796
|
342947
|
342973
|
342997
|
343006
|
343012
|
343014
|
343025
|
343051
|
343063
|
343073
|
343094
|
343110
|
343126
|
343354
|
343356
|
343456
|
343554
|
343574
|
343651
|
343655
|
343771
|
343774
|
343776
|
343804
|
344130
|
344805
|
344832
|
345206
|
345287
|
345311
|
345327
|
345377
|
345392
|
345405
|
345588
|
345598
|
346440
|
346558
|
346743
|
346810
|
346841
|
347144
|
347170