Attachment 343554 Details for Bug 184991 – cache sandbox

[patch] cache sandbox

cache_sandbox.patch (text/plain), 48.21 KB, created by Ben Richards on 2018-06-25 16:27:44 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ben Richards

Created: 2018-06-25 16:27:44 PDT

Size: 48.21 KB

patch

obsolete

>diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
>index 5378cb3c436..c4987e9d0ed 100644
>--- a/Source/WTF/ChangeLog
>+++ b/Source/WTF/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-06-25  Ben Richards  <benton_richards@apple.com>
>+
>+        Added trace points for initialize sandbox and exposed functions for sandbox caching
>+        https://bugs.webkit.org/show_bug.cgi?id=184991
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * wtf/SystemTracing.h:
>+        * wtf/spi/darwin/SandboxSPI.h:
>+
> 2018-06-25  Alicia Boya GarcÃa  <aboya@igalia.com>
> 
>         Fix ASAN_ENABLED in GCC
>diff --git a/Source/WTF/wtf/SystemTracing.h b/Source/WTF/wtf/SystemTracing.h
>index b52be8d3868..105196ec487 100644
>--- a/Source/WTF/wtf/SystemTracing.h
>+++ b/Source/WTF/wtf/SystemTracing.h
>@@ -96,6 +96,8 @@ enum TracePointCode {
>     CommitLayerTreeEnd,
>     ProcessLaunchStart,
>     ProcessLaunchEnd,
>+    InitializeSandboxStart,
>+    InitializeSandboxEnd,
> };
> 
> #ifdef __cplusplus
>diff --git a/Source/WTF/wtf/spi/darwin/SandboxSPI.h b/Source/WTF/wtf/spi/darwin/SandboxSPI.h
>index fa18c9ea639..1c3c59523d9 100644
>--- a/Source/WTF/wtf/spi/darwin/SandboxSPI.h
>+++ b/Source/WTF/wtf/spi/darwin/SandboxSPI.h
>@@ -42,6 +42,18 @@ enum sandbox_filter_type {
> 
> WTF_EXTERN_C_BEGIN
> 
>+typedef struct {
>+    char* builtin;
>+    unsigned char* data;
>+    size_t size;
>+} *sandbox_profile_t;
>+
>+typedef struct {
>+    const char **params;
>+    size_t size;
>+    size_t available;
>+} *sandbox_params_t;
>+
> extern const char *const APP_SANDBOX_READ;
> extern const char *const APP_SANDBOX_READ_WRITE;
> extern const enum sandbox_filter_type SANDBOX_CHECK_NO_REPORT;
>@@ -54,6 +66,12 @@ int sandbox_container_path_for_pid(pid_t, char *buffer, size_t bufsize);
> int sandbox_extension_release(int64_t extension_handle);
> int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);
> int64_t sandbox_extension_consume(const char *extension_token);
>+sandbox_params_t sandbox_create_params(void);
>+int sandbox_set_param(sandbox_params_t, const char *key, const char *value);
>+void sandbox_free_params(sandbox_params_t);
>+sandbox_profile_t sandbox_compile_file(const char *path, sandbox_params_t, char **error);
>+void sandbox_free_profile(sandbox_profile_t);
>+int sandbox_apply(sandbox_profile_t);
> 
> WTF_EXTERN_C_END
> 
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 8ea82f1b7c4..6664c88c5c0 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,51 @@
>+2018-06-25  Ben Richards  <benton_richards@apple.com>
>+
>+        Added sandbox caching for faster process initialization
>+        https://bugs.webkit.org/show_bug.cgi?id=184991
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * Configurations/Network-OSX-restricted.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements.
>+        * Configurations/Network-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements.
>+        * Configurations/NetworkService.xcconfig:
>+        * Configurations/Storage-OSX-restricted.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements.
>+        * Configurations/Storage-OSX.entitlements: Copied from Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements.
>+        * Configurations/StorageService.xcconfig:
>+        * Configurations/WebContent-OSX-restricted.entitlements:
>+        * Configurations/WebKit.xcconfig:
>+        * NetworkProcess/NetworkProcess.h:
>+        * PluginProcess/PluginProcess.h:
>+        * Shared/ChildProcess.h:
>+        * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:
>+        (WebKit::XPCServiceInitializer):
>+        * Shared/SandboxInitializationParameters.h:
>+        (WebKit::SandboxInitializationParameters::setOverrideSandboxProfilePath):
>+        (WebKit::SandboxInitializationParameters::overrideSandboxProfilePath const):
>+        (WebKit::SandboxInitializationParameters::setSandboxProfile):
>+        (WebKit::SandboxInitializationParameters::sandboxProfile const):
>+        (): Deleted.
>+        * Shared/mac/ChildProcessMac.mm:
>+        (WebKit::SandboxInfo::SandboxInfo):
>+        (WebKit::verboseLog):
>+        (WebKit::fileContents):
>+        (WebKit::processStorageClass):
>+        (WebKit::sandboxHeader):
>+        (WebKit::sandboxParentDirectory):
>+        (WebKit::sandboxDirectory):
>+        (WebKit::sandboxFilePath):
>+        (WebKit::ensureSandboxCacheDirectory):
>+        (WebKit::compileAndCacheSandboxProfile):
>+        (WebKit::applyCachedSandbox):
>+        (WebKit::sandboxProfilePath):
>+        (WebKit::applySandbox):
>+        (WebKit::initializeSandboxParameters):
>+        (WebKit::ChildProcess::initializeSandbox):
>+        (WebKit::ChildProcess::stopNSAppRunLoop):
>+        * Shared/mac/SandboxInitialiationParametersMac.mm:
>+        (WebKit::SandboxInitializationParameters::SandboxInitializationParameters):
>+        * StorageProcess/StorageProcess.h:
>+        * WebProcess/WebProcess.h:
>+
> 2018-06-25  Chris Dumez  <cdumez@apple.com>
> 
>         Make sure API::IconLoadingClient::getLoadDecisionForIcon()'s completion handler gets called
>diff --git a/Source/WebKit/Configurations/Network-OSX-restricted.entitlements b/Source/WebKit/Configurations/Network-OSX-restricted.entitlements
>new file mode 100644
>index 00000000000..03270566fc5
>--- /dev/null
>+++ b/Source/WebKit/Configurations/Network-OSX-restricted.entitlements
>@@ -0,0 +1,8 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
>+<plist version="1.0">
>+<dict>
>+	<key>com.apple.rootless.storage.WebKitNetworkingSandbox</key>
>+	<true/>
>+</dict>
>+</plist>
>diff --git a/Source/WebKit/Configurations/Network-OSX.entitlements b/Source/WebKit/Configurations/Network-OSX.entitlements
>new file mode 100644
>index 00000000000..6631ffa6f24
>--- /dev/null
>+++ b/Source/WebKit/Configurations/Network-OSX.entitlements
>@@ -0,0 +1,6 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
>+<plist version="1.0">
>+<dict>
>+</dict>
>+</plist>
>diff --git a/Source/WebKit/Configurations/NetworkService.xcconfig b/Source/WebKit/Configurations/NetworkService.xcconfig
>index 5b602d60d8d..7a08f5c7a6e 100644
>--- a/Source/WebKit/Configurations/NetworkService.xcconfig
>+++ b/Source/WebKit/Configurations/NetworkService.xcconfig
>@@ -32,6 +32,10 @@ WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvos = Network-iOS;
> WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_appletvsimulator = Network-iOS;
> WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE_iphoneminimalsimulator = Network-iOS-minimalsimulator;
> 
>+WK_NETWORK_ENTITLEMENTS_RESTRICTED_NO = Configurations/Network-OSX.entitlements;
>+WK_NETWORK_ENTITLEMENTS_RESTRICTED_YES = Configurations/Network-OSX-restricted.entitlements;
>+
>+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = $(WK_NETWORK_ENTITLEMENTS_RESTRICTED_$(WK_USE_RESTRICTED_ENTITLEMENTS));
> OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS);
> 
> PRODUCT_NAME = com.apple.WebKit.Networking;
>diff --git a/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements b/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements
>new file mode 100644
>index 00000000000..bbb392e80f9
>--- /dev/null
>+++ b/Source/WebKit/Configurations/Storage-OSX-restricted.entitlements
>@@ -0,0 +1,8 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
>+<plist version="1.0">
>+<dict>
>+	<key>com.apple.rootless.storage.WebKitStorageSandbox</key>
>+	<true/>
>+</dict>
>+</plist>
>diff --git a/Source/WebKit/Configurations/Storage-OSX.entitlements b/Source/WebKit/Configurations/Storage-OSX.entitlements
>new file mode 100644
>index 00000000000..6631ffa6f24
>--- /dev/null
>+++ b/Source/WebKit/Configurations/Storage-OSX.entitlements
>@@ -0,0 +1,6 @@
>+<?xml version="1.0" encoding="UTF-8"?>
>+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
>+<plist version="1.0">
>+<dict>
>+</dict>
>+</plist>
>diff --git a/Source/WebKit/Configurations/StorageService.xcconfig b/Source/WebKit/Configurations/StorageService.xcconfig
>index 75761d808af..2f4f4aa1849 100644
>--- a/Source/WebKit/Configurations/StorageService.xcconfig
>+++ b/Source/WebKit/Configurations/StorageService.xcconfig
>@@ -25,6 +25,10 @@
> 
> WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Databases-iOS;
> 
>+WK_STORAGE_ENTITLEMENTS_RESTRICTED_NO = Configurations/Storage-OSX.entitlements;
>+WK_STORAGE_ENTITLEMENTS_RESTRICTED_YES = Configurations/Storage-OSX-restricted.entitlements;
>+
>+CODE_SIGN_ENTITLEMENTS_COCOA_TOUCH_NO = $(WK_STORAGE_ENTITLEMENTS_RESTRICTED_$(WK_USE_RESTRICTED_ENTITLEMENTS));
> OTHER_CODE_SIGN_FLAGS = $(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS);
> 
> PRODUCT_NAME = $(WK_STORAGE_SERVICE_PRODUCT_NAME);
>diff --git a/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements b/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements
>index 2ad5067206a..3d4bc8c840a 100644
>--- a/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements
>+++ b/Source/WebKit/Configurations/WebContent-OSX-restricted.entitlements
>@@ -7,5 +7,7 @@
> 		<string>kTCCServiceCamera</string>
> 		<string>kTCCServiceMicrophone</string>
> 	</array>
>+	<key>com.apple.rootless.storage.WebKitWebContentSandbox</key>
>+	<true/>
> </dict>
> </plist>
>diff --git a/Source/WebKit/Configurations/WebKit.xcconfig b/Source/WebKit/Configurations/WebKit.xcconfig
>index 79f44e0517b..6d250e4fa34 100644
>--- a/Source/WebKit/Configurations/WebKit.xcconfig
>+++ b/Source/WebKit/Configurations/WebKit.xcconfig
>@@ -82,6 +82,9 @@ WK_MOBILE_CORE_SERVICES_LDFLAGS_cocoatouch = -framework MobileCoreServices;
> WK_MOBILE_GESTALT_LDFLAGS = $(WK_MOBILE_GESTALT_LDFLAGS_$(WK_COCOA_TOUCH));
> WK_MOBILE_GESTALT_LDFLAGS_cocoatouch = -lMobileGestalt;
> 
>+WK_LIBSANDBOX_LDFLAGS = $(WK_LIBSANDBOX_LDFLAGS_$(WK_PLATFORM_NAME));
>+WK_LIBSANDBOX_LDFLAGS_macosx = -lsandbox;
>+
> WK_OPENGL_LDFLAGS = $(WK_OPENGL_LDFLAGS_$(WK_PLATFORM_NAME));
> WK_OPENGL_LDFLAGS_iphoneos = -framework OpenGLES;
> WK_OPENGL_LDFLAGS_iphoneminimalsimulator = -framework OpenGL;
>@@ -112,7 +115,7 @@ WK_UIKIT_LDFLAGS_cocoatouch = -framework UIKit;
> WK_URL_FORMATTING_LDFLAGS = $(WK_URL_FORMATTING_LDFLAGS_$(WK_HAVE_URL_FORMATTING));
> WK_URL_FORMATTING_LDFLAGS_YES = -framework URLFormatting;
> 
>-FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS);
>+FRAMEWORK_AND_LIBRARY_LDFLAGS = -lobjc -framework CFNetwork -framework CoreAudio -framework CoreFoundation -framework CoreGraphics -framework CoreText -framework Foundation -framework ImageIO -framework IOKit -framework WebKitLegacy -lnetwork $(WK_ACCESSIBILITY_LDFLAGS) $(WK_APPKIT_LDFLAGS) $(WK_ASSERTION_SERVICES_LDFLAGS) $(WK_CARBON_LDFLAGS) $(WK_CORE_PDF_LDFLAGS) $(WK_CORE_PREDICTION_LDFLAGS) $(WK_CORE_SERVICES_LDFLAGS) $(WK_GRAPHICS_SERVICES_LDFLAGS) $(WK_IOSURFACE_LDFLAGS) $(WK_LIBSANDBOX_LDFLAGS) $(WK_LIBWEBRTC_LDFLAGS) $(WK_MOBILE_CORE_SERVICES_LDFLAGS) $(WK_MOBILE_GESTALT_LDFLAGS) $(WK_OPENGL_LDFLAGS) $(WK_PDFKIT_LDFLAGS) $(WK_SAFE_BROWSING_LDFLAGS) $(WK_UIKIT_LDFLAGS) $(WK_URL_FORMATTING_LDFLAGS);
> 
> // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols.
> UNEXPORTED_SYMBOL_LDFLAGS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-unexported_symbol -Wl,__Znwm -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1EOS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSEDn -Wl,-unexported_symbol, -Wl,__ZNKSt3__18functionIFvN7WebCore12PolicyActionEEEclES2_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEE4swapERS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC1ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEC2ERKS4_ -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED1Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEED2Ev -Wl,-unexported_symbol, -Wl,__ZNSt3__18functionIFvN7WebCore12PolicyActionEEEaSERKS4_ -Wl,-unexported_symbol, -Wl,__ZTVNSt3__117bad_function_callE;
>diff --git a/Source/WebKit/NetworkProcess/NetworkProcess.h b/Source/WebKit/NetworkProcess/NetworkProcess.h
>index be349319b1a..4c815a56fc8 100644
>--- a/Source/WebKit/NetworkProcess/NetworkProcess.h
>+++ b/Source/WebKit/NetworkProcess/NetworkProcess.h
>@@ -80,6 +80,7 @@ class NetworkProcess : public ChildProcess, private DownloadManager::Client {
>     friend NeverDestroyed<DownloadManager>;
> public:
>     static NetworkProcess& singleton();
>+    static constexpr ProcessType processType = ProcessType::NetworkType;
> 
>     template <typename T>
>     T* supplement()
>diff --git a/Source/WebKit/PluginProcess/PluginProcess.h b/Source/WebKit/PluginProcess/PluginProcess.h
>index d5081b061cd..9a8812d9f98 100644
>--- a/Source/WebKit/PluginProcess/PluginProcess.h
>+++ b/Source/WebKit/PluginProcess/PluginProcess.h
>@@ -49,6 +49,7 @@ class PluginProcess : public ChildProcess
> 
> public:
>     static PluginProcess& singleton();
>+    static constexpr ProcessType processType = ProcessType::PluginType;
> 
>     void removeWebProcessConnection(WebProcessConnection*);
> 
>diff --git a/Source/WebKit/Shared/ChildProcess.h b/Source/WebKit/Shared/ChildProcess.h
>index b35c9f2e3f3..4f3f794ed64 100644
>--- a/Source/WebKit/Shared/ChildProcess.h
>+++ b/Source/WebKit/Shared/ChildProcess.h
>@@ -39,22 +39,19 @@
> namespace WebKit {
> 
> class SandboxInitializationParameters;
>-
>-struct ChildProcessInitializationParameters {
>-    String uiProcessName;
>-    String clientIdentifier;
>-    std::optional<WebCore::ProcessIdentifier> processIdentifier;
>-    IPC::Connection::Identifier connectionIdentifier;
>-    HashMap<String, String> extraInitializationData;
>-#if PLATFORM(COCOA)
>-    OSObjectPtr<xpc_object_t> priorityBoostMessage;
>-#endif
>-};
>+struct ChildProcessInitializationParameters;
> 
> class ChildProcess : protected IPC::Connection::Client, public IPC::MessageSender {
>     WTF_MAKE_NONCOPYABLE(ChildProcess);
> 
> public:
>+    enum class ProcessType {
>+        WebContentType,
>+        NetworkType,
>+        StorageType,
>+        PluginType
>+    };
>+
>     void initialize(const ChildProcessInitializationParameters&);
> 
>     // disable and enable termination of the process. when disableTermination is called, the
>@@ -147,6 +144,18 @@ private:
> #endif
> };
> 
>+struct ChildProcessInitializationParameters {
>+    String uiProcessName;
>+    String clientIdentifier;
>+    std::optional<WebCore::ProcessIdentifier> processIdentifier;
>+    IPC::Connection::Identifier connectionIdentifier;
>+    HashMap<String, String> extraInitializationData;
>+    ChildProcess::ProcessType processType;
>+#if PLATFORM(COCOA)
>+    OSObjectPtr<xpc_object_t> priorityBoostMessage;
>+#endif
>+};
>+
> } // namespace WebKit
> 
> #endif // ChildProcess_h
>diff --git a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h
>index 5e7ca9ec942..f5e95648418 100644
>--- a/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h
>+++ b/Source/WebKit/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h
>@@ -112,6 +112,8 @@ void XPCServiceInitializer(OSObjectPtr<xpc_connection_t> connection, xpc_object_
>         Thread::setGlobalMaxQOSClass(QOS_CLASS_UTILITY);
> #endif
> 
>+    parameters.processType = XPCServiceType::processType;
>+
>     XPCServiceType::singleton().initialize(parameters);
> }
> 
>diff --git a/Source/WebKit/Shared/SandboxInitializationParameters.h b/Source/WebKit/Shared/SandboxInitializationParameters.h
>index a619b700423..0395c2fdd30 100644
>--- a/Source/WebKit/Shared/SandboxInitializationParameters.h
>+++ b/Source/WebKit/Shared/SandboxInitializationParameters.h
>@@ -54,7 +54,7 @@ public:
>     const char* name(size_t index) const;
>     const char* value(size_t index) const;
> 
>-    enum ProfileSelectionMode {
>+    enum class ProfileSelectionMode {
>         UseDefaultSandboxProfilePath,
>         UseOverrideSandboxProfilePath,
>         UseSandboxProfile
>@@ -64,25 +64,25 @@ public:
> 
>     void setOverrideSandboxProfilePath(const String& path)
>     {
>-        m_profileSelectionMode = UseOverrideSandboxProfilePath;
>+        m_profileSelectionMode = ProfileSelectionMode::UseOverrideSandboxProfilePath;
>         m_overrideSandboxProfilePathOrSandboxProfile = path;
>     }
> 
>     const String& overrideSandboxProfilePath() const
>     {
>-        ASSERT(m_profileSelectionMode == UseOverrideSandboxProfilePath);
>+        ASSERT(m_profileSelectionMode == ProfileSelectionMode::UseOverrideSandboxProfilePath);
>         return m_overrideSandboxProfilePathOrSandboxProfile;
>     }
> 
>     void setSandboxProfile(const String& profile)
>     {
>-        m_profileSelectionMode = UseSandboxProfile;
>+        m_profileSelectionMode = ProfileSelectionMode::UseSandboxProfile;
>         m_overrideSandboxProfilePathOrSandboxProfile = profile;
>     }
> 
>     const String& sandboxProfile() const
>     {
>-        ASSERT(m_profileSelectionMode == UseSandboxProfile);
>+        ASSERT(m_profileSelectionMode == ProfileSelectionMode::UseSandboxProfile);
>         return m_overrideSandboxProfilePathOrSandboxProfile;
>     }
> 
>diff --git a/Source/WebKit/Shared/mac/ChildProcessMac.mm b/Source/WebKit/Shared/mac/ChildProcessMac.mm
>index aed5b9fd709..0e549658988 100644
>--- a/Source/WebKit/Shared/mac/ChildProcessMac.mm
>+++ b/Source/WebKit/Shared/mac/ChildProcessMac.mm
>@@ -31,21 +31,31 @@
> #import "CodeSigning.h"
> #import "QuarantineSPI.h"
> #import "SandboxInitializationParameters.h"
>+#import "SandboxUtilities.h"
> #import "WKFoundation.h"
> #import "XPCServiceEntryPoint.h"
> #import <WebCore/FileSystem.h>
> #import <WebCore/SystemVersion.h>
> #import <mach/mach.h>
> #import <mach/task.h>
>+#import <pal/crypto/CryptoDigest.h>
> #import <pwd.h>
> #import <stdlib.h>
>+#import <sys/sysctl.h>
> #import <sysexits.h>
>+#import <wtf/DataLog.h>
> #import <wtf/Scope.h>
>+#import <wtf/SystemTracing.h>
>+#import <wtf/WallTime.h>
> #import <wtf/spi/darwin/SandboxSPI.h>
>+#import <wtf/text/Base64.h>
> 
> #if USE(APPLE_INTERNAL_SDK)
>+#import <rootless.h>
> #include <HIServices/ProcessesPriv.h>
>-#endif
>+#endif // USE(APPLE_INTERNAL_SDK)
>+
>+#define VERBOSE_LOGGING false
> 
> typedef bool (^LSServerConnectionAllowedBlock) ( CFDictionaryRef optionsRef );
> extern "C" void _LSSetApplicationLaunchServicesServerConnectionStatus(uint64_t flags, LSServerConnectionAllowedBlock block);
>@@ -57,6 +67,40 @@ using namespace WebCore;
> 
> namespace WebKit {
> 
>+using SandboxProfile = typename std::remove_pointer<sandbox_profile_t>::type;
>+
>+struct CachedSandboxHeader {
>+    uint32_t versionNumber;
>+    char osVersion[10];
>+    uint32_t headerSize;
>+    uint32_t builtinSize; // If a builtin doesn't exist, this is UINT_MAX
>+    uint32_t dataSize;
>+};
>+// The file is layed out on disk like:
>+// byte 0
>+// CachedSandboxHeader <- sizeof(CachedSandboxHeader) bytes
>+// SandboxHeader <- CachedSandboxHeader::sandboxHeaderSize bytes
>+// [SandboxBuiltin] optional. Present if CachedSandboxHeader::sanboxBuiltinSize is not UINT_MAX. If present, sandboxBuiltinSize bytes.
>+// SandboxData <- CachedSandboxHeader::sandboxDataSize bytes
>+// byte N
>+
>+struct SandboxInfo {
>+    String directoryPath;
>+    String filePath;
>+    String profilePath;
>+    sandbox_params_t sandboxParameters;
>+    Vector<uint8_t> header;
>+    ChildProcess::ProcessType processType;
>+    const SandboxInitializationParameters &initializationParameters;
>+
>+    SandboxInfo(const SandboxInitializationParameters &parameters)
>+        : initializationParameters(parameters)
>+    {
>+    }
>+};
>+
>+static constexpr uint32_t CachedSandboxVersionNumber = 0;
>+
> static void initializeTimerCoalescingPolicy()
> {
>     // Set task_latency and task_throughput QOS tiers as appropriate for a visible application.
>@@ -110,15 +154,476 @@ static OSStatus enableSandboxStyleFileQuarantine()
> #endif
> }
> 
>-void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
>+template<typename... Types>
>+void verboseLog(const Types&... values)
>+{
>+    dataLogLnIf(VERBOSE_LOGGING, values...);
>+}
>+
>+static std::optional<Vector<char>> fileContents(const String& path)
>+{
>+    FileSystem::PlatformFileHandle handle = openFile(path, FileSystem::FileOpenMode::Read);
>+
>+    if (handle == FileSystem::invalidPlatformFileHandle) {
>+        verboseLog("Can't get file handle for path: ", path);
>+        return std::nullopt;
>+    }
>+
>+    auto closeFileOnExit = makeScopeExit([&] {
>+        FileSystem::closeFile(handle);
>+    });
>+
>+    long long fileSize;
>+    if (!FileSystem::getFileSize(handle, fileSize)) {
>+        verboseLog("Could not get size for file: ", path);
>+        return std::nullopt;
>+    }
>+    RELEASE_ASSERT(fileSize >= 0);
>+
>+    Vector<char> contents(safeCast<size_t>(fileSize));
>+    int bytesRead = FileSystem::readFromFile(handle, contents.data(), safeCast<size_t>(fileSize));
>+    if (safeCast<int>(fileSize) != bytesRead) {
>+        verboseLog("Could not read the file: ", path);
>+        return std::nullopt;
>+    }
>+
>+    return WTFMove(contents);
>+}
>+
>+#if USE(APPLE_INTERNAL_SDK)
>+// These strings must match the last segment of the "com.apple.rootless.storage.<this part must match>" entry in each
>+// process's restricted entitlements file (ex. Configurations/Networking-OSX-restricted.entitlements).
>+static constexpr const char* processStorageClass(ChildProcess::ProcessType type)
>+{
>+    switch (type) {
>+    case ChildProcess::ProcessType::WebContentType:
>+        return "WebKitWebContentSandbox";
>+    case ChildProcess::ProcessType::NetworkType:
>+        return "WebKitNetworkingSandbox";
>+    case ChildProcess::ProcessType::StorageType:
>+        return "WebKitStorageSandbox";
>+    case ChildProcess::ProcessType::PluginType:
>+        return "WebKitPluginSandbox";
>+    }
>+}
>+#endif // USE(APPLE_INTERNAL_SDK)
>+
>+static std::optional<Vector<uint8_t>> sandboxHeader(const SandboxInitializationParameters& initializationParameters, const SandboxInfo& info)
>+{
>+    // Compute the sandbox header size.
>+    Vector<CString> headerPieces;
>+    Checked<size_t> headerSize = 0;
>+    for (size_t i = 0; i < initializationParameters.count(); ++i) {
>+        headerPieces.append(initializationParameters.name(i));
>+        auto& name = headerPieces.last();
>+        headerPieces.append(initializationParameters.value(i));
>+        auto& value = headerPieces.last();
>+
>+        if (name.isNull() || value.isNull())
>+            return std::nullopt;
>+        if (sandbox_set_param(info.sandboxParameters, name.data(), value.data())) {
>+            WTFLogAlways("%s: Couldn't set sandbox parameter, errno: %d\n", getprogname(), errno);
>+            CRASH();
>+        }
>+
>+        headerSize += name.length() + 1;
>+        headerSize += value.length() + 1;
>+    }
>+
>+    Vector<char> profileContents;
>+    if (auto contents = fileContents(info.profilePath))
>+        profileContents = WTFMove(*contents);
>+    else
>+        return std::nullopt;
>+    headerSize += profileContents.size();
>+
>+    // Write out the sandbox header.
>+    Vector<uint8_t> header(headerSize.unsafeGet());
>+    for (auto& piece : headerPieces) {
>+        header.append(piece.data(), piece.length());
>+        header.append(':');
>+    }
>+    header.append(bitwise_cast<uint8_t *>(profileContents.data()), profileContents.size());
>+
>+    return WTFMove(header);
>+}
>+
>+static inline String sandboxParentDirectory()
>+{
>+    char darwinUserCacheDir[PATH_MAX + 1];
>+    {
>+        char temp[PATH_MAX + 1];
>+        if (!confstr(_CS_DARWIN_USER_CACHE_DIR, temp, sizeof(temp))) {
>+            WTFLogAlways("%s: couldn't retrieve private cache directory path: %d\n", getprogname(), errno);
>+            exit(EX_NOPERM);
>+        }
>+        if (!realpath(temp, darwinUserCacheDir))
>+            CRASH();
>+    }
>+
>+    return darwinUserCacheDir;
>+}
>+
>+static inline String sandboxDirectory(ChildProcess::ProcessType processType)
>+{
>+    String directory = sandboxParentDirectory();
>+    switch (processType) {
>+    case ChildProcess::ProcessType::WebContentType:
>+        directory.append("/com.apple.WebKit.WebContent.Sandbox");
>+        break;
>+    case ChildProcess::ProcessType::NetworkType:
>+        directory.append("/com.apple.WebKit.Networking.Sandbox");
>+        break;
>+    case ChildProcess::ProcessType::StorageType:
>+        directory.append("/com.apple.WebKit.Storage.Sandbox");
>+        break;
>+    case ChildProcess::ProcessType::PluginType:
>+        directory.append("/com.apple.WebKit.Plugin.Sandbox");
>+        break;
>+    }
>+
>+#if !(USE(APPLE_INTERNAL_SDK))
>+    // Add .OpenSource suffix so that non-internal builds don't try to access a data vault used by system Safari
>+    directory.append(".OpenSource");
>+#endif // USE(APPLE_INTERNAL_SDK)
>+
>+    return directory;
>+}
>+
>+static inline String sandboxFilePath(const SandboxInfo& info)
>+{
>+    String sandboxFile = info.directoryPath;
>+    sandboxFile.append("/CompiledSandbox+");
>+
>+    // Make the filename semi-unique based on the contents of the header
>+    auto crypto = PAL::CryptoDigest::create(PAL::CryptoDigest::Algorithm::SHA_1);
>+    crypto->addBytes(info.header.data(), info.header.size());
>+    Vector<uint8_t> hash = crypto->computeHash();
>+    String readableHash = base64Encode(hash, WTF::Base64URLPolicy);
>+    readableHash.replace('/', '_');
>+
>+    sandboxFile.append(readableHash);
>+    return sandboxFile;
>+}
>+
>+static bool ensureSandboxCacheDirectory(const SandboxInfo& info)
>+{
>+    // First we need to ensure that at least the parent directory exists
>+    String parentDirectory = sandboxParentDirectory();
>+    if (!FileSystem::fileIsDirectory(parentDirectory, FileSystem::ShouldFollowSymbolicLinks::Yes)) {
>+        FileSystem::makeAllDirectories(parentDirectory);
>+        if (!FileSystem::fileIsDirectory(parentDirectory, FileSystem::ShouldFollowSymbolicLinks::Yes)) {
>+            WTFLogAlways("Couldn't create sandbox directory. Crashing.");
>+            CRASH();
>+        }
>+    }
>+
>+#if USE(APPLE_INTERNAL_SDK)
>+    const char* storageClass = processStorageClass(info.processType);
>+    CString directoryPath = FileSystem::fileSystemRepresentation(info.directoryPath);
>+    if (directoryPath.isNull())
>+        return false;
>+
>+    // First just try to make the data vault
>+    if (!rootless_mkdir_datavault(directoryPath.data(), 0700, storageClass)) {
>+        // We successfully made the data vault so we're good to go
>+        return true;
>+    }
>+
>+    // Check to see why it failed
>+    if (errno == EEXIST) {
>+        // Ok the directory already exists, we need to make sure we're the one's who created it
>+        if (!rootless_check_datavault_flag(directoryPath.data(), storageClass)) {
>+            // Good to go, we're the ones who created the data vault
>+            return true;
>+        }
>+
>+        // Someone must have put a directory here with the same name, we'll try moving it aside
>+        WTFLogAlways("\"%s\" is using a reserved path. Attempting to move it to \"%s.Invalid\"", directoryPath.data(), directoryPath.data());
>+        String movedDirectory = info.directoryPath + ".Invalid";
>+        CString movedDirectoryPath = FileSystem::fileSystemRepresentation(movedDirectory);
>+        if (rename(directoryPath.data(), movedDirectoryPath.data())) {
>+            // Too many unlikely bad things have happened here so let's just give up
>+            WTFLogAlways("Move of invalid directory \"%s\" to \"%s.Invalid\" failed. Crashing.", directoryPath.data(), directoryPath.data());
>+            CRASH();
>+        }
>+        WTFLogAlways("\"%s\" moved successfully to \"%s.Invalid\"", directoryPath.data(), directoryPath.data());
>+
>+        // We were able to move the old directory so let's try to make a valid one
>+        if (rootless_mkdir_datavault(directoryPath.data(), 0700, storageClass)) {
>+            // A malicious program could be fighting us here so let's crash
>+            WTFLogAlways("Couldn't create sandbox directory. Crashing.");
>+            CRASH();
>+        }
>+    } else {
>+        WTFLogAlways("Sandbox directory couldn't be created, errno: %d", errno);
>+        CRASH();
>+    }
>+#else
>+    bool hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes);
>+    if (!hasSandboxDirectory) {
>+        if (FileSystem::makeAllDirectories(info.directoryPath)) {
>+            ASSERT(FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes));
>+            verboseLog("Created sandbox directory: ", info.directoryPath);
>+            hasSandboxDirectory = true;
>+        } else {
>+            // We may have raced with someone else making it. That's ok.
>+            hasSandboxDirectory = FileSystem::fileIsDirectory(info.directoryPath, FileSystem::ShouldFollowSymbolicLinks::Yes);
>+        }
>+    }
>+
>+    if (!hasSandboxDirectory) {
>+        verboseLog("Bailing because we don't have a sandbox directory");
>+        return false;
>+    }
>+#endif // USE(APPLE_INTERNAL_SDK)
>+
>+    return true;
>+}
>+
>+static SandboxProfile* compileAndCacheSandboxProfile(const SandboxInfo& info)
>+{
>+    // Make sure the data vault/directory we want to cache in is good to go
>+    if (!ensureSandboxCacheDirectory(info))
>+        return nullptr;
>+
>+    // Create a sandbox profile that must be freed by the caller of this function
>+    char* error = nullptr;
>+    CString profilePath = FileSystem::fileSystemRepresentation(info.profilePath);
>+    if (profilePath.isNull())
>+        return nullptr;
>+    SandboxProfile* sandboxProfile = sandbox_compile_file(profilePath.data(), info.sandboxParameters, &error);
>+    if (!sandboxProfile) {
>+        WTFLogAlways("%s: Couldn't compile WebContent sandbox %s\n", getprogname(), error);
>+        CRASH();
>+    }
>+
>+    // Begin building our file to cache
>+    CachedSandboxHeader cachedHeader {
>+        CachedSandboxVersionNumber,
>+        "",
>+        safeCast<uint32_t>(info.header.size()),
>+        sandboxProfile->builtin ? safeCast<uint32_t>(strlen(sandboxProfile->builtin)) : std::numeric_limits<uint32_t>::max(),
>+        safeCast<uint32_t>(sandboxProfile->size)
>+    };
>+
>+    // Make sure to set header OS version
>+    size_t osVersionSize = sizeof(CachedSandboxHeader::osVersion);
>+    if (sysctlbyname("kern.osversion", cachedHeader.osVersion, &osVersionSize, NULL, 0)) {
>+        verboseLog("Couldn't get osversion");
>+        return nullptr;
>+    }
>+
>+    // Write contents into a temporary vector
>+    Vector<char> fileContents;
>+    fileContents.append(bitwise_cast<uint8_t *>(&cachedHeader), sizeof(CachedSandboxHeader));
>+    fileContents.append(info.header.data(), info.header.size());
>+    if (sandboxProfile->builtin)
>+        fileContents.append(sandboxProfile->builtin, cachedHeader.builtinSize);
>+    fileContents.append(sandboxProfile->data, cachedHeader.dataSize);
>+
>+    // Find a temporary filename to write to
>+    FileSystem::PlatformFileHandle tempHandle;
>+    String tempFileString;
>+    CString tempFilePath;
>+    for (unsigned i = 0; true; ++i) {
>+        tempFileString = info.directoryPath;
>+        tempFileString.append("/tempfile");
>+        if (i)
>+            tempFileString.append(String::number(i));
>+        tempFilePath = FileSystem::fileSystemRepresentation(tempFileString);
>+        if (tempFilePath.isNull())
>+            return nullptr;
>+        tempHandle = open(tempFilePath.data(), (O_WRONLY | O_CREAT | O_EXCL), 0666);
>+        if (tempHandle != FileSystem::invalidPlatformFileHandle)
>+            break;
>+        if (errno != EEXIST)
>+            return nullptr;
>+        verboseLog("errno is EEXIST, looping back and trying again: ", tempFileString);
>+    }
>+    ASSERT(tempHandle != FileSystem::invalidPlatformFileHandle);
>+
>+    // Attempt to rename the temporary file to its proper name (this operation is atomic)
>+    bool didRenameFile = false;
>+    int writeSize = FileSystem::writeToFile(tempHandle, bitwise_cast<const char*>(fileContents.data()), safeCast<int>(fileContents.size()));
>+    if (writeSize == safeCast<int>(fileContents.size())) {
>+        CString sandboxFilePath = FileSystem::fileSystemRepresentation(info.filePath);
>+        if (!sandboxFilePath.isNull()) {
>+            // According to POSIX complience requirements, this should not only rename the temporary
>+            // file but also overwrite any existing file with the same name atomically.
>+            if (!rename(tempFilePath.data(), sandboxFilePath.data())) {
>+                didRenameFile = true;
>+                verboseLog("Rename succeeded");
>+            } else
>+                verboseLog("Rename failed: ", errno);
>+        }
>+    } else
>+        verboseLog("Did not successfully write file temp file: ", tempFilePath);
>+
>+    // Clean up
>+    FileSystem::closeFile(tempHandle);
>+    if (!didRenameFile)
>+        FileSystem::deleteFile(tempFileString);
>+
>+    return sandboxProfile;
>+}
>+
>+static bool applyCachedSandbox(const SandboxInfo& info)
>+{
>+#if USE(APPLE_INTERNAL_SDK)
>+    // Need to make sure the sandbox directory is a data vault for security reasons
>+    CString directoryPath = FileSystem::fileSystemRepresentation(info.directoryPath);
>+    if (directoryPath.isNull())
>+        return false;
>+    if (rootless_check_datavault_flag(directoryPath.data(), processStorageClass(info.processType))) {
>+        // Directory isn't a datavault so we didn't put it there
>+        return false;
>+    }
>+#endif
>+
>+    Vector<char> cachedSandboxContents;
>+    if (auto contents = fileContents(info.filePath))
>+        cachedSandboxContents = WTFMove(*contents);
>+    else
>+        return false;
>+
>+    // Make sure cachedSandboxContents aren't too small to contain CachedSandboxHeader
>+    if (sizeof(CachedSandboxHeader) > cachedSandboxContents.size())
>+        return false;
>+
>+    // Read CachedSandboxHeader from top of file
>+    CachedSandboxHeader cachedSandboxHeader;
>+    memcpy(&cachedSandboxHeader, cachedSandboxContents.data(), sizeof(CachedSandboxHeader));
>+
>+    // Verify cached sandbox was compiled for the same OS version
>+    char *osVersionBuffer;
>+    CString osVersion = CString::newUninitialized(sizeof(CachedSandboxHeader::osVersion), osVersionBuffer);
>+    size_t osVersionSize = osVersion.length();
>+    if (sysctlbyname("kern.osversion", osVersionBuffer, &osVersionSize, NULL, 0)) {
>+        verboseLog("Couldn't get os version number");
>+        return false;
>+    }
>+    if (osVersion != cachedSandboxHeader.osVersion) {
>+        verboseLog("Cached sandbox is from old OS version");
>+        return false;
>+    }
>+
>+    // Make sure the sandbox versions match
>+    if (cachedSandboxHeader.versionNumber != CachedSandboxVersionNumber) {
>+        verboseLog("cached file has old version number: ", cachedSandboxHeader.versionNumber);
>+        return false;
>+    }
>+
>+    // Make sure the cached sandbox is the correct size
>+    size_t expectedFileSize = sizeof(CachedSandboxHeader) + cachedSandboxHeader.headerSize + cachedSandboxHeader.dataSize;
>+    bool haveBuiltin = cachedSandboxHeader.builtinSize != std::numeric_limits<uint32_t>::max();
>+    if (haveBuiltin)
>+        expectedFileSize += cachedSandboxHeader.builtinSize;
>+    if (cachedSandboxContents.size() != expectedFileSize) {
>+        verboseLog("Cached file has wrong file size.");
>+        return false;
>+    }
>+    if (cachedSandboxHeader.headerSize != info.header.size()) {
>+        verboseLog("Sandbox profile header size different from cached header size");
>+        return false;
>+    }
>+
>+    // Make sure the computed header and the cached header are the same as a final check
>+    const char* sandboxHeaderPointer = cachedSandboxContents.data() + sizeof(CachedSandboxHeader);
>+    const char* sandboxBuiltinPointer = sandboxHeaderPointer + cachedSandboxHeader.headerSize;
>+    const char* sandboxDataPointer = haveBuiltin ? sandboxBuiltinPointer + cachedSandboxHeader.builtinSize : sandboxBuiltinPointer;
>+
>+    if (memcmp(info.header.data(), sandboxHeaderPointer, info.header.size())) {
>+        verboseLog("Header and cached header do not have the same contents.");
>+        return false;
>+    }
>+
>+    // Start loading a SandboxProfile from the file contents
>+    SandboxProfile profile;
>+    CString builtin;
>+    profile.builtin = nullptr;
>+    profile.size = cachedSandboxHeader.dataSize;
>+    if (haveBuiltin) {
>+        builtin = CString::newUninitialized(cachedSandboxHeader.builtinSize, profile.builtin);
>+        if (builtin.isNull())
>+            return false;
>+        memcpy(profile.builtin, sandboxBuiltinPointer, cachedSandboxHeader.builtinSize);
>+    }
>+    profile.data = bitwise_cast<unsigned char*>(sandboxDataPointer);
>+
>+    if (sandbox_apply(&profile)) {
>+        WTFLogAlways("Could not apply cached sandbox");
>+        return false;
>+    }
>+
>+    return true;
>+}
>+
>+static inline String sandboxProfilePath(const SandboxInitializationParameters& parameters)
> {
> #if WK_API_ENABLED
>-    NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")];
>+    const static NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")];
> #else
>-    NSBundle *webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")];
>+    const static NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")];
> #endif
>-    String defaultProfilePath = [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"];
> 
>+    switch (parameters.mode()) {
>+    case SandboxInitializationParameters::ProfileSelectionMode::UseDefaultSandboxProfilePath:
>+        return [webKit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"];
>+    case SandboxInitializationParameters::ProfileSelectionMode::UseOverrideSandboxProfilePath:
>+        return parameters.overrideSandboxProfilePath();
>+    case SandboxInitializationParameters::ProfileSelectionMode::UseSandboxProfile:
>+        return parameters.sandboxProfile();
>+    }
>+}
>+
>+static bool applySandbox(const ChildProcessInitializationParameters& parameters, const SandboxInitializationParameters& sandboxParameters)
>+{
>+    SandboxInfo info(sandboxParameters);
>+    info.processType = parameters.processType;
>+    info.profilePath = sandboxProfilePath(sandboxParameters);
>+    info.directoryPath = sandboxDirectory(info.processType);
>+    info.sandboxParameters = sandbox_create_params();
>+
>+    auto freeParamsOnExit = makeScopeExit([&] {
>+        sandbox_free_params(info.sandboxParameters);
>+    });
>+
>+    if (info.profilePath.isEmpty())
>+        return false;
>+
>+    if (auto header = sandboxHeader(sandboxParameters, info)) {
>+        // Order here is important! Header must be set before calling sandboxFilename(info)
>+        info.header = WTFMove(*header);
>+        info.filePath = sandboxFilePath(info);
>+    } else
>+        return false;
>+
>+    // Try to find a cached version of the sandbox and apply it
>+    if (applyCachedSandbox(info))
>+        return true;
>+
>+    // We failed to find a valid sandbox on the fs so let's compile and cache one for the next process
>+    SandboxProfile* sandboxProfile = nullptr;
>+    sandboxProfile = compileAndCacheSandboxProfile(info);
>+    if (!sandboxProfile)
>+        return false;
>+    auto freeSandboxOnExit = makeScopeExit([&] {
>+        sandbox_free_profile(sandboxProfile);
>+    });
>+
>+    if (sandbox_apply(sandboxProfile)) {
>+        verboseLog("Could not apply compiled sandbox!");
>+        WTFLogAlways("%s: Couldn't apply compiled sandbox profile, errno: %d\n", getprogname(), errno);
>+        exit(EX_NOPERM);
>+    }
>+
>+    return true;
>+}
>+
>+static void initializeSandboxParameters(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
>+{
>+    // Verify user directory suffix
>     if (sandboxParameters.userDirectorySuffix().isNull()) {
>         auto userDirectorySuffix = parameters.extraInitializationData.find("user-directory-suffix");
>         if (userDirectorySuffix != parameters.extraInitializationData.end())
>@@ -132,6 +637,7 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters&
>         }
>     }
> 
>+    // Set OS version parameter
>     Vector<String> osVersionParts;
>     String osSystemMarketingVersion = systemMarketingVersion();
>     osSystemMarketingVersion.split('.', false, osVersionParts);
>@@ -144,13 +650,19 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters&
> 
>     // Use private temporary and cache directories.
>     setenv("DIRHELPER_USER_DIR_SUFFIX", FileSystem::fileSystemRepresentation(sandboxParameters.userDirectorySuffix()).data(), 1);
>-    char temporaryDirectory[PATH_MAX];
>+    char temporaryDirectory[PATH_MAX + 1];
>     if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryDirectory, sizeof(temporaryDirectory))) {
>         WTFLogAlways("%s: couldn't retrieve private temporary directory path: %d\n", getprogname(), errno);
>         exit(EX_NOPERM);
>     }
>     setenv("TMPDIR", temporaryDirectory, 1);
> 
>+#if WK_API_ENABLED
>+    NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")];
>+#else
>+    NSBundle* webKit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")];
>+#endif
>+
>     sandboxParameters.addPathParameter("WEBKIT2_FRAMEWORK_DIR", [[webKit2Bundle bundlePath] stringByDeletingLastPathComponent]);
>     sandboxParameters.addConfDirectoryParameter("DARWIN_USER_TEMP_DIR", _CS_DARWIN_USER_TEMP_DIR);
>     sandboxParameters.addConfDirectoryParameter("DARWIN_USER_CACHE_DIR", _CS_DARWIN_USER_CACHE_DIR);
>@@ -165,50 +677,25 @@ void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters&
>     }
> 
>     sandboxParameters.addPathParameter("HOME_DIR", pwd.pw_dir);
>-
>     String path = String::fromUTF8(pwd.pw_dir);
>     path.append("/Library");
>-
>+    String libraryPath = path;
>     sandboxParameters.addPathParameter("HOME_LIBRARY_DIR", FileSystem::fileSystemRepresentation(path).data());
>-
>     path.append("/Preferences");
>-
>     sandboxParameters.addPathParameter("HOME_LIBRARY_PREFERENCES_DIR", FileSystem::fileSystemRepresentation(path).data());
>+}
> 
>-    switch (sandboxParameters.mode()) {
>-    case SandboxInitializationParameters::UseDefaultSandboxProfilePath:
>-    case SandboxInitializationParameters::UseOverrideSandboxProfilePath: {
>-        String sandboxProfilePath = sandboxParameters.mode() == SandboxInitializationParameters::UseDefaultSandboxProfilePath ? defaultProfilePath : sandboxParameters.overrideSandboxProfilePath();
>-        if (!sandboxProfilePath.isEmpty()) {
>-            CString profilePath = FileSystem::fileSystemRepresentation(sandboxProfilePath);
>-            char* errorBuf;
>-#pragma clang diagnostic push
>-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
>-            if (sandbox_init_with_parameters(profilePath.data(), SANDBOX_NAMED_EXTERNAL, sandboxParameters.namedParameterArray(), &errorBuf)) {
>-#pragma clang diagnostic pop
>-                WTFLogAlways("%s: Couldn't initialize sandbox profile [%s], error '%s'\n", getprogname(), profilePath.data(), errorBuf);
>-                for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i)
>-                    WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i));
>-                exit(EX_NOPERM);
>-            }
>-        }
>+void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
>+{
>+    TraceScope traceScope(InitializeSandboxStart, InitializeSandboxEnd);
> 
>-        break;
>-    }
>-    case SandboxInitializationParameters::UseSandboxProfile: {
>-        char* errorBuf;
>-#pragma clang diagnostic push
>-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
>-        if (sandbox_init_with_parameters(sandboxParameters.sandboxProfile().utf8().data(), 0, sandboxParameters.namedParameterArray(), &errorBuf)) {
>-#pragma clang diagnostic pop
>-            WTFLogAlways("%s: Couldn't initialize sandbox profile, error '%s'\n", getprogname(), errorBuf);
>-            for (size_t i = 0, count = sandboxParameters.count(); i != count; ++i)
>-                WTFLogAlways("%s=%s\n", sandboxParameters.name(i), sandboxParameters.value(i));
>-            exit(EX_NOPERM);
>-        }
>+    initializeSandboxParameters(parameters, sandboxParameters);
> 
>-        break;
>-    }
>+    // Try to apply the sandbox
>+    if (!applySandbox(parameters, sandboxParameters)) {
>+        // Something is really wrong, we can't continue without our sandbox
>+        WTFLogAlways("%s: Unable to apply sandbox\n", getprogname());
>+        CRASH();
>     }
> 
>     // This will override LSFileQuarantineEnabled from Info.plist unless sandbox quarantine is globally disabled.
>@@ -225,7 +712,7 @@ void ChildProcess::stopNSAppRunLoop()
>     ASSERT([NSApp isRunning]);
>     [NSApp stop:nil];
> 
>-    NSEvent *event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0];
>+    NSEvent* event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined location:NSMakePoint(0, 0) modifierFlags:0 timestamp:0.0 windowNumber:0 context:nil subtype:0 data1:0 data2:0];
>     [NSApp postEvent:event atStart:true];
> }
> #endif
>diff --git a/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm b/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm
>index 6cb4c88a70c..634909da999 100644
>--- a/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm
>+++ b/Source/WebKit/Shared/mac/SandboxInitialiationParametersMac.mm
>@@ -29,7 +29,7 @@
> namespace WebKit {
> 
> SandboxInitializationParameters::SandboxInitializationParameters()
>-    : m_profileSelectionMode(UseDefaultSandboxProfilePath)
>+    : m_profileSelectionMode(ProfileSelectionMode::UseDefaultSandboxProfilePath)
> {
> }
> 
>diff --git a/Source/WebKit/StorageProcess/StorageProcess.h b/Source/WebKit/StorageProcess/StorageProcess.h
>index aee510042be..42271d9f138 100644
>--- a/Source/WebKit/StorageProcess/StorageProcess.h
>+++ b/Source/WebKit/StorageProcess/StorageProcess.h
>@@ -71,6 +71,8 @@ class StorageProcess : public ChildProcess
>     friend NeverDestroyed<StorageProcess>;
> public:
>     static StorageProcess& singleton();
>+    static constexpr ProcessType processType = ProcessType::StorageType;
>+
>     ~StorageProcess();
> 
>     WorkQueue& queue() { return m_queue.get(); }
>diff --git a/Source/WebKit/WebProcess/WebProcess.h b/Source/WebKit/WebProcess/WebProcess.h
>index 88cc21f9f51..69208f350a6 100644
>--- a/Source/WebKit/WebProcess/WebProcess.h
>+++ b/Source/WebKit/WebProcess/WebProcess.h
>@@ -109,6 +109,7 @@ struct WebsiteDataStoreParameters;
> class WebProcess : public ChildProcess {
> public:
>     static WebProcess& singleton();
>+    static constexpr ProcessType processType = ProcessType::WebContentType;
> 
>     template <typename T>
>     T* supplement()
>diff --git a/Tools/ChangeLog b/Tools/ChangeLog
>index c0e2b830a0e..c5006c6a8da 100644
>--- a/Tools/ChangeLog
>+++ b/Tools/ChangeLog
>@@ -1,3 +1,12 @@
>+2018-06-25  Ben Richards  <benton_richards@apple.com>
>+
>+        Added trace points for sandbox initialize
>+        https://bugs.webkit.org/show_bug.cgi?id=184991
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * Tracing/SystemTracePoints.plist:
>+
> 2018-06-25  Youenn Fablet  <youenn@apple.com>
> 
>         Add API to control mock media devices
>diff --git a/Tools/Tracing/SystemTracePoints.plist b/Tools/Tracing/SystemTracePoints.plist
>index e9e1776965b..0e1a6783866 100644
>--- a/Tools/Tracing/SystemTracePoints.plist
>+++ b/Tools/Tracing/SystemTracePoints.plist
>@@ -300,6 +300,18 @@
>                  <key>CodeEnd</key>
>                  <string>14004</string>
>              </dict>
>+             <dict>
>+                 <key>Name</key>
>+                 <string>Initialize Sandbox</string>
>+                 <key>Type</key>
>+                 <string>Interval</string>
>+                 <key>Component</key>
>+                 <string>47</string>
>+                 <key>CodeBegin</key>
>+                 <string>14005</string>
>+                 <key>CodeEnd</key>
>+                 <string>14006</string>
>+             </dict>
>          </array>
>      </dict>
>  </array>

Actions: View | Formatted Diff | Diff

Attachments on bug 184991: 338858 | 338915 | 338951 | 338955 | 338963 | 338968 | 339519 | 342768 | 342781 | 342796 | 342947 | 342973 | 342997 | 343006 | 343012 | 343014 | 343025 | 343051 | 343063 | 343073 | 343094 | 343110 | 343126 | 343354 | 343356 | 343456 | 343554 | 343574 | 343651 | 343655 | 343771 | 343774 | 343776 | 343804 | 344130 | 344805 | 344832 | 345206 | 345287 | 345311 | 345327 | 345377 | 345392 | 345405 | 345588 | 345598 | 346440 | 346558 | 346743 | 346810 | 346841 | 347144 | 347170