227343 2021-06-24 02:36:48 -0700 [GTK] MiniBrowser: add an option to enable the web process sandbox 2021-06-28 05:41:14 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED Gtk P2 Normal --- 1 cgarcia webkit-unassigned bugs-noreply mcatanzaro oldest_to_newest 1772226 0 cgarcia 2021-06-24 02:36:48 -0700 . 1772229 1 432143 cgarcia 2021-06-24 02:38:05 -0700 Created attachment 432143 Patch 1772296 2 432143 mcatanzaro 2021-06-24 08:46:28 -0700 Comment on attachment 432143 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=432143&action=review > Tools/MiniBrowser/gtk/main.c:149 > + { "enable-sandbox", 0, 0, G_OPTION_ARG_NONE, &enableSandbox, "Enable web process sandbox support", NULL }, Ideally it would be on by default, to have the best chance of avoiding mistakes like developing new features that are incompatible with the sandbox (it has happened recently). I guess the sandbox will probably break layout tests if we're not careful, though. And I know you want to avoid waiting for D-Bus registration when running layout tests. So I would flip it to disable-sandbox, if possible. > Tools/MiniBrowser/gtk/main.c:682 > + if (!webkit_website_data_manager_is_ephemeral(manager)) { > + webkit_web_context_add_path_to_sandbox(webContext, webkit_website_data_manager_get_base_data_directory(manager), TRUE); > + webkit_web_context_add_path_to_sandbox(webContext, webkit_website_data_manager_get_base_cache_directory(manager), TRUE); > + } Um, I thought this was supposed to be done automatically, but I can't find any code for it, so I guess it has to be manual. :/ 1772328 3 mcatanzaro 2021-06-24 10:03:44 -0700 (In reply to Michael Catanzaro from comment #2) > So I would flip it to disable-sandbox, if possible. If you do this, then we can also close bug #213174. > > Tools/MiniBrowser/gtk/main.c:682 > > + if (!webkit_website_data_manager_is_ephemeral(manager)) { > > + webkit_web_context_add_path_to_sandbox(webContext, webkit_website_data_manager_get_base_data_directory(manager), TRUE); > > + webkit_web_context_add_path_to_sandbox(webContext, webkit_website_data_manager_get_base_cache_directory(manager), TRUE); > > + } > > Um, I thought this was supposed to be done automatically, but I can't find > any code for it, so I guess it has to be manual. :/ Discussing this with Patrick, we think these should not be needed. Does something break if you don't add them? It might be a bug. 1773038 4 cgarcia 2021-06-28 05:41:14 -0700 Committed r279337 (239205@main): <https://commits.webkit.org/239205@main> 432143 2021-06-24 02:38:05 -0700 2021-06-24 08:46:28 -0700 Patch mb-sandbox.diff text/plain 3058 cgarcia ZGlmZiAtLWdpdCBhL1Rvb2xzL0NoYW5nZUxvZyBiL1Rvb2xzL0NoYW5nZUxvZwppbmRleCBmMTI3 YTU3N2IyYmEuLmQ1NmUxZmNhMDgyOCAxMDA2NDQKLS0tIGEvVG9vbHMvQ2hhbmdlTG9nCisrKyBi L1Rvb2xzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDIxLTA2LTI0ICBDYXJsb3MgR2Fy Y2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXSBNaW5pQnJv d3NlcjogYWRkIGFuIG9wdGlvbiB0byBlbmFibGUgdGhlIHdlYiBwcm9jZXNzIHNhbmRib3gKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNzM0MworCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogTWluaUJyb3dz ZXIvZ3RrL21haW4uYzoKKyAgICAgICAgKGFjdGl2YXRlKToKKyAgICAgICAgKG1haW4pOgorCiAy MDIxLTA2LTIzICBaYW4gRG9iZXJzZWsgIDx6ZG9iZXJzZWtAaWdhbGlhLmNvbT4KIAogICAgICAg ICBbV1BFXSBXZWJLaXRHTGliQVBJVGVzdHNDb3JlIHNob3VsZCBtb3JlIGV4cGxpY2l0bHkgbGlu ayBhZ2FpbnN0IGxpYnJhcnkgZGVwZW5kZW5jaWVzCmRpZmYgLS1naXQgYS9Ub29scy9NaW5pQnJv d3Nlci9ndGsvbWFpbi5jIGIvVG9vbHMvTWluaUJyb3dzZXIvZ3RrL21haW4uYwppbmRleCBiNGFk NmNhZDdlZTMuLmQzNjNjMDgyZDEwZCAxMDA2NDQKLS0tIGEvVG9vbHMvTWluaUJyb3dzZXIvZ3Rr L21haW4uYworKysgYi9Ub29scy9NaW5pQnJvd3Nlci9ndGsvbWFpbi5jCkBAIC01Miw2ICs1Miw3 IEBAIHN0YXRpYyBjb25zdCBjaGFyICpjb29raWVzUG9saWN5Owogc3RhdGljIGNvbnN0IGNoYXIg KnByb3h5Owogc3RhdGljIGdib29sZWFuIGRhcmtNb2RlOwogc3RhdGljIGdib29sZWFuIGVuYWJs ZUlUUDsKK3N0YXRpYyBnYm9vbGVhbiBlbmFibGVTYW5kYm94Owogc3RhdGljIGdib29sZWFuIGV4 aXRBZnRlckxvYWQ7CiBzdGF0aWMgZ2Jvb2xlYW4gd2ViUHJvY2Vzc0NyYXNoZWQ7CiBzdGF0aWMg Z2Jvb2xlYW4gcHJpbnRWZXJzaW9uOwpAQCAtMTQ1LDYgKzE0Niw3IEBAIHN0YXRpYyBjb25zdCBH T3B0aW9uRW50cnkgY29tbWFuZExpbmVPcHRpb25zW10gPQogICAgIHsgImlnbm9yZS10bHMtZXJy b3JzIiwgMCwgMCwgR19PUFRJT05fQVJHX05PTkUsICZpZ25vcmVUTFNFcnJvcnMsICJJZ25vcmUg VExTIGVycm9ycyIsIE5VTEwgfSwKICAgICB7ICJjb250ZW50LWZpbHRlciIsIDAsIDAsIEdfT1BU SU9OX0FSR19GSUxFTkFNRSwgJmNvbnRlbnRGaWx0ZXIsICJKU09OIHdpdGggY29udGVudCBmaWx0 ZXJpbmcgcnVsZXMiLCAiRklMRSIgfSwKICAgICB7ICJlbmFibGUtaXRwIiwgMCwgMCwgR19PUFRJ T05fQVJHX05PTkUsICZlbmFibGVJVFAsICJFbmFibGUgSW50ZWxsaWdlbnQgVHJhY2tpbmcgUHJl dmVudGlvbiAoSVRQKSIsIE5VTEwgfSwKKyAgICB7ICJlbmFibGUtc2FuZGJveCIsIDAsIDAsIEdf T1BUSU9OX0FSR19OT05FLCAmZW5hYmxlU2FuZGJveCwgIkVuYWJsZSB3ZWIgcHJvY2VzcyBzYW5k Ym94IHN1cHBvcnQiLCBOVUxMIH0sCiAgICAgeyAiZXhpdC1hZnRlci1sb2FkIiwgMCwgMCwgR19P UFRJT05fQVJHX05PTkUsICZleGl0QWZ0ZXJMb2FkLCAiUXVpdCB0aGUgYnJvd3NlciBhZnRlciB0 aGUgbG9hZCBmaW5pc2hlcyIsIE5VTEwgfSwKICAgICB7ICJ2ZXJzaW9uIiwgJ3YnLCAwLCBHX09Q VElPTl9BUkdfTk9ORSwgJnByaW50VmVyc2lvbiwgIlByaW50IHRoZSBXZWJLaXRHVEsgdmVyc2lv biIsIE5VTEwgfSwKICAgICB7IEdfT1BUSU9OX1JFTUFJTklORywgMCwgMCwgR19PUFRJT05fQVJH X0ZJTEVOQU1FX0FSUkFZLCAmdXJpQXJndW1lbnRzLCAwLCAiW1VSTOKApl0iIH0sCkBAIC02NzIs NiArNjc0LDEzIEBAIHN0YXRpYyB2b2lkIGFjdGl2YXRlKEdBcHBsaWNhdGlvbiAqYXBwbGljYXRp b24sIFdlYktpdFNldHRpbmdzICp3ZWJraXRTZXR0aW5ncykKICAgICAgICAgInVzZS1zeXN0ZW0t YXBwZWFyYW5jZS1mb3Itc2Nyb2xsYmFycyIsIEZBTFNFLAogI2VuZGlmCiAgICAgICAgIE5VTEwp OworICAgIGlmIChlbmFibGVTYW5kYm94KSB7CisgICAgICAgIHdlYmtpdF93ZWJfY29udGV4dF9z ZXRfc2FuZGJveF9lbmFibGVkKHdlYkNvbnRleHQsIFRSVUUpOworICAgICAgICBpZiAoIXdlYmtp dF93ZWJzaXRlX2RhdGFfbWFuYWdlcl9pc19lcGhlbWVyYWwobWFuYWdlcikpIHsKKyAgICAgICAg ICAgIHdlYmtpdF93ZWJfY29udGV4dF9hZGRfcGF0aF90b19zYW5kYm94KHdlYkNvbnRleHQsIHdl YmtpdF93ZWJzaXRlX2RhdGFfbWFuYWdlcl9nZXRfYmFzZV9kYXRhX2RpcmVjdG9yeShtYW5hZ2Vy KSwgVFJVRSk7CisgICAgICAgICAgICB3ZWJraXRfd2ViX2NvbnRleHRfYWRkX3BhdGhfdG9fc2Fu ZGJveCh3ZWJDb250ZXh0LCB3ZWJraXRfd2Vic2l0ZV9kYXRhX21hbmFnZXJfZ2V0X2Jhc2VfY2Fj aGVfZGlyZWN0b3J5KG1hbmFnZXIpLCBUUlVFKTsKKyAgICAgICAgfQorICAgIH0KICAgICBnX29i amVjdF91bnJlZihtYW5hZ2VyKTsKIAogICAgIGlmIChjb29raWVzUG9saWN5KSB7CkBAIC04Mjcs NyArODM2LDcgQEAgaW50IG1haW4oaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkKICAgICAgICAgcmV0 dXJuIDA7CiAgICAgfQogCi0gICAgR3RrQXBwbGljYXRpb24gKmFwcGxpY2F0aW9uID0gZ3RrX2Fw cGxpY2F0aW9uX25ldyhOVUxMLCBHX0FQUExJQ0FUSU9OX0ZMQUdTX05PTkUpOworICAgIEd0a0Fw cGxpY2F0aW9uICphcHBsaWNhdGlvbiA9IGd0a19hcHBsaWNhdGlvbl9uZXcoIm9yZy53ZWJraXRn dGsuTWluaUJyb3dzZXIiLCBHX0FQUExJQ0FUSU9OX05PTl9VTklRVUUpOwogICAgIGdfc2lnbmFs X2Nvbm5lY3QoYXBwbGljYXRpb24sICJzdGFydHVwIiwgR19DQUxMQkFDSyhzdGFydHVwKSwgTlVM TCk7CiAgICAgZ19zaWduYWxfY29ubmVjdChhcHBsaWNhdGlvbiwgImFjdGl2YXRlIiwgR19DQUxM QkFDSyhhY3RpdmF0ZSksIHdlYmtpdFNldHRpbmdzKTsKICAgICBnX2FwcGxpY2F0aW9uX3J1bihH X0FQUExJQ0FUSU9OKGFwcGxpY2F0aW9uKSwgMCwgTlVMTCk7Cg==