Bug 154861

Summary: [MediaStream] Dynamically generate media capture sandbox extensions
Product: WebKit Reporter: Eric Carlson <eric.carlson>
Component: MediaAssignee: Eric Carlson <eric.carlson>
Status: RESOLVED FIXED    
Severity: Normal CC: agouaillard, buildbot, commit-queue, rniwa, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch for the bots.
none
Proposed patch
none
Updated patch.
buildbot: commit-queue-
Archive of layout-test-results from ews107 for mac-yosemite-wk2
none
Updated patch.
none
Updated patch.
none
Updated patch.
thorton: review+
Updated patch for landing.
none
Updated patch for landing.
none
Updated patch for landing.
buildbot: commit-queue-
Archive of layout-test-results from ews107 for mac-yosemite-wk2
none
Updated patch for landing. none

Description Eric Carlson 2016-03-01 09:31:38 PST
Access to audio & video capture devices from the WebProcess require sandbox extensions. Instead of changing the sandbox permanently, generate extensions on dynamically when access is required.
Comment 1 Radar WebKit Bug Importer 2016-03-01 09:36:05 PST
<rdar://problem/24909411>
Comment 2 Eric Carlson 2016-03-12 16:27:01 PST
Created attachment 273859 [details]
Patch for the bots.
Comment 3 Eric Carlson 2016-03-14 11:18:22 PDT
Created attachment 273993 [details]
Proposed patch
Comment 4 Eric Carlson 2016-03-14 12:52:13 PDT
Created attachment 274003 [details]
Updated patch.
Comment 5 Build Bot 2016-03-14 13:27:25 PDT
Comment on attachment 274003 [details]
Updated patch.

Attachment 274003 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/978511

Number of test failures exceeded the failure limit.
Comment 6 Build Bot 2016-03-14 13:27:28 PDT
Created attachment 274010 [details]
Archive of layout-test-results from ews107 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5
Comment 7 Eric Carlson 2016-03-14 13:34:36 PDT
Created attachment 274013 [details]
Updated patch.
Comment 8 Anders Carlsson 2016-03-14 14:22:41 PDT
Comment on attachment 274013 [details]
Updated patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=274013&action=review

> Source/WebCore/Modules/mediastream/MediaDeviceAccessRequestClient.h:49
> +class MediaDeviceAccessRequestClient {
> +public:
> +    virtual ~MediaDeviceAccessRequestClient() { }
> +
> +    enum class MediaDeviceAccess {
> +        Unknown,
> +        Pending,
> +        Allowed,
> +        Blocked,
> +    };
> +    virtual void didCompleteMediaDeviceAccessRequest(MediaDeviceAccess) = 0;
> +
> +    virtual void ref() = 0;
> +    virtual void deref() = 0;
> +};

Instead of using a client for this, I think you can just use a completion function, something like

std::function<void (MediaDeviceAccess)>> completionHandler;

> Source/WebCore/Modules/mediastream/UserMediaClient.h:57
> +    virtual void requestMediaDeviceAccess(MediaDeviceAccessRequestClient&) { }

This would turn into virtual void requestMdiaDeviceAccess(std::function<void (MediaDeviceAccess)>> completionHandler) { }

Is it OK to no call the client here?

> Source/WebCore/Modules/mediastream/UserMediaRequest.h:77
> +    void ref() override { RefCounted<UserMediaRequest>::ref(); }
> +    void deref() override { RefCounted<UserMediaRequest>::deref(); }

Is it OK to keep UserMediaRequest alive longer here?

> Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in:378
> +;; Media capture, microphone access
> +(with-filter (extension "com.apple.webkit.microphone")
> +    (allow device-microphone))
> +
> +;; Media capture, camera access
> +(with-filter (extension "com.apple.webkit.camera")

Didn't know that you could do this with sandbox extensions - that's pretty cool!
Comment 9 Brent Fulgham 2016-04-13 22:20:09 PDT
Comment on attachment 274013 [details]
Updated patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=274013&action=review

>> Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in:378
>> +(with-filter (extension "com.apple.webkit.camera")
> 
> Didn't know that you could do this with sandbox extensions - that's pretty cool!

Is this needed on iOS, too? iOS does not support some fancier operations because of performance concerns, so you might need to do some testing on device to ensure things work the way you expect. (annoying, I realize).
Comment 10 Eric Carlson 2016-10-21 15:51:38 PDT
Created attachment 292423 [details]
Updated patch.
Comment 11 WebKit Commit Bot 2016-10-21 15:52:32 PDT
Attachment 292423 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:193:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:193:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 12 Eric Carlson 2016-10-21 16:36:08 PDT
Created attachment 292427 [details]
Updated patch.
Comment 13 WebKit Commit Bot 2016-10-21 16:38:50 PDT
Attachment 292427 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 14 Tim Horton 2016-10-21 16:47:48 PDT
Comment on attachment 292427 [details]
Updated patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=292427&action=review

It would be ideal if you didn't land it until it builds.

> Source/WebKit2/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:138
> +        extensionCount += 1;

++?
Comment 15 Tim Horton 2016-10-21 16:48:14 PDT
Should probably have Alexey or Brent or someone look over the sandbox changes a bit more.
Comment 16 Eric Carlson 2016-10-21 16:58:39 PDT
Created attachment 292431 [details]
Updated patch for landing.
Comment 17 WebKit Commit Bot 2016-10-21 16:59:54 PDT
Attachment 292431 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 18 Eric Carlson 2016-10-21 17:10:13 PDT
Created attachment 292433 [details]
Updated patch for landing.
Comment 19 WebKit Commit Bot 2016-10-21 17:13:44 PDT
Attachment 292433 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 20 Eric Carlson 2016-10-21 17:24:25 PDT
Created attachment 292437 [details]
Updated patch for landing.
Comment 21 WebKit Commit Bot 2016-10-21 17:28:06 PDT
Attachment 292437 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 22 Build Bot 2016-10-21 18:16:41 PDT
Comment on attachment 292437 [details]
Updated patch for landing.

Attachment 292437 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/2341549

Number of test failures exceeded the failure limit.
Comment 23 Build Bot 2016-10-21 18:16:45 PDT
Created attachment 292444 [details]
Archive of layout-test-results from ews107 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5
Comment 24 Eric Carlson 2016-10-21 18:50:58 PDT
Created attachment 292445 [details]
Updated patch for landing.
Comment 25 WebKit Commit Bot 2016-10-21 18:52:42 PDT
Attachment 292445 [details] did not pass style-queue:


ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
ERROR: Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:194:  Missing space before {  [whitespace/braces] [5]
Total errors found: 2 in 15 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 26 Eric Carlson 2016-10-21 20:39:07 PDT
Committed r207704: https://trac.webkit.org/r207704