Bug 170387 – [Cocoa] Allow clients to specify in _WKProcessPoolConfiguration additional directory sandbox extensions

• Component: WebKit2
• Status: RESOLVED FIXED

A client with a an injected bundle would like Web Content processes that load its bundle to have read access to additional directories which the bundle code needs. We can add _WKProcessPoolConfiguration API for specifying an array of file URLs of additional directories for which to grant a sandbox extension to the Web process.

Created attachment 307089 [details]
Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration

[Sam Weinig]

Comment on attachment 307089 [details]
Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration

View in context: https://bugs.webkit.org/attachment.cgi?id=307089&action=review

> Source/WebKit2/UIProcess/API/Cocoa/_WKProcessPoolConfiguration.mm:121
> +    paths.reserveCapacity(additionalReadAccessAllowedURLs.count);

This can use reserveInitialCapacity for a little bit of a speed bump.

[Sam Weinig]

Comment on attachment 307089 [details]
Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration

View in context: https://bugs.webkit.org/attachment.cgi?id=307089&action=review

> Source/WebKit2/Shared/WebProcessCreationParameters.h:68
> +    SandboxExtension::HandleArray additionalSandboxExtensionHandles;

Unrelated, but we really should get rid of HandleArray since we now know how to deal with move-only types in Vector :).

Comment on attachment 307089 [details]
Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration

View in context: https://bugs.webkit.org/attachment.cgi?id=307089&action=review

>> Source/WebKit2/Shared/WebProcessCreationParameters.h:68
>> +    SandboxExtension::HandleArray additionalSandboxExtensionHandles;
> 
> Unrelated, but we really should get rid of HandleArray since we now know how to deal with move-only types in Vector :).

I didn’t even know about HandleArray when I wrote this as a plain Vector<SandboxExtension::Handle>, but then things broke at runtime, so I switched to HandleArray.

>> Source/WebKit2/UIProcess/API/Cocoa/_WKProcessPoolConfiguration.mm:121
>> +    paths.reserveCapacity(additionalReadAccessAllowedURLs.count);
> 
> This can use reserveInitialCapacity for a little bit of a speed bump.

Will bump.

Committed <https://trac.webkit.org/r215355>.

[Sam Weinig]

(In reply to mitz from comment #4)
> Comment on attachment 307089 [details]
> Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=307089&action=review
> 
> >> Source/WebKit2/Shared/WebProcessCreationParameters.h:68
> >> +    SandboxExtension::HandleArray additionalSandboxExtensionHandles;
> > 
> > Unrelated, but we really should get rid of HandleArray since we now know how to deal with move-only types in Vector :).
> 
> I didn’t even know about HandleArray when I wrote this as a plain
> Vector<SandboxExtension::Handle>, but then things broke at runtime, so I
> switched to HandleArray.

Broke you say. I wonder if we need to teach Handle to move correctly. If you remember / know, what broke?

(In reply to Sam Weinig from comment #6)
> (In reply to mitz from comment #4)
> > Comment on attachment 307089 [details]
> > Add additionalReadAccessAllowedURLs property to _WKProcessPoolConfiguration
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=307089&action=review
> > 
> > >> Source/WebKit2/Shared/WebProcessCreationParameters.h:68
> > >> +    SandboxExtension::HandleArray additionalSandboxExtensionHandles;
> > > 
> > > Unrelated, but we really should get rid of HandleArray since we now know how to deal with move-only types in Vector :).
> > 
> > I didn’t even know about HandleArray when I wrote this as a plain
> > Vector<SandboxExtension::Handle>, but then things broke at runtime, so I
> > switched to HandleArray.
> 
> Broke you say. I wonder if we need to teach Handle to move correctly. If you
> remember / know, what broke?

The underlying platform object was getting double-freed, probably meaning that the “move” didn’t clear the pointer in the donor handle?

<rdar://problem/13191458>