Bug 187831 – [macOS] Relax WebKit sandbox to permit proper App Store behavior

• Component: WebKit2
• Status: RESOLVED FIXED

[Brent Fulgham]

The Mac App Store is unable to perform some gift card redemption tasks on Mojave due to missing sandbox permissions:

1. We need to allow TCC checking in the plugin process so that the user can permit the camera to be activated.
2. We need to allow connections to com.apple.assertiond.processassertionconnection.
3. We need to allow commerce kit preferences to be read in the WebContent process.

This patch adds those permissions.

[Brent Fulgham]

<rdar://problem/42047455>

[Brent Fulgham]

Created attachment 345406 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 345406 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=345406&action=review

> Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:370
> +    (global-name "com.apple.assertiond.processassertionconnection")

Is this part of this particular fix?

> Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:395
> +    (global-name "com.apple.tccd")

Do we want this here, or specifically in com.apple.appstore.CodeRedeemerNetscapePlugin.sb?

[Brent Fulgham]

(In reply to Alexey Proskuryakov from comment #3)
> Comment on attachment 345406 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=345406&action=review
> 
> > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:370
> > +    (global-name "com.apple.assertiond.processassertionconnection")
> 
> Is this part of this particular fix?

Yes -- this was on the advice of the sandboxing team (this is apparently needed for many services).

> > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:395
> > +    (global-name "com.apple.tccd")
> 
> Do we want this here, or specifically in
> com.apple.appstore.CodeRedeemerNetscapePlugin.sb?

I think making it possible for any plugin to talk to the TCC service is good, since anything that wants to request camera/microphone access needs TCC to give it permission.

[Alexey Proskuryakov]

Comment on attachment 345406 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=345406&action=review

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:476
> +        "com.apple.commerce" ;; <rdar://problem/42047455>

Please explain in that radar why this is needed.

[Alexey Proskuryakov]

> I think making it possible for any plugin to talk to the TCC service is good, since anything that wants to request camera/microphone access needs TCC to give it permission.

Is camera/microphone broken in Flash right now? If so, then the fix is much bigger than what its title implies. And if not, then something strange is going on.

[Brent Fulgham]

(In reply to Alexey Proskuryakov from comment #5)
> Comment on attachment 345406 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=345406&action=review
> 
> > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:476
> > +        "com.apple.commerce" ;; <rdar://problem/42047455>
> 
> Please explain in that radar why this is needed.

I just spoke with the store folks and they don't think this is needed. I'll remove it from the patch.

[Brent Fulgham]

Created attachment 345456 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 345456 [details]
Patch for landing

Clearing flags on attachment: 345456

Committed r234054: <https://trac.webkit.org/changeset/234054>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.