Bug 189963
| Summary: | [WPE][GTK] Fix file:// URI access in sandbox | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Patrick Griffis <pgriffis> |
| Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED INVALID | ||
| Severity: | Normal | CC: | bugs-noreply |
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | |||
| Bug Blocks: | 189956 | ||
Patrick Griffis
Currently `file://` URIs are all handled by the NetworkProcess which does not have filesystem access.
Granting that access would defeat the purpose of the sandbox so this needs to be moved out of this process.
One idea would be creating a new LocalFileProcess or such so it could work but doesn't compromise every
websites NetworkProcess.
This cannot be solved by simply mounting requested URIs dynamically at runtime as all `bwrap` permissions
happen once at process creation and adding bind mounts later would require root permissions which is
not ideal.
We also cannot use the `document-portal` that flatpak uses because it does not handle
directories yet and doesn't have any solid plans how to do so.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Patrick Griffis
We've decided to trust the NetworkProcess for now and not sandbox it so this no longer applies.