[Mac] Add an experimental SPI for plug-ins to enter sandbox

• Component: Plug-ins
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

...

[Alexey Proskuryakov]

Created attachment 129116 [details]
proposed patch

This has been previously discussed on plugin-futures, adding an experimental implementation to validate the approach.

[WebKit Review Bot]

Attachment 129116 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/WebKit2/ChangeLog', u'Source/WebKit..." exit_code: 1
Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:32:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Alexey Proskuryakov]

Created attachment 129141 [details]
style fix, and added a comment

[WebKit Review Bot]

Attachment 129141 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/WebKit2/ChangeLog', u'Source/WebKit..." exit_code: 1
Source/WebKit2/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:32:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Collabora GTK+ EWS bot]

Comment on attachment 129141 [details]
style fix, and added a comment

Attachment 129141 [details] did not pass gtk-ews (gtk):
Output: http://queues.webkit.org/results/11645287

[Sam Weinig]

Comment on attachment 129141 [details]
style fix, and added a comment

View in context: https://bugs.webkit.org/attachment.cgi?id=129141&action=review

This seems to have problems building.

> Source/WebKit2/ChangeLog:10
> +        * PluginProcess/mac/plugin.sb: Added.

The sandbox profile for the WebProcess is called, com.apple.WebProcess.sb. Should we match the naming convention?  Also, is it possible/a good idea to extract a set of both profiles that are common and share them?

[Alexey Proskuryakov]

> This seems to have problems building.

Fixed a non-Mac issue locally, but mostly it depends on WKSI changes that are yet to be landed.

> The sandbox profile for the WebProcess is called, com.apple.WebProcess.sb. Should we match the naming convention?

I don't really care, I liked plugin.sb.

>  Also, is it possible/a good idea to extract a set of both profiles that are common and share them?

I think that at this stage, it's easier to maintain them separately.

[Anders Carlsson]

Comment on attachment 129141 [details]
style fix, and added a comment

I think plugin.sb should be com.apple.PluginProcess.sb to match the WebProcess name.

[Alexey Proskuryakov]

Created attachment 129311 [details]
patch for landing

[WebKit Review Bot]

Comment on attachment 129311 [details]
patch for landing

Rejecting attachment 129311 [details] from commit-queue.

Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 1

Ander Carlsson found in /mnt/git/webkit-commit-queue/Source/WebKit2/ChangeLog does not appear to be a valid reviewer according to committers.py.
ERROR: /mnt/git/webkit-commit-queue/Source/WebKit2/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive).

Full output: http://queues.webkit.org/results/11714047

[Alexey Proskuryakov]

Created attachment 129313 [details]
patch for landing

[WebKit Review Bot]

Comment on attachment 129313 [details]
patch for landing

Clearing flags on attachment: 129313

Committed r109143: <http://trac.webkit.org/changeset/109143>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Alexey Proskuryakov]

Build fix in <http://trac.webkit.org/changeset/109148>.

[Rafael Brandao]

Reopening to attach new patch.

[Rafael Brandao]

Created attachment 129330 [details]
Patch

It looks like this has broken qt buildbots. The following patch is a build fix, please double check it before landing.

[Alexey Proskuryakov]

Build fix has already been landed, please see above.

[Alexey Proskuryakov]

Comment on attachment 129330 [details]
Patch

-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) || !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && (!defined(BUILDING_ON_LEOPARD) || !defined(BUILDING_ON_SNOW_LEOPARD))

Also, this is insufficient, there are two instances of this in this file.

[Alexey Proskuryakov]

Mac build fix of same kind in <http://trac.webkit.org/changeset/109159>.