Provide networking process with access to its HSTS db

[Oliver Hunt]

Provide networking process with access to its parent app relative cache directory

[Oliver Hunt]

Created attachment 235230 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 235230 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=235230&action=review

> Source/WebKit2/ChangeLog:14
> +        Long term we will probably want to restrict this somewhat, but we obviously
> +        can't control the exact files the CFNetwork may wish to use and create so
> +        I'm not sure how feasible this would be.

Having discussed this, hopefully we only need to allow HSTS.plist in this location.

[Oliver Hunt]

Comment on attachment 235230 [details]
Patch

Where trying a much more restrictive approach

[Oliver Hunt]

Created attachment 235300 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 235300 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=235300&action=review

r=me conditional on adding a FIXME with radar number to make this unnecessary. Please don't land without one.

> Source/WebKit2/ChangeLog:10
> +        directory in the network process, as the network sandbox

s/network process/UI process/

> Source/WebKit2/NetworkProcess/cocoa/NetworkProcessCocoa.mm:64
> +    SandboxExtension::consumePermanently(parameters.hstsDatabasePathExtensionHandle);

Do we need to do this on OS X? I don't think that we do, so it's confusing to have this code run on both platforms. Confusion in security sensitive code is worse than #ifs.

> Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h:63
> +    SandboxExtension::Handle hstsDatabasePathExtensionHandle;

Can we have a FIXME here with a bug tracking making this unnecessary please?

> Source/WebKit2/UIProcess/WebContext.cpp:1218
> +    if (!m_overrideNetworkingHSTSDatabasePath.isEmpty())
> +        return m_overrideNetworkingHSTSDatabasePath;

There is no code anywhere to set m_overrideNetworkingHSTSDatabasePath. Please remove it.

[Oliver Hunt]

Created attachment 235301 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 235301 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=235301&action=review

Looks good to me, but still breaking builds.

> Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h:63
> +    // Remove this once <rdar://problem/17726660> is fixed.

"FIXME: "

[Oliver Hunt]

Committed r171356: <http://trac.webkit.org/changeset/171356>