Bug 169431 - [WK2][iOS] Extend WebProcess sandbox to support audio and video compression/decompression
Summary: [WK2][iOS] Extend WebProcess sandbox to support audio and video compression/d...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: iPhone / iPad All
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks: 169480
  Show dependency treegraph
 
Reported: 2017-03-09 12:54 PST by Brent Fulgham
Modified: 2017-03-10 12:14 PST (History)
6 users (show)

See Also:


Attachments
Patch (2.45 KB, patch)
2017-03-09 12:57 PST, Brent Fulgham
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2017-03-09 12:54:02 PST
The iOS web  process needs access to the following Mach names in order to compress, decompress, and render audio and video for WebRTC:

These are needed to decode video content delivered over WebRTC:
com.apple.coremedia.videoqueue
com.apple.audio.audiohald
com.apple.coremedia.decompressionsession

This is needed to encode video to ship over WebRTC:
com.apple.coremedia.compressionsession
Comment 1 Brent Fulgham 2017-03-09 12:54:35 PST
<rdar://problem/30844650>
Comment 2 Brent Fulgham 2017-03-09 12:57:22 PST
Created attachment 303960 [details]
Patch
Comment 3 youenn fablet 2017-03-09 13:09:03 PST
Comment on attachment 303960 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=303960&action=review

> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:116
> +    (allow mach-lookup (global-name "com.apple.coremedia.compressionsession")))

We need compressionsession when doing exporting canvas through peer connection, not only for gum.
I would add it next to decompressionsession.

> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:141
> +    (global-name "com.apple.audio.audiohald")

I wonder whether we can put this one under com.apple.webkit.microphone?
Comment 4 Brent Fulgham 2017-03-09 13:13:26 PST
Comment on attachment 303960 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=303960&action=review

>> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:116
>> +    (allow mach-lookup (global-name "com.apple.coremedia.compressionsession")))
> 
> We need compressionsession when doing exporting canvas through peer connection, not only for gum.
> I would add it next to decompressionsession.

We need this for microphone OR camera, but not otherwise. So I think this is correct (it's safe to tell the Sandbox to allow a particular mach name more than once).

>> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:141
>> +    (global-name "com.apple.audio.audiohald")
> 
> I wonder whether we can put this one under com.apple.webkit.microphone?

Eric said it was needed for incoming video streams (which I assume include audio?), so I put it here.
Comment 5 WebKit Commit Bot 2017-03-09 13:42:07 PST
Comment on attachment 303960 [details]
Patch

Clearing flags on attachment: 303960

Committed r213665: <http://trac.webkit.org/changeset/213665>
Comment 6 WebKit Commit Bot 2017-03-09 13:42:11 PST
All reviewed patches have been landed.  Closing bug.
Comment 7 youenn fablet 2017-03-10 08:02:21 PST
(In reply to comment #4)
> Comment on attachment 303960 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=303960&action=review
> 
> >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:116
> >> +    (allow mach-lookup (global-name "com.apple.coremedia.compressionsession")))
> > 
> > We need compressionsession when doing exporting canvas through peer connection, not only for gum.
> > I would add it next to decompressionsession.
> 
> We need this for microphone OR camera, but not otherwise. So I think this is
> correct (it's safe to tell the Sandbox to allow a particular mach name more
> than once).

We also need it when no microphone and no camera,: canvas is exported to a mediastream track which is then sent to peer connection.
Can you update the patch?
> 
> >> Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:141
> >> +    (global-name "com.apple.audio.audiohald")
> > 
> > I wonder whether we can put this one under com.apple.webkit.microphone?
> 
> Eric said it was needed for incoming video streams (which I assume include
> audio?), so I put it here.
Comment 8 youenn fablet 2017-03-10 08:03:35 PST
See https://youennf.github.io/webrtc-tests/src/content/capture/canvas-pc2/ as an example