Bug 172365 – Enable library validation on WebKit XPC processes

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[David Kilzer (:ddkilzer)]

Need the bug URL (OOPS!).
<rdar://problem/26470661>

Reviewed by NOBODY (OOPS!).

* Configurations/Base.xcconfig:
(WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS): Set a default value so
that it can be overridden by build commands.
* Configurations/BaseXPCService.xcconfig:
(OTHER_CODE_SIGN_FLAGS): Enable library validation for all SDKs
except for simulator SDKs, based on
WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS.
* Configurations/DebugRelease.xcconfig:
(OTHER_CODE_SIGN_FLAGS): Disable library validation for
engineering builds.
* Configurations/PluginService.32.xcconfig:
(OTHER_CODE_SIGN_FLAGS): Disable library validation for plugin
process since it loads third-party binaries.
* Configurations/PluginService.64.xcconfig: Ditto.
* Configurations/WebContentService.xcconfig:
(OTHER_CODE_SIGN_FLAGS): Remove since it's now defined in
BaseXPCService.xcconfig.
(WK_XPC_DOMAIN_EXTENSION_CODE_SIGN_FLAGS): Remove since it's no
longer needed.
(WK_XPC_DOMAIN_EXTENSION_CODE_SIGN_FLAGS_YES): Ditto.
---
 7 files changed, 39 insertions(+), 4 deletions(-)

[David Kilzer (:ddkilzer)]

Created attachment 310669 [details]
Patch

[David Kilzer (:ddkilzer)]

<rdar://problem/26470661>

[Brent Fulgham]

Comment on attachment 310669 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=310669&action=review

> Source/WebKit2/Configurations/Base.xcconfig:109
> +WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS = -o library;

Could this be gated on target release somehow? I wonder if we could enable it only for builds beyond some target OS to avoid breaking builds targeting older OS's?

[Build Bot]

Comment on attachment 310669 [details]
Patch

Attachment 310669 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3777825

Number of test failures exceeded the failure limit.

[Build Bot]

Created attachment 310680 [details]
Archive of layout-test-results from ews107 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

Created attachment 332175 [details]
Part 1: Web Content service

This is a revised version of a patch I’ve tested at Apple. Posting to see if the revisions broke it for EWS.

[Brent Fulgham]

Comment on attachment 332175 [details]
Part 1: Web Content service

View in context: https://bugs.webkit.org/attachment.cgi?id=332175&action=review

> Source/WebKit/UIProcess/mac/WebProcessProxyMac.mm:43
> +    static bool isSystemWebKit = [] {

should we use 'dispatch_once' here?

Comment on attachment 332175 [details]
Part 1: Web Content service

View in context: https://bugs.webkit.org/attachment.cgi?id=332175&action=review

>> Source/WebKit/UIProcess/mac/WebProcessProxyMac.mm:43
>> +    static bool isSystemWebKit = [] {
> 
> should we use 'dispatch_once' here?

This function shouldn’t be getting called from arbitrary threads, so no.

[David Kilzer (:ddkilzer)]

Comment on attachment 332175 [details]
Part 1: Web Content service

r=me

[WebKit Commit Bot]

Comment on attachment 332175 [details]
Part 1: Web Content service

Clearing flags on attachment: 332175

Committed r227582: <https://trac.webkit.org/changeset/227582>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

Reopening to track the remaining non-PlugIn services.

(In reply to mitz from comment #12)
> Reopening to track the remaining non-PlugIn services.

Actually, going to use bug 173424 for the remaining services.