Bug 173424 - [Mac] Enable library validation for Networking & Storage XPC services
Summary: [Mac] Enable library validation for Networking & Storage XPC services
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Kilzer (:ddkilzer)
URL:
Keywords: InRadar
Depends on: 156668
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-15 10:45 PDT by David Kilzer (:ddkilzer)
Modified: 2018-01-25 11:34 PST (History)
11 users (show)

See Also:


Attachments
Patch v1 (7.92 KB, patch)
2017-06-15 14:37 PDT, David Kilzer (:ddkilzer)
no flags Details | Formatted Diff | Diff
Enable Library Validation (6.09 KB, patch)
2018-01-25 10:20 PST, mitz
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description David Kilzer (:ddkilzer) 2017-06-15 10:45:33 PDT
<rdar://problem/32386565>

Enable library validation for the com.apple.WebKit.Networking and com.apple.WebKit.Databases XPC services in Safari Technology Preview.
Comment 1 David Kilzer (:ddkilzer) 2017-06-15 14:37:42 PDT
Created attachment 313010 [details]
Patch v1
Comment 2 David Kilzer (:ddkilzer) 2017-08-22 13:05:18 PDT
(In reply to David Kilzer (:ddkilzer) from comment #1)
> Created attachment 313010 [details]
> Patch v1

https://bugs.webkit.org/attachment.cgi?id=313010&action=review

Review ping.
Comment 3 Joseph Pecoraro 2017-08-22 13:34:11 PDT
Comment on attachment 313010 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=313010&action=review

> Source/WebKit2/Configurations/BaseXPCService.xcconfig:71
> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_EMPTY_$(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT)));
> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_ = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO);
> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT);
> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = $(WK_RELOCATABLE_FRAMEWORKS);

I realize this is code you are just moving, but this is recursive in a way I don't really understand because it is so complex. I also don't see what what impact the WK_EMPTY has.

It seems to me that the answer here is YES only if WK_RELOCATABLE_FRAMEWORKS. If so, can we simplify this to one of the productions below?

The sweetest:

    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_RELOCATABLE_FRAMEWORKS);

The middle ground:

    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_RELOCATABLE_FRAMEWORKS));
    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = YES;

The worst case:

    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_RELOCATABLE_FRAMEWORKS));
    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_ = NO;
    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO = NO;
    WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = YES;
Comment 4 mitz 2017-08-22 13:58:36 PDT
Comment on attachment 313010 [details]
Patch v1

View in context: https://bugs.webkit.org/attachment.cgi?id=313010&action=review

While this may achieve the desired results, semantically it is completely wrong.

> Source/WebKit2/Configurations/BaseXPCService.xcconfig:45
> +OTHER_CODE_SIGN_FLAGS[sdk=macosx*] = $(WK_XPC_DOMAIN_EXTENSION_CODE_SIGN_FLAGS);

It doesn’t make sense for the code signing flags for something that doesn’t need to domain extension entitlement to be defined in terms of the domain extension code signing flags.

>> Source/WebKit2/Configurations/BaseXPCService.xcconfig:71
>> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_EMPTY_$(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT)));
>> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_ = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO);
>> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT);
>> +WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = $(WK_RELOCATABLE_FRAMEWORKS);
> 
> I realize this is code you are just moving, but this is recursive in a way I don't really understand because it is so complex. I also don't see what what impact the WK_EMPTY has.
> 
> It seems to me that the answer here is YES only if WK_RELOCATABLE_FRAMEWORKS. If so, can we simplify this to one of the productions below?
> 
> The sweetest:
> 
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_RELOCATABLE_FRAMEWORKS);
> 
> The middle ground:
> 
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_RELOCATABLE_FRAMEWORKS));
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = YES;
> 
> The worst case:
> 
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT = $(WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_$(WK_RELOCATABLE_FRAMEWORKS));
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_ = NO;
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_NO = NO;
>     WK_WEBCONTENT_SERVICE_NEEDS_XPC_DOMAIN_EXTENSION_ENTITLEMENT_YES = YES;

It doesn’t make sense for something pertaining to the Web Content service to be defined in the generic XPC service configuration settings file.

> Source/WebKit2/Configurations/DebugRelease.xcconfig:55
> +OTHER_CODE_SIGN_FLAGS = ;

How does this work?
Comment 5 mitz 2018-01-25 10:10:57 PST
We can do it for all production builds (Safari Technology Preview, Safari releases, and macOS releases). Patch forthcoming.
Comment 6 mitz 2018-01-25 10:20:45 PST
Created attachment 332279 [details]
Enable Library Validation
Comment 7 Joseph Pecoraro 2018-01-25 11:08:36 PST
Comment on attachment 332279 [details]
Enable Library Validation

r=me
Comment 8 WebKit Commit Bot 2018-01-25 11:34:52 PST
Comment on attachment 332279 [details]
Enable Library Validation

Clearing flags on attachment: 332279

Committed r227618: <https://trac.webkit.org/changeset/227618>
Comment 9 WebKit Commit Bot 2018-01-25 11:34:54 PST
All reviewed patches have been landed.  Closing bug.