Bug 181995 - [macOS] WebProcess needs TCC entitlements for media capture
Summary: [macOS] WebProcess needs TCC entitlements for media capture
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-01-23 11:03 PST by Brent Fulgham
Modified: 2018-05-09 14:40 PDT (History)
4 users (show)

See Also:


Attachments
Patch (1.32 KB, patch)
2018-01-23 11:04 PST, Brent Fulgham
eric.carlson: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2018-01-23 11:03:06 PST
Now that TCC controls access to camera and microphone on macOS, the web process needs to have the following entitlements for our dynamic sandbox extension to work:

com.apple.tcc.delegated-services 
    kTCCServiceCamera
    kTCCServiceMicrophone
Comment 1 Brent Fulgham 2018-01-23 11:03:35 PST
<rdar://problem/36674649>
Comment 2 Brent Fulgham 2018-01-23 11:04:32 PST
Created attachment 332041 [details]
Patch
Comment 3 Brent Fulgham 2018-01-23 12:50:52 PST
Committed r227436: <https://trac.webkit.org/changeset/227436>
Comment 4 mitz 2018-03-01 21:42:37 PST
Comment on attachment 332041 [details]
Patch

WebContent-OSX.entitlements is only used when the Web Content services needs the domain extension entitlement, which is only when it is relocatable (such as in Safari Technology Preview). Was this patch intended to grant the service this entitlement also when it’s installed as part of macOS or a Safari update?
Comment 5 Brent Fulgham 2018-03-02 09:03:50 PST
(In reply to mitz from comment #4)
> Comment on attachment 332041 [details]
> Patch
> 
> WebContent-OSX.entitlements is only used when the Web Content services needs
> the domain extension entitlement, which is only when it is relocatable (such
> as in Safari Technology Preview). Was this patch intended to grant the
> service this entitlement also when it’s installed as part of macOS or a
> Safari update?

Yes!

Where do those entitlements live?
Comment 6 Brent Fulgham 2018-05-09 14:40:09 PDT
Dan answered this question in comment 5 in bug 184485.