Bug 183192 - Remove network access from the WebContent process sandbox
Summary: Remove network access from the WebContent process sandbox
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on: 178540
Blocks: 183421
  Show dependency treegraph
 
Reported: 2018-02-27 17:21 PST by Brent Fulgham
Modified: 2018-05-22 11:12 PDT (History)
10 users (show)

See Also:


Attachments
Patch (3.71 KB, patch)
2018-02-27 17:26 PST, Brent Fulgham
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews105 for mac-sierra-wk2 (2.10 MB, application/zip)
2018-02-27 18:22 PST, Build Bot
no flags Details
Patch (4.34 KB, patch)
2018-02-27 20:15 PST, Brent Fulgham
achristensen: review+
commit-queue: commit-queue-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2018-02-27 17:21:39 PST
Now that Bug 178540 is done, we can remove basic network access from the WebContent process!
Comment 1 Brent Fulgham 2018-02-27 17:23:49 PST
I've run local tests against the upcoming macOS 10.13.4 and iOS 11.3 betas and confirmed this does not break browsing or media playback.

I ran a full test pass on macOS and confirmed no new test failures.
Comment 2 Brent Fulgham 2018-02-27 17:24:20 PST
<rdar://problem/35369115>
Comment 3 Brent Fulgham 2018-02-27 17:26:20 PST
Created attachment 334717 [details]
Patch
Comment 4 Alex Christensen 2018-02-27 17:34:31 PST
Comment on attachment 334717 [details]
Patch

r=me!
HOORAY!
Comment 5 youenn fablet 2018-02-27 17:39:22 PST
In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
(allow network-outbound
     (remote udp))

Can we try removing it as well?
Comment 6 Build Bot 2018-02-27 18:22:16 PST
Comment on attachment 334717 [details]
Patch

Attachment 334717 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/6699122

Number of test failures exceeded the failure limit.
Comment 7 Build Bot 2018-02-27 18:22:17 PST
Created attachment 334721 [details]
Archive of layout-test-results from ews105 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6
Comment 8 youenn fablet 2018-02-27 18:28:17 PST
Could there still be some media loading directly from the WebProcess on this Sierra bot?
Comment 9 Brent Fulgham 2018-02-27 18:53:51 PST
(In reply to youenn fablet from comment #8)
> Could there still be some media loading directly from the WebProcess on this
> Sierra bot?

Oh, I'll bet there is. I think we only took over full media loading in High Sierra.

I'll conditionalize the patch so it only takes effect on High Sierra and newer.
Comment 10 Brent Fulgham 2018-02-27 18:54:23 PST
(In reply to youenn fablet from comment #5)
> In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
> (allow network-outbound
>      (remote udp))
> 
> Can we try removing it as well?

Absolutely! I'll try it out in the morning.
Comment 11 Brent Fulgham 2018-02-27 20:15:17 PST
Created attachment 334726 [details]
Patch
Comment 12 Brent Fulgham 2018-02-27 20:23:21 PST
(In reply to Brent Fulgham from comment #10)
> (In reply to youenn fablet from comment #5)
> > In Source/WebKit/WebProcess/com.apple.WebProcess.sb.in, there is also:
> > (allow network-outbound
> >      (remote udp))
> > 
> > Can we try removing it as well?
> 
> Absolutely! I'll try it out in the morning.

... or, right now.
Comment 13 WebKit Commit Bot 2018-02-28 08:50:58 PST
Comment on attachment 334726 [details]
Patch

Rejecting attachment 334726 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'land-attachment', '--force-clean', '--non-interactive', '--parent-command=commit-queue', 334726, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

Last 500 characters of output:
rdparty/autoinstalled/mechanize/_urllib2_fork.py", line 332, in _call_chain
    result = func(*args)
  File "/Volumes/Data/EWS/WebKit/Tools/Scripts/webkitpy/thirdparty/autoinstalled/mechanize/_urllib2_fork.py", line 1170, in https_open
    return self.do_open(conn_factory, req)
  File "/Volumes/Data/EWS/WebKit/Tools/Scripts/webkitpy/thirdparty/autoinstalled/mechanize/_urllib2_fork.py", line 1118, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 60] Operation timed out>

Full output: http://webkit-queues.webkit.org/results/6705241
Comment 14 Brent Fulgham 2018-02-28 09:17:14 PST
Committed r229093: <https://trac.webkit.org/changeset/229093>
Comment 15 Michael Catanzaro 2018-02-28 09:39:35 PST
Nice!