Bug 190619 - [GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox
Summary: [GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-10-16 08:36 PDT by Patrick Griffis
Modified: 2018-10-16 19:20 PDT (History)
3 users (show)

See Also:


Attachments
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox (7.97 KB, patch)
2018-10-16 08:37 PDT, Patrick Griffis
no flags Details | Formatted Diff | Diff
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox (7.72 KB, patch)
2018-10-16 11:29 PDT, Patrick Griffis
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Patrick Griffis 2018-10-16 08:36:56 PDT
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox
Comment 1 Patrick Griffis 2018-10-16 08:37:41 PDT
Created attachment 352457 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox
Comment 2 Michael Catanzaro 2018-10-16 09:18:04 PDT
Comment on attachment 352457 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox

View in context: https://bugs.webkit.org/attachment.cgi?id=352457&action=review

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:43
> +static int createSealedMemFdWithData(const char *name, gconstpointer data, size_t size)

const char* name

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:129
> +    void setPermissions(Vector<CString>& permissions)

Vector<CString>&&

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:132
> +        m_permissions = permissions;

WTFMove(permissions)

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:651
> +        g_warning("GApplication is required for portal access");

This warning message should be a bit more detailed, so users understand what is actually wrong:

"GApplication is required for xdg-desktop-portal access in the WebKit sandbox. Actions that require xdg-desktop-portal will be broken. To fix this, create a GApplication."

or something along those lines.

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:738
> +    // xdg-desktop-portal defaults to assuming you are host application with
> +    // full permissions unless it can identify you as a snap or flatpak.
> +    // The easiest method is for us to pretend to be a flatpak and if that
> +    // fails just blocking portals entirely as it just becomes a sandbox escape.

Is Alex OK with supporting this hackery? It's OK for now, but seems like not a great long-term solution.
Comment 3 Michael Catanzaro 2018-10-16 09:19:14 PDT
Comment on attachment 352457 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox

View in context: https://bugs.webkit.org/attachment.cgi?id=352457&action=review

> Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp:805
> +            proxy.setPermissions(permissions);

WTFMove() here as well. Basically, whenever you are sinking a value into a caller such that the callee doesn't need it anymore, consider WTFMove() and &&.
Comment 4 Patrick Griffis 2018-10-16 11:29:18 PDT
Created attachment 352478 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox
Comment 5 Michael Catanzaro 2018-10-16 15:07:22 PDT
Comment on attachment 352478 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox

View in context: https://bugs.webkit.org/attachment.cgi?id=352478&action=review

> Source/WebKit/ChangeLog:14
> +        (WebKit::XDGDBusProxyLauncher::setPermissions):

Umm this hunk of the patch disappeared, what happened to it? How does it build?
Comment 6 Patrick Griffis 2018-10-16 17:33:39 PDT
(In reply to Michael Catanzaro from comment #5)
> > Source/WebKit/ChangeLog:14
> > +        (WebKit::XDGDBusProxyLauncher::setPermissions):
> 
> Umm this hunk of the patch disappeared, what happened to it? How does it
> build?

Already had a version that took `Vector<CString>&&`. Was just missing `WTFMove()` which makes sense.
Comment 7 WebKit Commit Bot 2018-10-16 19:19:17 PDT
Comment on attachment 352478 [details]
[GTK][WPE] Fix xdg-desktop-portal permissions from a sandbox

Clearing flags on attachment: 352478

Committed r237213: <https://trac.webkit.org/changeset/237213>
Comment 8 WebKit Commit Bot 2018-10-16 19:19:19 PDT
All reviewed patches have been landed.  Closing bug.
Comment 9 Radar WebKit Bug Importer 2018-10-16 19:20:31 PDT
<rdar://problem/45326563>