Bug 206906 – Limit access to 'com.apple.SecurityService' and 'com.apple.ocspd' to systems that require it

• Status: RESOLVED
• Resolution: WONTFIX
• Component: WebKit Misc.

[Brent Fulgham]

Make use of the Sandbox parameter features to allow WebKit to hint to the sandbox that it is running on a version of macOS that can benefit from updated system components.

[Radar WebKit Bug Importer]

<rdar://problem/58971886>

[Brent Fulgham]

Created attachment 389077 [details]
Patch

[Per Arne Vollan]

Comment on attachment 389077 [details]
Patch

R=me.

[Alexey Proskuryakov]

Comment on attachment 389077 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389077&action=review

> Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:622
> +        if (osVersionParts.size() < 3 || osVersionParts[2].toInt() <= 3)

The logic looks wrong here. It seems exceeding unlikely that you are getting the right set of versions here. 

This means that 10.14.3 and 10.15.3 both need the parameter, but .4 updates do not.

> Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:623
> +            sandboxParameters.addParameter("_OS_NEEDS_EME_QUIRK", "YES");

We control all parameter names, what is the need for the leading underscore?

[Brent Fulgham]

Created attachment 389100 [details]
Patch

[Brent Fulgham]

Comment on attachment 389077 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389077&action=review

>> Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:622
>> +        if (osVersionParts.size() < 3 || osVersionParts[2].toInt() <= 3)
> 
> The logic looks wrong here. It seems exceeding unlikely that you are getting the right set of versions here. 
> 
> This means that 10.14.3 and 10.15.3 both need the parameter, but .4 updates do not.

Doh!

>> Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:623
>> +            sandboxParameters.addParameter("_OS_NEEDS_EME_QUIRK", "YES");
> 
> We control all parameter names, what is the need for the leading underscore?

Consistency with the other parameters that work like this. _OS_VERSION

[Alexey Proskuryakov]

Comment on attachment 389100 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=389100&action=review

> Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:621
> +    if (osVersionParts[0].toInt() == 10 && osVersionParts[1].toInt() <= 15) {

Can you put this into an #if block too, so that it’s easier to remove in the future?

> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:674
> +(if (equal? (param "_OS_NEEDS_EME_QUIRK") "YES")

Did you check how this behaves on old OS versions? I vaguely remember that profile may fail to compile when an undefined param is used.

[Brent Fulgham]

After talking with a few other people, we're going to do this slightly differently.