Title: [243449] trunk/Source/WebKit
- Revision
- 243449
- Author
- [email protected]
- Date
- 2019-03-25 13:38:16 -0700 (Mon, 25 Mar 2019)
Log Message
[GTK][WPE] Remove network access from web process sandbox
https://bugs.webkit.org/show_bug.cgi?id=189967
Patch by Patrick Griffis <[email protected]> on 2019-03-25
Reviewed by Michael Catanzaro.
* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::createFlatpakInfo):
(WebKit::bubblewrapSpawn):
* UIProcess/Launcher/glib/FlatpakLauncher.cpp:
(WebKit::flatpakSpawn):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (243448 => 243449)
--- trunk/Source/WebKit/ChangeLog 2019-03-25 20:29:19 UTC (rev 243448)
+++ trunk/Source/WebKit/ChangeLog 2019-03-25 20:38:16 UTC (rev 243449)
@@ -1,3 +1,16 @@
+2019-03-25 Patrick Griffis <[email protected]>
+
+ [GTK][WPE] Remove network access from web process sandbox
+ https://bugs.webkit.org/show_bug.cgi?id=189967
+
+ Reviewed by Michael Catanzaro.
+
+ * UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
+ (WebKit::createFlatpakInfo):
+ (WebKit::bubblewrapSpawn):
+ * UIProcess/Launcher/glib/FlatpakLauncher.cpp:
+ (WebKit::flatpakSpawn):
+
2019-03-25 Andy Estes <[email protected]>
[Apple Pay] Call +canMakePayments on a work queue
Modified: trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp (243448 => 243449)
--- trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp 2019-03-25 20:29:19 UTC (rev 243448)
+++ trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp 2019-03-25 20:38:16 UTC (rev 243449)
@@ -641,9 +641,6 @@
{
GUniquePtr<GKeyFile> keyFile(g_key_file_new());
- const char* sharedPermissions[] = { "network", nullptr };
- g_key_file_set_string_list(keyFile.get(), "Context", "shared", sharedPermissions, sizeof(sharedPermissions));
-
// xdg-desktop-portal relates your name to certain permissions so we want
// them to be application unique which is best done via GApplication.
GApplication* app = g_application_get_default();
@@ -686,6 +683,7 @@
"--die-with-parent",
"--unshare-pid",
"--unshare-uts",
+ "--unshare-net",
// We assume /etc has safe permissions.
// At a later point we can start masking privacy-concerning files.
@@ -748,7 +746,6 @@
}));
}
- // NOTE: This has network access for HLS via GStreamer.
if (launchOptions.processType == ProcessLauncher::ProcessType::Web) {
static XDGDBusProxyLauncher proxy;
Modified: trunk/Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp (243448 => 243449)
--- trunk/Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp 2019-03-25 20:29:19 UTC (rev 243448)
+++ trunk/Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp 2019-03-25 20:38:16 UTC (rev 243449)
@@ -51,6 +51,9 @@
childProcessSocketArg.get(),
};
+ if (launchOptions.processType == ProcessLauncher::ProcessType::Web)
+ flatpakArgs.append("--no-network");
+
char** newArgv = g_newa(char*, g_strv_length(argv) + flatpakArgs.size() + 1);
size_t i = 0;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
