Title: [263287] trunk/Source/WebKit
- Revision
- 263287
- Author
- [email protected]
- Date
- 2020-06-19 14:12:16 -0700 (Fri, 19 Jun 2020)
Log Message
[iOS, macOS] Allow access to the container manager to support Mail InjectedBundle
https://bugs.webkit.org/show_bug.cgi?id=213357
<rdar://problem/63837247>
Reviewed by Darin Adler.
The Mail Injected Bundle requires access to the container manager to support certain OS operations. We do not need
this access for web browsing, and should limit this access to this one case.
This patch creates a dynamic mach extension to the container manager for this single use case. It also denies the
non-extension access case with a backtrace so we can see if any other clients are hitting this.
* Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
* Shared/WebProcessCreationParameters.cpp:
(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):
* Shared/WebProcessCreationParameters.h:
* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::platformInitializeWebProcess):
* WebProcess/cocoa/WebProcessCocoa.mm:
(WebKit::WebProcess::platformInitializeWebProcess):
* WebProcess/com.apple.WebProcess.sb.in:
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (263286 => 263287)
--- trunk/Source/WebKit/ChangeLog 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/ChangeLog 2020-06-19 21:12:16 UTC (rev 263287)
@@ -1,3 +1,28 @@
+2020-06-19 Brent Fulgham <[email protected]>
+
+ [iOS, macOS] Allow access to the container manager to support Mail InjectedBundle
+ https://bugs.webkit.org/show_bug.cgi?id=213357
+ <rdar://problem/63837247>
+
+ Reviewed by Darin Adler.
+
+ The Mail Injected Bundle requires access to the container manager to support certain OS operations. We do not need
+ this access for web browsing, and should limit this access to this one case.
+
+ This patch creates a dynamic mach extension to the container manager for this single use case. It also denies the
+ non-extension access case with a backtrace so we can see if any other clients are hitting this.
+
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+ * Shared/WebProcessCreationParameters.cpp:
+ (WebKit::WebProcessCreationParameters::encode const):
+ (WebKit::WebProcessCreationParameters::decode):
+ * Shared/WebProcessCreationParameters.h:
+ * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+ (WebKit::WebProcessPool::platformInitializeWebProcess):
+ * WebProcess/cocoa/WebProcessCocoa.mm:
+ (WebKit::WebProcess::platformInitializeWebProcess):
+ * WebProcess/com.apple.WebProcess.sb.in:
+
2020-06-19 Andres Gonzalez <[email protected]>
AX: web process crash in AXObjectCache::postNotification.
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (263286 => 263287)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2020-06-19 21:12:16 UTC (rev 263287)
@@ -940,6 +940,10 @@
(home-subpath "/Library/Preferences/")
(with no-log))
+(deny mach-lookup (with telemetry-backtrace)
+ (global-name "com.apple.containermanagerd")
+)
+
(allow mach-lookup
(require-all
(extension "com.apple.webkit.extension.mach")
@@ -946,6 +950,7 @@
(global-name
"com.apple.cfprefsd.agent"
"com.apple.cfprefsd.daemon"
+ "com.apple.containermanagerd"
"com.apple.diagnosticd"
"com.apple.iphone.axserver-systemwide"
"com.apple.lsd.mapdb"
Modified: trunk/Source/WebKit/Shared/WebProcessCreationParameters.cpp (263286 => 263287)
--- trunk/Source/WebKit/Shared/WebProcessCreationParameters.cpp 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/Shared/WebProcessCreationParameters.cpp 2020-06-19 21:12:16 UTC (rev 263287)
@@ -161,6 +161,8 @@
encoder << frontboardServiceExtensionHandle;
#endif
+ encoder << containerManagerExtensionHandle;
+
#if PLATFORM(IOS_FAMILY)
encoder << diagnosticsExtensionHandles;
encoder << dynamicMachExtensionHandles;
@@ -435,6 +437,12 @@
parameters.frontboardServiceExtensionHandle = WTFMove(*frontboardServiceExtensionHandle);
#endif
+ Optional<Optional<SandboxExtension::Handle>> containerManagerExtensionHandle;
+ decoder >> containerManagerExtensionHandle;
+ if (!containerManagerExtensionHandle)
+ return false;
+ parameters.containerManagerExtensionHandle = WTFMove(*containerManagerExtensionHandle);
+
#if PLATFORM(IOS_FAMILY)
Optional<SandboxExtension::HandleArray> diagnosticsExtensionHandles;
decoder >> diagnosticsExtensionHandles;
Modified: trunk/Source/WebKit/Shared/WebProcessCreationParameters.h (263286 => 263287)
--- trunk/Source/WebKit/Shared/WebProcessCreationParameters.h 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/Shared/WebProcessCreationParameters.h 2020-06-19 21:12:16 UTC (rev 263287)
@@ -205,6 +205,8 @@
Optional<SandboxExtension::Handle> frontboardServiceExtensionHandle;
#endif
+ Optional<SandboxExtension::Handle> containerManagerExtensionHandle;
+
#if PLATFORM(IOS_FAMILY)
SandboxExtension::HandleArray diagnosticsExtensionHandles;
SandboxExtension::HandleArray dynamicMachExtensionHandles;
Modified: trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (263286 => 263287)
--- trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm 2020-06-19 21:12:16 UTC (rev 263287)
@@ -292,6 +292,18 @@
#endif
+static bool requiresContainerManagerAccess()
+{
+#if PLATFORM(MAC)
+ return WebCore::MacApplication::isAppleMail();
+#elif PLATFORM(IOS)
+ return WebCore::IOSApplication::isMobileMail();
+#else
+ return false;
+#endif
+}
+
+
void WebProcessPool::platformInitializeWebProcess(const WebProcessProxy& process, WebProcessCreationParameters& parameters)
{
parameters.mediaMIMETypes = process.mediaMIMETypes();
@@ -439,6 +451,12 @@
}
#endif
+ if (requiresContainerManagerAccess()) {
+ SandboxExtension::Handle handle;
+ SandboxExtension::createHandleForMachLookup("com.apple.containermanagerd", WTF::nullopt, handle);
+ parameters.containerManagerExtensionHandle = WTFMove(handle);
+ }
+
#if PLATFORM(IOS_FAMILY)
parameters.currentUserInterfaceIdiomIsPad = currentUserInterfaceIdiomIsPad();
parameters.supportsPictureInPicture = supportsPictureInPicture();
Modified: trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm (263286 => 263287)
--- trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm 2020-06-19 21:12:16 UTC (rev 263287)
@@ -283,6 +283,9 @@
SandboxExtension::consumePermanently(*parameters.frontboardServiceExtensionHandle);
#endif
+ if (parameters.containerManagerExtensionHandle)
+ SandboxExtension::consumePermanently(*parameters.containerManagerExtensionHandle);
+
#if PLATFORM(IOS_FAMILY)
SandboxExtension::consumePermanently(parameters.diagnosticsExtensionHandles);
SandboxExtension::consumePermanently(parameters.dynamicMachExtensionHandles);
Modified: trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in (263286 => 263287)
--- trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in 2020-06-19 21:08:17 UTC (rev 263286)
+++ trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in 2020-06-19 21:12:16 UTC (rev 263287)
@@ -898,6 +898,12 @@
(home-subpath "/Library/Preferences/")
(with no-log))
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101500
+(deny mach-lookup (with telemetry-backtrace)
+ (global-name "com.apple.containermanagerd")
+)
+#endif
+
(allow mach-lookup
(require-all
(extension "com.apple.webkit.extension.mach")
@@ -911,6 +917,7 @@
"com.apple.webinspector"
"com.apple.cfprefsd.agent"
"com.apple.cfprefsd.daemon"
+ "com.apple.containermanagerd"
"com.apple.tccd"
"com.apple.lsd.mapdb"
"com.apple.BluetoothServices"
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
