- Revision
- 276721
- Author
- [email protected]
- Date
- 2021-04-28 10:27:34 -0700 (Wed, 28 Apr 2021)
Log Message
[iOS] [GPU] The UI process should issue mach sandbox extensions to 'iconservices'
https://bugs.webkit.org/show_bug.cgi?id=225111
<rdar://problem/68366888>
Reviewed by Per Arne Vollan.
In Bug 205443 we did work to extend access to non-web-browsing services to the WebContent process only when
needed. This was lost in the transition to the GPU Process, and should be added back.
This change does the following:
1. Adds sandbox extension handles for the iconservices (and related) services to the GPU process creation parameters.
2. Updates the GPUProcessProxy to extend iconservices when waranted, and add them to the creation parameter structure.
3. Updates the GPUProcess to consume the extensions (when granted).
4. Makes a GPU process-specific version of the 'nonBrowserServices' static function for use by GPUProcessProxy. This is needed
because fewer services are needed in the GPU process than in the WebContent process.
5. Removes unused telemetry from the WebContent process sandbox.
6. Switches the GPU process sandbox to deny iconservices (and related) by default, and to consume the extensions instead.
Tested by exisiting TestWebKitAPI tests.
* GPUProcess/GPUProcess.cpp:
(WebKit::GPUProcess::initializeGPUProcess):
* GPUProcess/GPUProcessCreationParameters.cpp:
(WebKit::GPUProcessCreationParameters::encode const):
(WebKit::GPUProcessCreationParameters::decode):
* GPUProcess/GPUProcessCreationParameters.h:
* Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
* Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
* UIProcess/GPU/GPUProcessProxy.cpp:
(WebKit::GPUProcessProxy::GPUProcessProxy):
Modified Paths
Diff
Modified: trunk/Source/WebKit/ChangeLog (276720 => 276721)
--- trunk/Source/WebKit/ChangeLog 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/ChangeLog 2021-04-28 17:27:34 UTC (rev 276721)
@@ -1,3 +1,36 @@
+2021-04-28 Brent Fulgham <[email protected]>
+
+ [iOS] [GPU] The UI process should issue mach sandbox extensions to 'iconservices'
+ https://bugs.webkit.org/show_bug.cgi?id=225111
+ <rdar://problem/68366888>
+
+ Reviewed by Per Arne Vollan.
+
+ In Bug 205443 we did work to extend access to non-web-browsing services to the WebContent process only when
+ needed. This was lost in the transition to the GPU Process, and should be added back.
+
+ This change does the following:
+ 1. Adds sandbox extension handles for the iconservices (and related) services to the GPU process creation parameters.
+ 2. Updates the GPUProcessProxy to extend iconservices when waranted, and add them to the creation parameter structure.
+ 3. Updates the GPUProcess to consume the extensions (when granted).
+ 4. Makes a GPU process-specific version of the 'nonBrowserServices' static function for use by GPUProcessProxy. This is needed
+ because fewer services are needed in the GPU process than in the WebContent process.
+ 5. Removes unused telemetry from the WebContent process sandbox.
+ 6. Switches the GPU process sandbox to deny iconservices (and related) by default, and to consume the extensions instead.
+
+ Tested by exisiting TestWebKitAPI tests.
+
+ * GPUProcess/GPUProcess.cpp:
+ (WebKit::GPUProcess::initializeGPUProcess):
+ * GPUProcess/GPUProcessCreationParameters.cpp:
+ (WebKit::GPUProcessCreationParameters::encode const):
+ (WebKit::GPUProcessCreationParameters::decode):
+ * GPUProcess/GPUProcessCreationParameters.h:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
+ * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+ * UIProcess/GPU/GPUProcessProxy.cpp:
+ (WebKit::GPUProcessProxy::GPUProcessProxy):
+
2021-04-28 Chris Dumez <[email protected]>
Crash under GPUProcessProxy::getGPUProcessConnection()
Modified: trunk/Source/WebKit/GPUProcess/GPUProcess.cpp (276720 => 276721)
--- trunk/Source/WebKit/GPUProcess/GPUProcess.cpp 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/GPUProcess/GPUProcess.cpp 2021-04-28 17:27:34 UTC (rev 276721)
@@ -223,6 +223,7 @@
#if PLATFORM(IOS_FAMILY)
SandboxExtension::consumePermanently(parameters.compilerServiceExtensionHandles);
SandboxExtension::consumePermanently(parameters.dynamicIOKitExtensionHandles);
+ SandboxExtension::consumePermanently(parameters.dynamicMachExtensionHandles);
#endif
#if HAVE(CGIMAGESOURCE_WITH_SET_ALLOWABLE_TYPES)
Modified: trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.cpp (276720 => 276721)
--- trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.cpp 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.cpp 2021-04-28 17:27:34 UTC (rev 276721)
@@ -64,6 +64,7 @@
#if PLATFORM(IOS_FAMILY)
encoder << compilerServiceExtensionHandles;
encoder << dynamicIOKitExtensionHandles;
+ encoder << dynamicMachExtensionHandles;
#endif
}
@@ -117,6 +118,12 @@
if (!dynamicIOKitExtensionHandles)
return false;
result.dynamicIOKitExtensionHandles = WTFMove(*dynamicIOKitExtensionHandles);
+
+ Optional<SandboxExtension::HandleArray> dynamicMachExtensionHandles;
+ decoder >> dynamicMachExtensionHandles;
+ if (!dynamicMachExtensionHandles)
+ return false;
+ result.dynamicMachExtensionHandles = WTFMove(*dynamicMachExtensionHandles);
#endif
return true;
Modified: trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.h (276720 => 276721)
--- trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.h 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.h 2021-04-28 17:27:34 UTC (rev 276721)
@@ -62,6 +62,7 @@
#if PLATFORM(IOS_FAMILY)
SandboxExtension::HandleArray compilerServiceExtensionHandles;
SandboxExtension::HandleArray dynamicIOKitExtensionHandles;
+ SandboxExtension::HandleArray dynamicMachExtensionHandles;
#endif
void encode(IPC::Encoder&) const;
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb (276720 => 276721)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb 2021-04-28 17:27:34 UTC (rev 276721)
@@ -403,10 +403,6 @@
"com.apple.mt"
"com.apple.preferences.sounds")
- (allow mach-lookup (with report) (with telemetry)
- (global-name "com.apple.frontboard.systemappservices") ; -[UIViewServiceInterface _createProcessAssertion] -> SBSProcessIDForDisplayIdentifier()
- )
-
(allow mach-lookup
(global-name "com.apple.CARenderServer"))
@@ -724,9 +720,6 @@
;; <rdar://problem/7344719&26323449> LaunchServices app icons
(allow file-read*
(well-known-system-group-container-subpath "/systemgroup.com.apple.lsd.iconscache"))
-(allow mach-lookup (with report) (with telemetry)
- (xpc-service-name "com.apple.iconservices")
- (global-name "com.apple.iconservices"))
(allow-preferences-common)
@@ -925,8 +918,7 @@
(media-accessibility-support)
;; Various services required by CFNetwork and other frameworks
-(allow mach-lookup
- (global-name "com.apple.PowerManagement.control")
+(allow mach-lookup (with telemetry-backtrace)
(global-name "com.apple.analyticsd"))
(deny file-write-create (vnode-type SYMLINK))
@@ -942,6 +934,17 @@
(literal "/usr/local/lib/log") ; <rdar://problem/36629495>
)
+(allow mach-lookup
+ (require-all
+ (extension "com.apple.webkit.extension.mach")
+ (global-name
+ "com.apple.PowerManagement.control"
+ "com.apple.frontboard.systemappservices"
+ "com.apple.iconservices"
+ )
+ )
+)
+
(allow iokit-open
(require-all
(extension "com.apple.webkit.extension.iokit")
@@ -964,6 +967,16 @@
(xpc-service-name "com.apple.audio.toolbox.reporting.service")
)
+(deny mach-lookup (with telemetry-backtrace)
+ (xpc-service-name "com.apple.iconservices")
+ (global-name
+ "com.apple.PowerManagement.control"
+ "com.apple.iconservices"
+ "com.apple.frontboard.systemappservices"
+ )
+)
+
+
(allow mach-lookup
(require-all
(extension "com.apple.webkit.extension.mach")
Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (276720 => 276721)
--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb 2021-04-28 17:27:34 UTC (rev 276721)
@@ -1159,7 +1159,7 @@
;;; FIXME(207716): End services to remove.
)))
-(allow mach-lookup (with telemetry-backtrace)
+(allow mach-lookup
(require-all
(extension "com.apple.webkit.extension.mach")
(global-name
Modified: trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp (276720 => 276721)
--- trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp 2021-04-28 17:19:32 UTC (rev 276720)
+++ trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp 2021-04-28 17:27:34 UTC (rev 276721)
@@ -107,6 +107,19 @@
}
#endif
+#if PLATFORM(IOS_FAMILY)
+static const Vector<ASCIILiteral>& nonBrowserServices()
+{
+ ASSERT(isMainRunLoop());
+ static const auto services = makeNeverDestroyed(Vector<ASCIILiteral> {
+ "com.apple.iconservices"_s,
+ "com.apple.PowerManagement.control"_s,
+ "com.apple.frontboard.systemappservices"_s
+ });
+ return services;
+}
+#endif
+
static WeakPtr<GPUProcessProxy>& singleton()
{
static NeverDestroyed<WeakPtr<GPUProcessProxy>> singleton;
@@ -194,6 +207,9 @@
parameters.compilerServiceExtensionHandles = SandboxExtension::createHandlesForMachLookup(WebCore::agxCompilerServices(), WTF::nullopt);
parameters.dynamicIOKitExtensionHandles = SandboxExtension::createHandlesForIOKitClassExtensions(WebCore::agxCompilerClasses(), WTF::nullopt);
}
+
+ if (!WebCore::IOSApplication::isMobileSafari())
+ parameters.dynamicMachExtensionHandles = SandboxExtension::createHandlesForMachLookup(nonBrowserServices(), WTF::nullopt);
#endif
// Initialize the GPU process.
