- Revision
- 185298
- Author
- [email protected]
- Date
- 2015-06-06 19:08:46 -0700 (Sat, 06 Jun 2015)
Log Message
[iOS] Can’t debug with Development XPC services due to automatic sandboxing
https://bugs.webkit.org/show_bug.cgi?id=145731
Reviewed by Darin Adler.
In iOS, the XPC services are automatically sandboxed based on their entitlements. The
sandbox doesn’t allow them to re-exec, which is necessary for linking against engineering
builds of the WebKit frameworks placed in a non-system location.
The solution is to opt Engineering builds into manual sandboxing.
* Configurations/BaseTarget.xcconfig:
- Add ENABLE_MANUAL_SANDBOXING to
GCC_PREPROCESSOR_DEFINITIONS when WK_MANUAL_SANDBOXING_ENABLED is YES.
- Set WK_MANUAL_SANDBOXING_ENABLED to YES for OS X, because we always use manual
sandboxing on that platform.
* Configurations/DebugRelease.xcconfig: Removed unused definition of DEBUG_OR_RELEASE. Set
WK_MANUAL_SANDBOXING_ENABLED to YES for all engineering builds.
* Configurations/BaseXPCService.xcconfig: Define CODE_SIGN_ENTITLEMENTS for iOS to be empty
if the service is not installed; to use the base entitlements file from Configurations if
manual sandboxing is not enabled; and to use a derived entitlements file, which doesn’t
specify a sandbox profile, if manual sandboxing is enabled.
* Configurations/DatabaseService.Development.xcconfig: Define
WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE and let BaseXPCService.xcconfig define
CODE_SIGN_ENTITLEMENTS for iOS.
* Configurations/DatabaseService.xcconfig: Ditto.
* Configurations/NetworkService.Development.xcconfig: Ditto.
* Configurations/NetworkService.xcconfig: Ditto.
* Configurations/WebContentService.Development.xcconfig: Ditto.
* Configurations/WebContentService.xcconfig: Ditto.
* WebKit2.xcodeproj/project.pbxproj:
- In the Derived Sources target, added a Derive Entitlements for Manual Sandboxing script
build phase. When building for iOS with manual sandboxing enabled, it creates copies of
the iOS entitlements files with a -no-sandbox suffix and the seatbelt-profiles key
removed.
- In the WebKit target, added a Copy iOS Sandbox Profiles for Manual Sandboxing script build
phase. When building for iOS with manual sandboxing enabled, it copies the iOS sandbox
profiles into the framework, so that the services can apply them to themselves at runtime.
* Shared/ios/ChildProcessIOS.mm:
(WebKit::ChildProcess::initializeSandbox): Use ENABLE(MANUAL_SANDBOXING) and don’t define it
here.
* WebProcess/cocoa/WebProcessCocoa.mm:
(WebKit::WebProcess::initializeSandbox): Use ENABLE(MANUAL_SANDBOXING) instead of defining
and using ENABLE_MANUAL_WEBPROCESS_SANDBOXING here.
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (185297 => 185298)
--- trunk/Source/WebKit2/ChangeLog 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/ChangeLog 2015-06-07 02:08:46 UTC (rev 185298)
@@ -1,3 +1,57 @@
+2015-06-06 Dan Bernstein <[email protected]>
+
+ [iOS] Can’t debug with Development XPC services due to automatic sandboxing
+ https://bugs.webkit.org/show_bug.cgi?id=145731
+
+ Reviewed by Darin Adler.
+
+ In iOS, the XPC services are automatically sandboxed based on their entitlements. The
+ sandbox doesn’t allow them to re-exec, which is necessary for linking against engineering
+ builds of the WebKit frameworks placed in a non-system location.
+
+ The solution is to opt Engineering builds into manual sandboxing.
+
+ * Configurations/BaseTarget.xcconfig:
+ - Add ENABLE_MANUAL_SANDBOXING to
+ GCC_PREPROCESSOR_DEFINITIONS when WK_MANUAL_SANDBOXING_ENABLED is YES.
+ - Set WK_MANUAL_SANDBOXING_ENABLED to YES for OS X, because we always use manual
+ sandboxing on that platform.
+
+ * Configurations/DebugRelease.xcconfig: Removed unused definition of DEBUG_OR_RELEASE. Set
+ WK_MANUAL_SANDBOXING_ENABLED to YES for all engineering builds.
+
+ * Configurations/BaseXPCService.xcconfig: Define CODE_SIGN_ENTITLEMENTS for iOS to be empty
+ if the service is not installed; to use the base entitlements file from Configurations if
+ manual sandboxing is not enabled; and to use a derived entitlements file, which doesn’t
+ specify a sandbox profile, if manual sandboxing is enabled.
+
+ * Configurations/DatabaseService.Development.xcconfig: Define
+ WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE and let BaseXPCService.xcconfig define
+ CODE_SIGN_ENTITLEMENTS for iOS.
+
+ * Configurations/DatabaseService.xcconfig: Ditto.
+ * Configurations/NetworkService.Development.xcconfig: Ditto.
+ * Configurations/NetworkService.xcconfig: Ditto.
+ * Configurations/WebContentService.Development.xcconfig: Ditto.
+ * Configurations/WebContentService.xcconfig: Ditto.
+
+ * WebKit2.xcodeproj/project.pbxproj:
+ - In the Derived Sources target, added a Derive Entitlements for Manual Sandboxing script
+ build phase. When building for iOS with manual sandboxing enabled, it creates copies of
+ the iOS entitlements files with a -no-sandbox suffix and the seatbelt-profiles key
+ removed.
+ - In the WebKit target, added a Copy iOS Sandbox Profiles for Manual Sandboxing script build
+ phase. When building for iOS with manual sandboxing enabled, it copies the iOS sandbox
+ profiles into the framework, so that the services can apply them to themselves at runtime.
+
+ * Shared/ios/ChildProcessIOS.mm:
+ (WebKit::ChildProcess::initializeSandbox): Use ENABLE(MANUAL_SANDBOXING) and don’t define it
+ here.
+
+ * WebProcess/cocoa/WebProcessCocoa.mm:
+ (WebKit::WebProcess::initializeSandbox): Use ENABLE(MANUAL_SANDBOXING) instead of defining
+ and using ENABLE_MANUAL_WEBPROCESS_SANDBOXING here.
+
2015-06-06 Anders Carlsson <[email protected]>
Remove support from getting plug-in information from Carbon resources
Modified: trunk/Source/WebKit2/Configurations/BaseTarget.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/BaseTarget.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/BaseTarget.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -29,7 +29,7 @@
FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_base);
GCC_PREFIX_HEADER = WebKit2Prefix.h;
-GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) FRAMEWORK_NAME=WebKit
+GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) $(WK_MANUAL_SANDBOXING_DEFINES) FRAMEWORK_NAME=WebKit
HEADER_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR)/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2 $(HEADER_SEARCH_PATHS);
OTHER_CFLAGS = $(inherited) -iframework $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks -iframework $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/Carbon.framework/Frameworks -iframework $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks -iframework $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks -iframework $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
@@ -58,3 +58,8 @@
OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH = $(OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH_$(USE_STAGING_INSTALL_PATH));
OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH_YES = -Wl,-dyld_env -Wl,DYLD_VERSIONED_FRAMEWORK_PATH=/System/Library/StagedFrameworks/Safari;
+
+WK_MANUAL_SANDBOXING_ENABLED[sdk=macosx*] = YES;
+
+WK_MANUAL_SANDBOXING_DEFINES = $(WK_MANUAL_SANDBOXING_DEFINES_$(WK_MANUAL_SANDBOXING_ENABLED));
+WK_MANUAL_SANDBOXING_DEFINES_YES = ENABLE_MANUAL_SANDBOXING;
Modified: trunk/Source/WebKit2/Configurations/BaseXPCService.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/BaseXPCService.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/BaseXPCService.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -44,3 +44,13 @@
MACH_O_TYPE = mh_execute;
OTHER_LDFLAGS = $(inherited) $(OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH);
+
+CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = $(CODE_SIGN_ENTITLEMENTS_IOS_SKIP_INSTALL_$(SKIP_INSTALL));
+
+CODE_SIGN_ENTITLEMENTS_IOS_SKIP_INSTALL_ = $(CODE_SIGN_ENTITLEMENTS_IOS_SKIP_INSTALL_NO);
+CODE_SIGN_ENTITLEMENTS_IOS_SKIP_INSTALL_NO = $(CODE_SIGN_ENTITLEMENTS_IOS_MANUAL_SANDBOXING_$(WK_MANUAL_SANDBOXING_ENABLED));
+CODE_SIGN_ENTITLEMENTS_IOS_SKIP_INSTALL_YES = ;
+
+CODE_SIGN_ENTITLEMENTS_IOS_MANUAL_SANDBOXING_ = $(CODE_SIGN_ENTITLEMENTS_IOS_MANUAL_SANDBOXING_NO);
+CODE_SIGN_ENTITLEMENTS_IOS_MANUAL_SANDBOXING_NO = Configurations/$(WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE).entitlements;
+CODE_SIGN_ENTITLEMENTS_IOS_MANUAL_SANDBOXING_YES = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2/$(WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE)-no-sandbox.entitlements;
Modified: trunk/Source/WebKit2/Configurations/DatabaseService.Development.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/DatabaseService.Development.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/DatabaseService.Development.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,9 +24,7 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Development;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Databases-iOS;
PRODUCT_NAME = com.apple.WebKit.Databases.Development;
INFOPLIST_FILE = DatabaseProcess/EntryPoint/mac/XPCService/DatabaseService.Development/Info.plist;
-
-CODE_SIGN_ENTITLEMENTS[sdk=iphoneos*] = Configurations/Databases-iOS.entitlements
-CODE_SIGN_ENTITLEMENTS[sdk=iphonesimulator*] = Configurations/Databases-iOS.entitlements
Modified: trunk/Source/WebKit2/Configurations/DatabaseService.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/DatabaseService.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/DatabaseService.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,9 +24,7 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Normal;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = WebContent-iOS;
PRODUCT_NAME = com.apple.WebKit.Databases;
INFOPLIST_FILE = DatabaseProcess/EntryPoint/mac/XPCService/DatabaseService/Info.plist;
-
-CODE_SIGN_ENTITLEMENTS[sdk=iphoneos*] = Configurations/Databases-iOS.entitlements
-CODE_SIGN_ENTITLEMENTS[sdk=iphonesimulator*] = Configurations/Databases-iOS.entitlements
Modified: trunk/Source/WebKit2/Configurations/DebugRelease.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/DebugRelease.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/DebugRelease.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -44,9 +44,9 @@
WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_101100 = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_101000);
WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_101200 = $(WEBKIT_SYSTEM_INTERFACE_LIBRARY_macosx_101100);
-DEBUG_OR_RELEASE = YES;
-
SDKROOT[sdk=iphone*] = $(SDKROOT);
SDKROOT = $(SDKROOT_$(PLATFORM_NAME)_$(USE_INTERNAL_SDK));
SDKROOT_macosx_ = macosx;
SDKROOT_macosx_YES = macosx.internal;
+
+WK_MANUAL_SANDBOXING_ENABLED = YES;
Modified: trunk/Source/WebKit2/Configurations/NetworkService.Development.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/NetworkService.Development.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/NetworkService.Development.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,9 +24,8 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Development;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Network-iOS;
PRODUCT_NAME = com.apple.WebKit.Networking.Development;
INFOPLIST_FILE[sdk=iphone*] = NetworkProcess/EntryPoint/mac/XPCService/NetworkService.Development/Info-iOS.plist;
INFOPLIST_FILE[sdk=macosx*] = NetworkProcess/EntryPoint/mac/XPCService/NetworkService.Development/Info-OSX.plist;
-
-CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = Configurations/Network-iOS.entitlements;
Modified: trunk/Source/WebKit2/Configurations/NetworkService.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/NetworkService.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/NetworkService.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,6 +24,7 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Normal;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = Network-iOS;
PRODUCT_NAME = com.apple.WebKit.Networking;
INFOPLIST_FILE[sdk=iphone*] = NetworkProcess/EntryPoint/mac/XPCService/NetworkService/Info-iOS.plist;
@@ -31,8 +32,6 @@
INFOPLIST_FILE[sdk=macosx10.9*] = NetworkProcess/EntryPoint/mac/XPCService/NetworkService/Info-OSX-10.9-10.10.plist;
INFOPLIST_FILE[sdk=macosx10.10*] = NetworkProcess/EntryPoint/mac/XPCService/NetworkService/Info-OSX-10.9-10.10.plist;
-CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = Configurations/Network-iOS.entitlements;
-
OTHER_LDFLAGS = $(inherited) $(OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH) $(OTHER_LDFLAGS_PLATFORM);
OTHER_LDFLAGS_PLATFORM[sdk=macosx*] = $(BUILT_PRODUCTS_DIR)/SecItemShim.dylib;
OTHER_LDFLAGS_PLATFORM[sdk=macosx10.9*] = ;
Modified: trunk/Source/WebKit2/Configurations/WebContentService.Development.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/WebContentService.Development.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/WebContentService.Development.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,6 +24,7 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Development;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = WebContent-iOS;
PRODUCT_NAME = com.apple.WebKit.WebContent.Development;
INFOPLIST_FILE[sdk=iphone*] = WebProcess/EntryPoint/mac/XPCService/WebContentService.Development/Info-iOS.plist;
@@ -36,7 +37,5 @@
BUNDLE_LOCALIZATION_KEY_macosx_101100 = CFBundleFollowParentLocalization;
BUNDLE_LOCALIZATION_KEY_macosx_101200 = CFBundleFollowParentLocalization;
-CODE_SIGN_ENTITLEMENTS[sdk=iphoneos*] = Configurations/WebContent-iOS.entitlements;
-
OTHER_LDFLAGS = $(inherited) $(OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH) $(OTHER_LDFLAGS_PLATFORM);
OTHER_LDFLAGS_PLATFORM[sdk=macosx*] = -framework AppKit;
Modified: trunk/Source/WebKit2/Configurations/WebContentService.xcconfig (185297 => 185298)
--- trunk/Source/WebKit2/Configurations/WebContentService.xcconfig 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Configurations/WebContentService.xcconfig 2015-06-07 02:08:46 UTC (rev 185298)
@@ -24,6 +24,7 @@
#include "BaseXPCService.xcconfig"
WK_XPC_SERVICE_VARIANT = Normal;
+WK_XPC_SERVICE_IOS_ENTITLEMENTS_BASE = WebContent-iOS;
PRODUCT_NAME = com.apple.WebKit.WebContent;
INFOPLIST_FILE[sdk=iphone*] = WebProcess/EntryPoint/mac/XPCService/WebContentService/Info-iOS.plist;
@@ -38,8 +39,6 @@
BUNDLE_LOCALIZATION_KEY_macosx_101100 = CFBundleFollowParentLocalization;
BUNDLE_LOCALIZATION_KEY_macosx_101200 = CFBundleFollowParentLocalization;
-CODE_SIGN_ENTITLEMENTS[sdk=iphoneos*] = Configurations/WebContent-iOS.entitlements;
-
OTHER_LDFLAGS = $(inherited) $(OTHER_LDFLAGS_VERSIONED_FRAMEWORK_PATH) $(OTHER_LDFLAGS_PLATFORM);
OTHER_LDFLAGS_PLATFORM[sdk=macosx*] = -framework AppKit $(BUILT_PRODUCTS_DIR)/WebProcessShim.dylib;
OTHER_LDFLAGS_PLATFORM[sdk=macosx10.9*] = -framework AppKit;
Modified: trunk/Source/WebKit2/Shared/ios/ChildProcessIOS.mm (185297 => 185298)
--- trunk/Source/WebKit2/Shared/ios/ChildProcessIOS.mm 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/Shared/ios/ChildProcessIOS.mm 2015-06-07 02:08:46 UTC (rev 185298)
@@ -41,12 +41,8 @@
#import <WebCore/FloatingPointEnvironment.h>
-#ifndef ENABLE_MANUAL_SANDBOXING
-#define ENABLE_MANUAL_SANDBOXING 0
-#endif
+#if ENABLE(MANUAL_SANDBOXING)
-#if ENABLE_MANUAL_SANDBOXING
-
// We have to #undef __APPLE_API_PRIVATE to prevent sandbox.h from looking for a header file that does not exist (<rdar://problem/9679211>).
#undef __APPLE_API_PRIVATE
#import <sandbox.h>
@@ -74,7 +70,7 @@
void ChildProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
{
-#if ENABLE_MANUAL_SANDBOXING
+#if ENABLE(MANUAL_SANDBOXING)
NSBundle *webkit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")];
String defaultProfilePath = [webkit2Bundle pathForResource:[[NSBundle mainBundle] bundleIdentifier] ofType:@"sb"];
if (sandboxParameters.systemDirectorySuffix().isNull()) {
Modified: trunk/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj (185297 => 185298)
--- trunk/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj 2015-06-07 02:08:46 UTC (rev 185298)
@@ -74,6 +74,7 @@
buildConfigurationList = C0CE72891247E68600BC0EC4 /* Build configuration list for PBXAggregateTarget "Derived Sources" */;
buildPhases = (
C0CE72841247E66800BC0EC4 /* Generate Derived Sources */,
+ 3740E7281B23724A004ADEF1 /* Derive Entitlements for Manual Sandboxing */,
);
dependencies = (
);
@@ -8690,6 +8691,7 @@
1A1D2115191D96380001619F /* Postprocess Framework Headers */,
8DC2EF520486A6940098B216 /* Resources */,
7CB16FEE1724BA05007A0A95 /* Copy Plug-in Sandbox Profiles */,
+ 37E531011B2391090074F0DF /* Copy iOS Sandbox Profiles for Manual Sandboxing */,
1A07D2F71919B36500ECDA16 /* Copy Message Generation Scripts */,
8DC2EF540486A6940098B216 /* Sources */,
8DC2EF560486A6940098B216 /* Frameworks */,
@@ -9201,6 +9203,26 @@
shellPath = /bin/sh;
shellScript = "if [ \"${ACTION}\" = \"installhdrs\" ]; then\n exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-inappropriate-objc-class-names ]; then\n ../../Tools/Scripts/check-for-inappropriate-objc-class-names WK _WK || exit $?\nfi";
};
+ 3740E7281B23724A004ADEF1 /* Derive Entitlements for Manual Sandboxing */ = {
+ isa = PBXShellScriptBuildPhase;
+ buildActionMask = 2147483647;
+ files = (
+ );
+ inputPaths = (
+ "$(SRCROOT)/Configurations/Databases-iOS.entitlements",
+ "$(SRCROOT)/Configurations/Network-iOS.entitlements",
+ "$(SRCROOT)/Configurations/WebContent-iOS.entitlements",
+ );
+ name = "Derive Entitlements for Manual Sandboxing";
+ outputPaths = (
+ "$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2/Databases-iOS-no-sandbox.entitlements",
+ "$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2/Network-iOS-no-sandbox.entitlements",
+ "$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit2/WebContent-iOS-no-sandbox.entitlements",
+ );
+ runOnlyForDeploymentPostprocessing = 0;
+ shellPath = /bin/sh;
+ shellScript = "if [[ \"${WK_MANUAL_SANDBOXING_ENABLED}\" != \"YES\" || \"${PLATFORM_NAME}\" == \"macosx\" ]]; then\n exit\nfi\n\nif [[ \"${ACTION}\" == \"build\" || \"${ACTION}\" == \"install\" ]]; then\n for ((i = 0; i < ${SCRIPT_INPUT_FILE_COUNT}; ++i)); do\n eval ENTITLEMENTS=\\${SCRIPT_INPUT_FILE_${i}}\n ENTITLEMENTS_BASE=${ENTITLEMENTS##*/}\n ENTITLEMENTS_BASE=${ENTITLEMENTS_BASE%.entitlements}\n plutil -remove seatbelt-profiles -o \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebKit2/${ENTITLEMENTS_BASE}-no-sandbox.entitlements\" \"${ENTITLEMENTS}\"\n done\nfi";
+ };
375A248817E5048E00C9A086 /* Postprocess WKBase.h */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
@@ -9216,6 +9238,26 @@
shellPath = /bin/sh;
shellScript = "WKBASE_H=${TARGET_BUILD_DIR}/${PRIVATE_HEADERS_FOLDER_PATH}/WKBase.h\n\nunifdef -B -D__APPLE__ -UBUILDING_GTK__ -UUSE_SOUP -UBUILDING_EFL__ -UBUILDING_QT__ -o ${WKBASE_H}.unifdef ${WKBASE_H}\n\ncase $? in\n0)\n rm ${WKBASE_H}.unifdef\n ;;\n1)\n mv ${WKBASE_H}{.unifdef,}\n ;;\n*)\n exit 1\nesac\n";
};
+ 37E531011B2391090074F0DF /* Copy iOS Sandbox Profiles for Manual Sandboxing */ = {
+ isa = PBXShellScriptBuildPhase;
+ buildActionMask = 2147483647;
+ files = (
+ );
+ inputPaths = (
+ "$(SRCROOT)/Resources/SandboxProfiles/ios/com.apple.WebKit.Databases.sb",
+ "$(SRCROOT)/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb",
+ "$(SRCROOT)/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb",
+ );
+ name = "Copy iOS Sandbox Profiles for Manual Sandboxing";
+ outputPaths = (
+ "$(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/com.apple.WebKit.Databases.sb",
+ "$(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/com.apple.WebKit.Networking.sb",
+ "$(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/com.apple.WebKit.WebContent.sb",
+ );
+ runOnlyForDeploymentPostprocessing = 0;
+ shellPath = /bin/sh;
+ shellScript = "if [[ \"${WK_MANUAL_SANDBOXING_ENABLED}\" != \"YES\" || \"${PLATFORM_NAME}\" == \"macosx\" ]]; then\n exit\nfi\n\nif [[ \"${ACTION}\" == \"build\" || \"${ACTION}\" == \"install\" ]]; then\n for ((i = 0; i < ${SCRIPT_INPUT_FILE_COUNT}; ++i)); do\n eval SANDBOX_PROFILE=\\${SCRIPT_INPUT_FILE_${i}}\n ditto \"${SANDBOX_PROFILE}\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/${SANDBOX_PROFILE##*/}\"\n done\nfi";
+ };
5DF408C5131DD46700130071 /* Check For Weak VTables and Externals */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
@@ -11141,6 +11183,7 @@
377E7CD21B20FF9E00931AFC /* Production */,
);
defaultConfigurationIsVisible = 0;
+ defaultConfigurationName = Production;
};
510031F21379CACB00C8DFE4 /* Build configuration list for PBXNativeTarget "SecItemShim" */ = {
isa = XCConfigurationList;
Modified: trunk/Source/WebKit2/WebProcess/cocoa/WebProcessCocoa.mm (185297 => 185298)
--- trunk/Source/WebKit2/WebProcess/cocoa/WebProcessCocoa.mm 2015-06-07 02:07:15 UTC (rev 185297)
+++ trunk/Source/WebKit2/WebProcess/cocoa/WebProcessCocoa.mm 2015-06-07 02:08:46 UTC (rev 185298)
@@ -59,8 +59,6 @@
#import <stdio.h>
#import <wtf/RAMSize.h>
-#define ENABLE_MANUAL_WEBPROCESS_SANDBOXING !PLATFORM(IOS)
-
using namespace WebCore;
namespace WebKit {
@@ -207,7 +205,7 @@
void WebProcess::initializeSandbox(const ChildProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
{
#if ENABLE(WEB_PROCESS_SANDBOX)
-#if ENABLE_MANUAL_WEBPROCESS_SANDBOXING
+#if ENABLE(MANUAL_SANDBOXING)
// Need to override the default, because service has a different bundle ID.
NSBundle *webkit2Bundle = [NSBundle bundleForClass:NSClassFromString(@"WKView")];
#if PLATFORM(IOS)
