Changeset 170686 in webkit

Timestamp:

Jul 1, 2014, 6:24:17 PM (12 years ago)

Author:

commit-queue@webkit.org

Message:

Unreviewed, rolling out r170608.
​https://bugs.webkit.org/show_bug.cgi?id=134533

Safari keeps crashing on device due to sandbox violation.
(Requested by enrica on #webkit).

Reverted changeset:

"Restrict network process sandbox"
​https://bugs.webkit.org/show_bug.cgi?id=134360
​http://trac.webkit.org/changeset/170608

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/cocoa/NetworkProcessCocoa.mm (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb (modified) (1 diff)
• Shared/Network/NetworkProcessCreationParameters.cpp (modified) (2 diffs)
• Shared/Network/NetworkProcessCreationParameters.h (modified) (1 diff)
• Shared/mac/SandboxUtilities.cpp (modified) (2 diffs)
• Shared/mac/SandboxUtilities.h (modified) (2 diffs)
• UIProcess/WebContext.cpp (modified) (1 diff)
• UIProcess/mac/WebContextMac.mm (modified) (2 diffs)
• WebProcess/cocoa/WebProcessCocoa.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-07-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r170608.
+        https://bugs.webkit.org/show_bug.cgi?id=134533
+
+        Safari keeps crashing on device due to sandbox violation.
+        (Requested by enrica on #webkit).
+
+        Reverted changeset:
+
+        "Restrict network process sandbox"
+        https://bugs.webkit.org/show_bug.cgi?id=134360
+        http://trac.webkit.org/changeset/170608
+
 2014-07-01  Pratik Solanki  <psolanki@apple.com>
 

trunk/Source/WebKit2/NetworkProcess/cocoa/NetworkProcessCocoa.mm

@@ -61 +61 @@
 void NetworkProcess::platformInitializeNetworkProcessCocoa(const NetworkProcessCreationParameters& parameters)
 {
-    SandboxExtension::consumePermanently(parameters.cookieStorageDirectoryExtensionHandle);
+#if PLATFORM(IOS)
+    if (!parameters.uiProcessBundleIdentifier.isNull()) {
+        [NSURLCache setSharedURLCache:adoptNS([[NSURLCache alloc]
+            _initWithMemoryCapacity:parameters.nsURLCacheMemoryCapacity
+            diskCapacity:parameters.nsURLCacheDiskCapacity
+            relativePath:parameters.uiProcessBundleIdentifier]).get()];
+    }
+#else
     m_diskCacheDirectory = parameters.diskCacheDirectory;
 
     if (!m_diskCacheDirectory.isNull()) {
         SandboxExtension::consumePermanently(parameters.diskCacheDirectoryExtensionHandle);
-#if PLATFORM(IOS)
-        [NSURLCache setSharedURLCache:adoptNS([[NSURLCache alloc]
-            _initWithMemoryCapacity:parameters.nsURLCacheMemoryCapacity
-            diskCapacity:parameters.nsURLCacheDiskCapacity
-            relativePath:parameters.uiProcessBundleIdentifier]).get()];
-#else
         [NSURLCache setSharedURLCache:adoptNS([[NSURLCache alloc]
             initWithMemoryCapacity:parameters.nsURLCacheMemoryCapacity
             diskCapacity:parameters.nsURLCacheDiskCapacity
             diskPath:parameters.diskCacheDirectory]).get()];
+    }
 #endif
-    }
 
 #if PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090

trunk/Source/WebKit2/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb

@@ -23 +23 @@
 
 (version 1)
-(deny default (with partial-symbolication))
-(allow system-audit file-read-metadata)
+(allow default)
 
 (import "common.sb")
 (import "removed-dev-nodes.sb")
-
-;; Access CFNetwork shared cookies
-;; This is too generous -- <rdar://problem/17496756>
-(apple-cookie-access 'with-read-write)
-
-;; Sandbox extensions
-(allow file-read* (container-subpath "Library/")
-       (extension "com.apple.webkit.read"))
-
-;; Access to client's cache folder & re-vending to CFNetwork.
-(allow file-read* file-write* (container-subpath "Library/")
-       (extension "com.apple.nsurlstorage.extension-cache"))
-(allow file-issue-extension  (container-subpath "Library/")
-       (extension-class "com.apple.nsurlstorage.extension-cache"))
-
-;; App sandbox extensions
-(allow file-read* file-write* (container-subpath "Library/")
-       (extension "com.apple.app-sandbox.read-write"))
-
-;; Access to own cache & temp folders.
-(allow file-read* file-write* (container-subpath "")
-       (extension "com.apple.webkit.read-write"))
-
-;; IOKit user clients
-(allow iokit-open
-       (iokit-user-client-class "RootDomainUserClient"))
-
-;; Various services required by CFNetwork and other frameworks
-(allow mach-lookup
-       (global-name "com.apple.PowerManagement.control"))
-
-(network-client)
-
-;; Security framework
-(allow mach-lookup
-       (global-name "com.apple.ocspd")
-       (global-name "com.apple.securityd"))
-
-(deny file-write-create
-       (vnode-type SYMLINK))

trunk/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.cpp

@@ -43 +43 @@
     encoder << diskCacheDirectory;
     encoder << diskCacheDirectoryExtensionHandle;
-    encoder << cookieStorageDirectory;
-    encoder << cookieStorageDirectoryExtensionHandle;
     encoder << shouldUseTestingNetworkSession;
 #if ENABLE(CUSTOM_PROTOCOLS)
@@ -75 +73 @@
         return false;
     if (!decoder.decode(result.diskCacheDirectoryExtensionHandle))
-        return false;
-    if (!decoder.decode(result.cookieStorageDirectory))
-        return false;
-    if (!decoder.decode(result.cookieStorageDirectoryExtensionHandle))
         return false;
     if (!decoder.decode(result.shouldUseTestingNetworkSession))

trunk/Source/WebKit2/Shared/Network/NetworkProcessCreationParameters.h

@@ -57 +57 @@
     SandboxExtension::Handle diskCacheDirectoryExtensionHandle;
 
-    String cookieStorageDirectory;
-    SandboxExtension::Handle cookieStorageDirectoryExtensionHandle;
-
     bool shouldUseTestingNetworkSession;
 

trunk/Source/WebKit2/Shared/mac/SandboxUtilities.cpp

@@ -28 +28 @@
 
 #include <array>
-#include <wtf/text/WTFString.h>
 
 #if __has_include(<sandbox/private.h>)
@@ -69 +68 @@
 }
 
-String pathForProcessContainer()
-{
-    std::array<char, MAXPATHLEN> path;
-    path[0] = 0;
-    sandbox_container_path_for_pid(getpid(), path.data(), path.size());
-
-    return String::fromUTF8(path.data());
 }
-
-}

trunk/Source/WebKit2/Shared/mac/SandboxUtilities.h

@@ -28 +28 @@
 
 #include <sys/types.h>
-#include <wtf/Forward.h>
 
 namespace WebKit {
@@ -35 +34 @@
 bool processHasContainer();
 
-// Returns an empty string if the process is not in a container.
-String pathForProcessContainer();
-
 }
 

trunk/Source/WebKit2/UIProcess/WebContext.cpp

@@ -412 +412 @@
         SandboxExtension::createHandleForReadWriteDirectory(parameters.diskCacheDirectory, parameters.diskCacheDirectoryExtensionHandle);
 
-    parameters.cookieStorageDirectory = cookieStorageDirectory();
-    if (!parameters.cookieStorageDirectory.isEmpty())
-        SandboxExtension::createHandleForReadWriteDirectory(parameters.cookieStorageDirectory, parameters.cookieStorageDirectoryExtensionHandle);
-
     parameters.shouldUseTestingNetworkSession = m_shouldUseTestingNetworkSession;
 

trunk/Source/WebKit2/UIProcess/mac/WebContextMac.mm

@@ -28 +28 @@
 
 #import "PluginProcessManager.h"
-#import "SandboxUtilities.h"
 #import "TextChecker.h"
 #import "WKBrowsingContextControllerInternal.h"
@@ -271 +270 @@
 String WebContext::platformDefaultCookieStorageDirectory() const
 {
-#if PLATFORM(IOS)
-    String path = pathForProcessContainer();
-    if (path.isEmpty())
-        path = NSHomeDirectory();
-
-    path = path + "/Library/Cookies";
-    return stringByResolvingSymlinksInPath(path);
-#else
     notImplemented();
     return [@"" stringByStandardizingPath];
-#endif
 }
 

trunk/Source/WebKit2/WebProcess/cocoa/WebProcessCocoa.mm

@@ -168 +168 @@
     SandboxExtension::consumePermanently(parameters.applicationCacheDirectoryExtensionHandle);
     SandboxExtension::consumePermanently(parameters.diskCacheDirectoryExtensionHandle);
-    SandboxExtension::consumePermanently(parameters.cookieStorageDirectoryExtensionHandle);
 #endif