Changeset 228620 in webkit


Ignore:
Timestamp:
Feb 19, 2018 1:12:12 AM (6 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r228108 - Gigacage: enable only for WebContent process and token executables
​https://bugs.webkit.org/show_bug.cgi?id=182457
<rdar://problem/35875011>

Reviewed by Keith Miller.

Gigacage is a solid security improvement, but it's probably best
to roll it out incrementally to the most valuable targets first
and progressively try out more and more over time rather than
outright enabling it everywhere. We've gotten some reports that it
has some side-effects that weren't expected, so for now let's
enable it for the WebContent process, JSC, and other executables
we know, and then later we'll enable more gigacage uses.

For now I've chosen the following bundles:

  • com.apple.WebKit.WebContent.Development
  • com.apple.WebKit.WebContent
  • com.apple.WebProcess

And the following processes:

  • jsc
  • wasm
  • anything starting with "test", to match the JSC tests

I tried a different approach first, where I add a function to turn
gigacage on or off and crash if gigacage is initialized without
having been told what to do. Doing this in ChildProcess and a
bunch of the process initialization methods isn't sufficient. I
got MiniBrowser working, but some other builds use static globals
which themselves use hash and string which are allocate with
bmalloc and therefore which initialize gigacage before main is
called and before the process gets a chance to opt in our out. It
gets tricky with API calls too, because we have to do the right
thing in any entry an API user could plausibly use, even the
private ones, so I endend up having to initialize gigacage in e.g.
WebPreferencesExperimentalFeatures.cpp.erb.

Another approach could be to create a free-for-all gigacage
entitlement, and opt-in the processes we want..

As a follow-up we can also check that gigacage allocation always
succeeds if it was allowed for that process. With my change I
expect it to always succeed.

  • CMakeLists.txt:
  • bmalloc.xcodeproj/project.pbxproj:
  • bmalloc/BPlatform.h:
  • bmalloc/Gigacage.cpp:

(Gigacage::shouldBeEnabled):

  • bmalloc/ProcessCheck.h: Added.

(bmalloc::gigacageEnabledForProcess):

  • bmalloc/ProcessCheck.mm: Added.

(bmalloc::gigacageEnabledForProcess):

Location:
releases/WebKitGTK/webkit-2.20/Source/bmalloc
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.20/Source/bmalloc/CMakeLists.txt

    r226972 r228620  
    3535if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
    3636    list(APPEND bmalloc_SOURCES
     37        bmalloc/ProcessCheck.mm
    3738        bmalloc/Zone.cpp
    3839    )

  • releases/WebKitGTK/webkit-2.20/Source/bmalloc/ChangeLog

    r228619 r228620  
     12018-02-05  JF Bastien  <jfbastien@apple.com>
     2
     3        Gigacage: enable only for WebContent process and token executables
     4        https://bugs.webkit.org/show_bug.cgi?id=182457
     5        <rdar://problem/35875011>
     6
     7        Reviewed by Keith Miller.
     8
     9        Gigacage is a solid security improvement, but it's probably best
     10        to roll it out incrementally to the most valuable targets first
     11        and progressively try out more and more over time rather than
     12        outright enabling it everywhere. We've gotten some reports that it
     13        has some side-effects that weren't expected, so for now let's
     14        enable it for the WebContent process, JSC, and other executables
     15        we know, and then later we'll enable more gigacage uses.
     16
     17        For now I've chosen the following bundles:
     18
     19          - com.apple.WebKit.WebContent.Development
     20          - com.apple.WebKit.WebContent
     21          - com.apple.WebProcess
     22
     23        And the following processes:
     24
     25          - jsc
     26          - wasm
     27          - anything starting with "test", to match the JSC tests
     28
     29        I tried a different approach first, where I add a function to turn
     30        gigacage on or off and crash if gigacage is initialized without
     31        having been told what to do. Doing this in ChildProcess and a
     32        bunch of the process initialization methods isn't sufficient. I
     33        got MiniBrowser working, but some other builds use static globals
     34        which themselves use hash and string which are allocate with
     35        bmalloc and therefore which initialize gigacage before main is
     36        called and before the process gets a chance to opt in our out. It
     37        gets tricky with API calls too, because we have to do the right
     38        thing in any entry an API user could plausibly use, even the
     39        private ones, so I endend up having to initialize gigacage in e.g.
     40        WebPreferencesExperimentalFeatures.cpp.erb.
     41
     42        Another approach could be to create a free-for-all gigacage
     43        entitlement, and opt-in the processes we want..
     44
     45        As a follow-up we can also check that gigacage allocation always
     46        succeeds if it was allowed for that process. With my change I
     47        expect it to always succeed.
     48
     49        * CMakeLists.txt:
     50        * bmalloc.xcodeproj/project.pbxproj:
     51        * bmalloc/BPlatform.h:
     52        * bmalloc/Gigacage.cpp:
     53        (Gigacage::shouldBeEnabled):
     54        * bmalloc/ProcessCheck.h: Added.
     55        (bmalloc::gigacageEnabledForProcess):
     56        * bmalloc/ProcessCheck.mm: Added.
     57        (bmalloc::gigacageEnabledForProcess):
     58
    1592018-02-05  Joseph Pecoraro  <pecoraro@apple.com>
    260

  • releases/WebKitGTK/webkit-2.20/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj

    r227951 r228620  
    134134                6599C5CD1EC3F15900A2F7BB /* AvailableMemory.h in Headers */ = {isa = PBXBuildFile; fileRef = 6599C5CB1EC3F15900A2F7BB /* AvailableMemory.h */; settings = {ATTRIBUTES = (Private, ); }; };
    135135                AD0934331FCF406D00E85EB5 /* BCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = AD0934321FCF405000E85EB5 /* BCompiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
     136                AD14AD29202529C400890E3B /* ProcessCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = AD14AD27202529A600890E3B /* ProcessCheck.h */; };
     137                AD14AD2A202529C700890E3B /* ProcessCheck.mm in Sources */ = {isa = PBXBuildFile; fileRef = AD14AD28202529B000890E3B /* ProcessCheck.mm */; };
    136138/* End PBXBuildFile section */
    137139
    … …  
    290292                6599C5CB1EC3F15900A2F7BB /* AvailableMemory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AvailableMemory.h; path = bmalloc/AvailableMemory.h; sourceTree = "<group>"; };
    291293                AD0934321FCF405000E85EB5 /* BCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BCompiler.h; path = bmalloc/BCompiler.h; sourceTree = "<group>"; };
     294                AD14AD27202529A600890E3B /* ProcessCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProcessCheck.h; path = bmalloc/ProcessCheck.h; sourceTree = "<group>"; };
     295                AD14AD28202529B000890E3B /* ProcessCheck.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = ProcessCheck.mm; path = bmalloc/ProcessCheck.mm; sourceTree = "<group>"; };
    292296/* End PBXFileReference section */
    293297
    … …  
    481485                                14105E8318E14374003A106E /* ObjectType.cpp */,
    482486                                1485656018A43DBA00ED6942 /* ObjectType.h */,
     487                                AD14AD27202529A600890E3B /* ProcessCheck.h */,
     488                                AD14AD28202529B000890E3B /* ProcessCheck.mm */,
    483489                                0F5BF1501F22E1570029D91D /* Scavenger.cpp */,
    484490                                0F5BF1511F22E1570029D91D /* Scavenger.h */,
    … …  
    633639                                14DD78D018F48D7500950702 /* VMAllocate.h in Headers */,
    634640                                0F7EB83A1F9541B000F1ABCB /* IsoDeallocatorInlines.h in Headers */,
     641                                AD14AD29202529C400890E3B /* ProcessCheck.h in Headers */,
    635642                                1400274A18F89C2300115C97 /* VMHeap.h in Headers */,
    636643                                1440AFCB1A95261100837FAA /* Zone.h in Headers */,
    … …  
    766773                                14895D911A3A319C0006235D /* Environment.cpp in Sources */,
    767774                                0F7EB83F1F9541B000F1ABCB /* IsoTLSLayout.cpp in Sources */,
     775                                AD14AD2A202529C700890E3B /* ProcessCheck.mm in Sources */,
    768776                                14F271C718EA3990008C152F /* Heap.cpp in Sources */,
    769777                                0F7EB8321F9541B000F1ABCB /* IsoTLSEntry.cpp in Sources */,

  • releases/WebKitGTK/webkit-2.20/Source/bmalloc/bmalloc/BPlatform.h

    r226958 r228620  
    11/*
    2  * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6464#endif
    6565
     66#if BPLATFORM(MAC) || BPLATFORM(IOS)
     67#define BPLATFORM_COCOA 1
     68#endif
     69
     70#if defined(TARGET_OS_WATCH) && TARGET_OS_WATCH
     71#define BPLATFORM_WATCHOS 1
     72#endif
     73
    6674/* ==== Policy decision macros: these define policy choices for a particular port. ==== */
    6775

  • releases/WebKitGTK/webkit-2.20/Source/bmalloc/bmalloc/Gigacage.cpp

    r225701 r228620  
    11/*
    2  * Copyright (C) 2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2929#include "Environment.h"
    3030#include "PerProcess.h"
     31#include "ProcessCheck.h"
    3132#include "VMAllocate.h"
    3233#include "Vector.h"
    … …  
    251252        onceFlag,
    252253        [] {
     254            if (!gigacageEnabledForProcess())
     255                return;
     256
    253257            bool result = !PerProcess<Environment>::get()->isDebugHeapEnabled();
    254258            if (!result)
Note: See TracChangeset for help on using the changeset viewer.