⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 230225 in webkit


Ignore:
Timestamp:
Apr 3, 2018, 4:50:14 PM (8 years ago)
Author:
Brent Fulgham
Message:

Guard against keychain/certificate access outside the network process
​https://bugs.webkit.org/show_bug.cgi?id=184214
<rdar://problem/38734795>

Reviewed by Youenn Fablet.

Use the ProcessPrivilege assertions to guard against accessing the Keychain from
a non-Networking process.

Source/WebCore:

  • Modules/webauthn/cocoa/LocalAuthenticator.mm:

(WebCore::LocalAuthenticator::makeCredential): Assert if we access the keychain from
a proces other than the Network or UI process.
(WebCore::LocalAuthenticator::getAssertion): Ditto.
(WebCore::LocalAuthenticator::issueClientCertificate const): Ditto.

  • crypto/mac/SerializedCryptoKeyWrapMac.mm:

(WebCore::createAndStoreMasterKey): Ditto.
(WebCore::findMasterKey): Ditto.
(WebCore::deleteDefaultWebCryptoMasterKey): Ditto.

  • platform/mac/SSLKeyGeneratorMac.mm:

(WebCore::signedPublicKeyAndChallengeString): Ditto.

  • platform/network/cocoa/NetworkStorageSessionCocoa.mm:

(WebCore::createPrivateStorageSession): Ditto.

  • platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Ditto.

Source/WebKit:

  • Shared/cf/ArgumentCodersCF.cpp:

(IPC::encode): Assert if we access the keychain from a proces other than the Network or UI process.
(IPC::decode): Ditto.

Location:
trunk/Source
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r230224 r230225  
     12018-04-03  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Guard against keychain/certificate access outside the network process
     4        https://bugs.webkit.org/show_bug.cgi?id=184214
     5        <rdar://problem/38734795>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Use the ProcessPrivilege assertions to guard against accessing the Keychain from
     10        a non-Networking process.
     11
     12        * Modules/webauthn/cocoa/LocalAuthenticator.mm:
     13        (WebCore::LocalAuthenticator::makeCredential): Assert if we access the keychain from
     14        a proces other than the Network or UI process.
     15        (WebCore::LocalAuthenticator::getAssertion): Ditto.
     16        (WebCore::LocalAuthenticator::issueClientCertificate const): Ditto.
     17        * crypto/mac/SerializedCryptoKeyWrapMac.mm:
     18        (WebCore::createAndStoreMasterKey): Ditto.
     19        (WebCore::findMasterKey): Ditto.
     20        (WebCore::deleteDefaultWebCryptoMasterKey): Ditto.
     21        * platform/mac/SSLKeyGeneratorMac.mm:
     22        (WebCore::signedPublicKeyAndChallengeString): Ditto.
     23        * platform/network/cocoa/NetworkStorageSessionCocoa.mm:
     24        (WebCore::createPrivateStorageSession): Ditto.
     25        * platform/network/mac/ResourceHandleMac.mm:
     26        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Ditto.
     27
    1282018-04-03  Youenn Fablet  <youenn@apple.com>
    229

  • trunk/Source/WebCore/Modules/webauthn/cocoa/LocalAuthenticator.h

    r230012 r230225  
    4848    WTF_MAKE_NONCOPYABLE(LocalAuthenticator);
    4949public:
    50     LocalAuthenticator() = default;
     50    LocalAuthenticator();
    5151    virtual ~LocalAuthenticator() = default;
    5252

  • trunk/Source/WebCore/Modules/webauthn/cocoa/LocalAuthenticator.mm

    r230012 r230225  
    4040#import <wtf/HashSet.h>
    4141#import <wtf/MainThread.h>
     42#import <wtf/ProcessPrivilege.h>
    4243#import <wtf/RetainPtr.h>
    4344#import <wtf/Vector.h>
    … …  
    109110
    110111} // LocalAuthenticatorInternal
     112
     113LocalAuthenticator::LocalAuthenticator()
     114{
     115    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     116}
    111117
    112118void LocalAuthenticator::makeCredential(const Vector<uint8_t>& hash, const PublicKeyCredentialCreationOptions& options, CreationCallback&& callback, ExceptionCallback&& exceptionCallback)

  • trunk/Source/WebCore/crypto/mac/SerializedCryptoKeyWrapMac.mm

    r226483 r230225  
    11/*
    2  * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3636#include <wtf/text/CString.h>
    3737#include <wtf/CryptographicUtilities.h>
     38#include <wtf/ProcessPrivilege.h>
    3839#include <wtf/RetainPtr.h>
    3940
    … …  
    8182static bool createAndStoreMasterKey(Vector<uint8_t>& masterKeyData)
    8283{
     84    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     85
    8386    masterKeyData.resize(masterKeySizeInBytes);
    8487    int rc = CCRandomCopyBytes(kCCRandomDefault, masterKeyData.data(), masterKeyData.size());
    … …  
    152155static bool findMasterKey(Vector<uint8_t>& masterKeyData)
    153156{
     157    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     158
    154159    NSDictionary *query = @{
    155160        (id)kSecClass : (id)kSecClassGenericPassword,
    … …  
    181186bool deleteDefaultWebCryptoMasterKey()
    182187{
     188    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     189
    183190    NSDictionary *query = @{
    184191        (id)kSecClass : (id)kSecClassGenericPassword,

  • trunk/Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm

    r228531 r230225  
    11/*
    2  * Copyright (C) 2003, 2005, 2008, 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2003-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3434#import <Security/SecAsn1Templates.h>
    3535#import <Security/SecEncodeTransform.h>
     36#import <wtf/ProcessPrivilege.h>
    3637#import <wtf/RetainPtr.h>
    3738#import <wtf/Scope.h>

  • trunk/Source/WebCore/platform/network/mac/ResourceHandleMac.mm

    r229977 r230225  
    11/*
    2  * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2004-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5151#import <wtf/BlockObjCExceptions.h>
    5252#import <wtf/CompletionHandler.h>
     53#import <wtf/ProcessPrivilege.h>
    5354#import <wtf/Ref.h>
    5455#import <wtf/SchedulePair.h>
    … …  
    496497    // return NO to -connectionShouldUseCredentialStorage: for <rdar://problem/7704943>.
    497498    if (!challenge.previousFailureCount() && challenge.protectionSpace().isProxy()) {
     499        RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    498500        NSURLAuthenticationChallenge *macChallenge = mac(challenge);
    499501        if (NSURLCredential *credential = [[NSURLCredentialStorage sharedCredentialStorage] defaultCredentialForProtectionSpace:[macChallenge protectionSpace]]) {

  • trunk/Source/WebKit/ChangeLog

    r230224 r230225  
     12018-04-03  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Guard against keychain/certificate access outside the network process
     4        https://bugs.webkit.org/show_bug.cgi?id=184214
     5        <rdar://problem/38734795>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Use the ProcessPrivilege assertions to guard against accessing the Keychain from
     10        a non-Networking process.
     11
     12        * Shared/cf/ArgumentCodersCF.cpp:
     13        (IPC::encode): Assert if we access the keychain from a proces other than the Network or UI process.
     14        (IPC::decode): Ditto.
     15
    1162018-04-03  Youenn Fablet  <youenn@apple.com>
    217

  • trunk/Source/WebKit/Shared/cf/ArgumentCodersCF.cpp

    r226499 r230225  
    11/*
    2  * Copyright (C) 2010 Apple Inc. All rights reserved.
     2 * Copyright (C) 2010-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3131#include "Encoder.h"
    3232#include <WebCore/CFURLExtras.h>
     33#include <wtf/ProcessPrivilege.h>
    3334#include <wtf/Vector.h>
    3435#include <wtf/spi/cocoa/SecuritySPI.h>
    … …  
    645646static CFDataRef copyPersistentRef(SecKeyRef key)
    646647{
     648    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    647649    // This function differs from SecItemCopyPersistentRef in that it specifies an access group.
    648650    // This is necessary in case there are multiple copies of the key in the keychain, because we
    … …  
    675677#endif
    676678#if PLATFORM(MAC)
     679    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    677680    SecKeychainItemCreatePersistentReference((SecKeychainItemRef)key, &keyData);
    678681#endif
    … …  
    688691bool decode(Decoder& decoder, RetainPtr<SecIdentityRef>& result)
    689692{
     693#if PLATFORM(COCOA)
     694    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     695#endif
     696
    690697    RetainPtr<SecCertificateRef> certificate;
    691698    if (!decode(decoder, certificate))
    … …  
    722729void encode(Encoder& encoder, SecKeychainItemRef keychainItem)
    723730{
     731    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     732
    724733    CFDataRef data;
    725734    if (SecKeychainItemCreatePersistentReference(keychainItem, &data) == errSecSuccess) {
    … …  
    731740bool decode(Decoder& decoder, RetainPtr<SecKeychainItemRef>& result)
    732741{
     742    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     743
    733744    RetainPtr<CFDataRef> data;
    734745    if (!IPC::decode(decoder, data))
    … …  
    747758void encode(Encoder& encoder, SecAccessControlRef accessControl)
    748759{
     760    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    749761    RetainPtr<CFDataRef> data = adoptCF(SecAccessControlCopyData(accessControl));
    750762    if (data)
    … …  
    754766bool decode(Decoder& decoder, RetainPtr<SecAccessControlRef>& result)
    755767{
     768    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    756769    RetainPtr<CFDataRef> data;
    757770    if (!decode(decoder, data))

  • trunk/Source/WebKit/Shared/mac/SecItemShim.cpp

    r219595 r230225  
    11/*
    2  * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3939#include <dlfcn.h>
    4040#include <mutex>
     41#include <wtf/ProcessPrivilege.h>
    4142
    4243#if USE(APPLE_INTERNAL_SDK)
    … …  
    7374static std::optional<SecItemResponseData> sendSecItemRequest(SecItemRequestData::Type requestType, CFDictionaryRef query, CFDictionaryRef attributesToMatch = 0)
    7475{
     76    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
     77
    7578    std::optional<SecItemResponseData> response;
    7679
    … …  
    9194static OSStatus webSecItemCopyMatching(CFDictionaryRef query, CFTypeRef* result)
    9295{
     96    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    9397    auto response = sendSecItemRequest(SecItemRequestData::CopyMatching, query);
    9498    if (!response)
    … …  
    101105static OSStatus webSecItemAdd(CFDictionaryRef query, CFTypeRef* result)
    102106{
     107    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    103108    auto response = sendSecItemRequest(SecItemRequestData::Add, query);
    104109    if (!response)
    … …  
    112117static OSStatus webSecItemUpdate(CFDictionaryRef query, CFDictionaryRef attributesToUpdate)
    113118{
     119    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    114120    auto response = sendSecItemRequest(SecItemRequestData::Update, query, attributesToUpdate);
    115121    if (!response)
    … …  
    121127static OSStatus webSecItemDelete(CFDictionaryRef query)
    122128{
     129    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    123130    auto response = sendSecItemRequest(SecItemRequestData::Delete, query);
    124131    if (!response)
    … …  
    130137void initializeSecItemShim(ChildProcess& process)
    131138{
     139    RELEASE_ASSERT(hasProcessPrivilege(ProcessPrivilege::CanAccessCredentials));
    132140    sharedProcess = &process;
    133141

  • trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm

    r229878 r230225  
    3434#import "SandboxExtension.h"
    3535#import "SandboxInitializationParameters.h"
    36 #import "SecItemShim.h"
    3736#import "SessionTracker.h"
    3837#import "WKAPICast.h"
    … …  
    305304    registerWithStateDumper();
    306305#endif
    307 
    308 #if ENABLE(SEC_ITEM_SHIM)
    309     initializeSecItemShim(*this);
    310 #endif
    311306}
    312307
Note: See TracChangeset for help on using the changeset viewer.