Changeset 242745 in webkit

Timestamp:

Mar 11, 2019, 3:15:51 PM (7 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Block access to backboardd service
​https://bugs.webkit.org/show_bug.cgi?id=195484

Reviewed by Brent Fulgham.

This patch is addressing blocking the backboardd service "com.apple.backboard.hid.services". Getting the
backlight level in the WebContent process will initiate a connection with this service. To be able to
block the service, the backlight level is queried in the UI process and sent to the WebContent process
when the WebContent process is started, and when the backlight level is changed. On the WebContent side,
the method getting the backlight level is swizzled to return the value sent from the UI process.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::displayBrightness):
(WebKit::WebProcessPool::backlightLevelDidChangeCallback):
(WebKit::WebProcessPool::registerNotificationObservers):
(WebKit::WebProcessPool::unregisterNotificationObservers):

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::initializeNewWebProcess):

• UIProcess/WebProcessPool.h:
• WebProcess/WebProcess.h:
• WebProcess/WebProcess.messages.in:
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::currentBacklightLevel):
(WebKit::WebProcess::backlightLevelDidChange):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/spi/ios/UIKitSPI.h (modified) (2 diffs)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)
• UIProcess/Cocoa/WebProcessPoolCocoa.mm (modified) (3 diffs)
• UIProcess/WebProcessPool.cpp (modified) (1 diff)
• UIProcess/WebProcessPool.h (modified) (1 diff)
• WebProcess/WebProcess.h (modified) (3 diffs)
• WebProcess/WebProcess.messages.in (modified) (1 diff)
• WebProcess/cocoa/WebProcessCocoa.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-11  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Block access to backboardd service
+        https://bugs.webkit.org/show_bug.cgi?id=195484
+
+        Reviewed by Brent Fulgham.
+
+        This patch is addressing blocking the backboardd service "com.apple.backboard.hid.services". Getting the
+        backlight level in the WebContent process will initiate a connection with this service. To be able to
+        block the service, the backlight level is queried in the UI process and sent to the WebContent process
+        when the WebContent process is started, and when the backlight level is changed. On the WebContent side,
+        the method getting the backlight level is swizzled to return the value sent from the UI process.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::displayBrightness):
+        (WebKit::WebProcessPool::backlightLevelDidChangeCallback):
+        (WebKit::WebProcessPool::registerNotificationObservers):
+        (WebKit::WebProcessPool::unregisterNotificationObservers):
+        * UIProcess/WebProcessPool.cpp:
+        (WebKit::WebProcessPool::initializeNewWebProcess):
+        * UIProcess/WebProcessPool.h:
+        * WebProcess/WebProcess.h:
+        * WebProcess/WebProcess.messages.in:
+        * WebProcess/cocoa/WebProcessCocoa.mm:
+        (WebKit::currentBacklightLevel):
+        (WebKit::WebProcess::backlightLevelDidChange):
+
 2019-03-11  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebKit/Platform/spi/ios/UIKitSPI.h

@@ -1125 +1125 @@
 #endif
 
+@interface UIDevice ()
+@property (nonatomic, setter=_setBacklightLevel:) float _backlightLevel;
+@end
+
 static inline bool currentUserInterfaceIdiomIsPad()
 {
@@ -1188 +1192 @@
 UIEdgeInsets UIEdgeInsetsAdd(UIEdgeInsets lhs, UIEdgeInsets rhs, UIRectEdge);
 
+extern NSString *const UIBacklightLevelChangedNotification;
+
 WTF_EXTERN_C_END

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -450 +450 @@
     (global-name "com.apple.coremedia.decompressionsession")
     (global-name "com.apple.coremedia.videoqueue"))
+
+
+;; FIXME: remove the send-signal when this rule is no longer generating crashes.
+(deny mach-lookup (with send-signal SIGKILL)
+    (global-name "com.apple.backboard.hid.services"))
 
 ;; These services have been identified as unused during living-on.

trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

@@ -78 +78 @@
 #endif
 
+#if PLATFORM(IOS_FAMILY)
+SOFT_LINK_PRIVATE_FRAMEWORK(BackBoardServices)
+SOFT_LINK(BackBoardServices, BKSDisplayBrightnessGetCurrent, float, (), ());
+#endif
+
 namespace WebKit {
 using namespace WebCore;
@@ -382 +387 @@
 }
 
+#if PLATFORM(IOS_FAMILY)
+float WebProcessPool::displayBrightness()
+{
+    return BKSDisplayBrightnessGetCurrent();
+}
+    
+void WebProcessPool::backlightLevelDidChangeCallback(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
+{
+    WebProcessPool* pool = reinterpret_cast<WebProcessPool*>(observer);
+    pool->sendToAllProcesses(Messages::WebProcess::BacklightLevelDidChange(BKSDisplayBrightnessGetCurrent()));
+}
+#endif
+
 void WebProcessPool::registerNotificationObservers()
 {
-#if !PLATFORM(IOS_FAMILY)
+#if PLATFORM(IOS_FAMILY)
+    CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenter(), this, backlightLevelDidChangeCallback, (CFStringRef)UIBacklightLevelChangedNotification, nullptr, CFNotificationSuspensionBehaviorCoalesce);
+#else
     // Listen for enhanced accessibility changes and propagate them to the WebProcess.
     m_enhancedAccessibilityObserver = [[NSNotificationCenter defaultCenter] addObserverForName:WebKitApplicationDidChangeAccessibilityEnhancedUserInterfaceNotification object:nil queue:[NSOperationQueue currentQueue] usingBlock:^(NSNotification *note) {
@@ -434 +454 @@
 void WebProcessPool::unregisterNotificationObservers()
 {
-#if !PLATFORM(IOS_FAMILY)
+#if PLATFORM(IOS_FAMILY)
+    CFNotificationCenterRemoveObserver(CFNotificationCenterGetDarwinNotifyCenter(), this, (CFStringRef)UIBacklightLevelChangedNotification, nullptr);
+#else
     [[NSNotificationCenter defaultCenter] removeObserver:m_enhancedAccessibilityObserver.get()];    
     [[NSNotificationCenter defaultCenter] removeObserver:m_automaticTextReplacementNotificationObserver.get()];

trunk/Source/WebKit/UIProcess/WebProcessPool.cpp

@@ -984 +984 @@
     }
 
+#if PLATFORM(IOS_FAMILY)
+    process.send(Messages::WebProcess::BacklightLevelDidChange(displayBrightness()), 0);
+#endif
+
 #if ENABLE(REMOTE_INSPECTOR)
     // Initialize remote inspector connection now that we have a sub-process that is hosting one of our web views.

trunk/Source/WebKit/UIProcess/WebProcessPool.h

@@ -573 +573 @@
     void updateMaxSuspendedPageCount();
 
+#if PLATFORM(IOS_FAMILY)
+    static float displayBrightness();
+    static void backlightLevelDidChangeCallback(CFNotificationCenterRef, void *observer, CFStringRef name, const void *, CFDictionaryRef userInfo);    
+#endif
+
     Ref<API::ProcessPoolConfiguration> m_configuration;
 

trunk/Source/WebKit/WebProcess/WebProcess.h

@@ -245 +245 @@
 #if PLATFORM(IOS_FAMILY)
     void accessibilityProcessSuspendedNotification(bool);
+    float backlightLevel() const { return m_backlightLevel; }
 #endif
 
@@ -410 +411 @@
 #endif
 
+#if PLATFORM(IOS_FAMILY)
+    void backlightLevelDidChange(float backlightLevel);
+#endif
+
 #if ENABLE(VIDEO)
     void suspendAllMediaBuffering();
@@ -507 +512 @@
     HashMap<String, RefPtr<SandboxExtension>> m_mediaCaptureSandboxExtensions;
 #endif
+
+#if PLATFORM(IOS_FAMILY)
+    float m_backlightLevel { 0 };
+#endif
 };
 

trunk/Source/WebKit/WebProcess/WebProcess.messages.in

@@ -135 +135 @@
 #endif
 
+#if PLATFORM(IOS_FAMILY)
+    BacklightLevelDidChange(float backlightLevel)
+#endif
+
     IsJITEnabled() -> (bool enabled) Async
 

trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm

@@ -76 +76 @@
 
 #if PLATFORM(IOS_FAMILY)
+#import "UIKitSPI.h"
 #import "WKAccessibilityWebPageObjectIOS.h"
 #import <UIKit/UIAccessibility.h>
@@ -699 +700 @@
 #endif
 
+#if PLATFORM(IOS_FAMILY)
+static float currentBacklightLevel()
+{
+    return WebProcess::singleton().backlightLevel();
+}
+
+void WebProcess::backlightLevelDidChange(float backlightLevel)
+{
+    m_backlightLevel = backlightLevel;
+
+    // Swizzle -[UIDevice _backlightLevel]
+    // FIXME: remove the swizzling and related code once <rdar://problem/47603552> is fixed.
+    static std::once_flag onceFlag;
+    std::call_once(
+        onceFlag,
+        [] {
+            Method methodToPatch = class_getInstanceMethod([UIDevice class], @selector(_backlightLevel));
+            method_setImplementation(methodToPatch, reinterpret_cast<IMP>(currentBacklightLevel));
+        });
+}
+#endif
+
 void WebProcess::setMediaMIMETypes(const Vector<String> types)
 {