Changeset 243449 in webkit

Timestamp:

Mar 25, 2019, 1:38:16 PM (7 years ago)

Author:

commit-queue@webkit.org

Message:

[GTK][WPE] Remove network access from web process sandbox
​https://bugs.webkit.org/show_bug.cgi?id=189967

Patch by Patrick Griffis <Patrick Griffis> on 2019-03-25
Reviewed by Michael Catanzaro.

• UIProcess/Launcher/glib/BubblewrapLauncher.cpp:

(WebKit::createFlatpakInfo):
(WebKit::bubblewrapSpawn):

• UIProcess/Launcher/glib/FlatpakLauncher.cpp:

(WebKit::flatpakSpawn):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/Launcher/glib/BubblewrapLauncher.cpp (modified) (3 diffs)
• UIProcess/Launcher/glib/FlatpakLauncher.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-25  Patrick Griffis  <pgriffis@igalia.com>
+
+        [GTK][WPE] Remove network access from web process sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=189967
+
+        Reviewed by Michael Catanzaro.
+
+        * UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
+        (WebKit::createFlatpakInfo):
+        (WebKit::bubblewrapSpawn):
+        * UIProcess/Launcher/glib/FlatpakLauncher.cpp:
+        (WebKit::flatpakSpawn):
+
 2019-03-25  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

@@ -642 +642 @@
     GUniquePtr<GKeyFile> keyFile(g_key_file_new());
 
-    const char* sharedPermissions[] = { "network", nullptr };
-    g_key_file_set_string_list(keyFile.get(), "Context", "shared", sharedPermissions, sizeof(sharedPermissions));
-
     // xdg-desktop-portal relates your name to certain permissions so we want
     // them to be application unique which is best done via GApplication.
@@ -687 +684 @@
         "--unshare-pid",
         "--unshare-uts",
+        "--unshare-net",
 
         // We assume /etc has safe permissions.
@@ -749 +747 @@
     }
 
-    // NOTE: This has network access for HLS via GStreamer.
     if (launchOptions.processType == ProcessLauncher::ProcessType::Web) {
         static XDGDBusProxyLauncher proxy;

trunk/Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp

@@ -52 +52 @@
     };
 
+    if (launchOptions.processType == ProcessLauncher::ProcessType::Web)
+        flatpakArgs.append("--no-network");
+
     char** newArgv = g_newa(char*, g_strv_length(argv) + flatpakArgs.size() + 1);
     size_t i = 0;