Changeset 259753 in webkit

Timestamp:

Apr 8, 2020, 1:15:58 PM (6 years ago)

Author:

pvollan@apple.com

Message:

[macOS] Crash under WebKit::SandboxExtension::consume
​https://bugs.webkit.org/show_bug.cgi?id=210188

Reviewed by Geoffrey Garen.

Source/WebKit:

When issuing a mach lookup extension to the database mapping service in the UI process fails, the WebContent
process will crash when trying to consume the extension.

No new tests, since I am not able to reproduce the issue.

• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):

• WebProcess/com.apple.WebProcess.sb.in:

LayoutTests:

• fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
• fast/sandbox/mac/sandbox-mach-lookup.html:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/sandbox/mac/sandbox-mach-lookup-expected.txt (modified) (1 diff)
• LayoutTests/fast/sandbox/mac/sandbox-mach-lookup.html (modified) (1 diff)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm (modified) (1 diff)
• Source/WebKit/WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-04-08  Per Arne Vollan  <pvollan@apple.com>
+
+        [macOS] Crash under WebKit::SandboxExtension::consume
+        https://bugs.webkit.org/show_bug.cgi?id=210188
+
+        Reviewed by Geoffrey Garen.
+
+        * fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
+        * fast/sandbox/mac/sandbox-mach-lookup.html:
+
 2020-04-08  Jacob Uphoff  <jacob_uphoff@apple.com>
 

trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup-expected.txt

@@ -9 +9 @@
 PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.nesessionmanager.content-filter") is false
 PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.system.logger") is false
-PASS internals.hasSandboxMachLookupAccessToGlobalName("com.apple.WebKit.WebContent", "com.apple.lsd.mapdb") is false
 

trunk/LayoutTests/fast/sandbox/mac/sandbox-mach-lookup.html

@@ -12 +12 @@
     shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.nesessionmanager.content-filter\")");
     shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.system.logger\")");
-    shouldBeFalse("internals.hasSandboxMachLookupAccessToGlobalName(\"com.apple.WebKit.WebContent\", \"com.apple.lsd.mapdb\")");
 }
 </script>

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-04-08  Per Arne Vollan  <pvollan@apple.com>
+
+        [macOS] Crash under WebKit::SandboxExtension::consume
+        https://bugs.webkit.org/show_bug.cgi?id=210188
+
+        Reviewed by Geoffrey Garen.
+
+        When issuing a mach lookup extension to the database mapping service in the UI process fails, the WebContent
+        process will crash when trying to consume the extension.
+
+        No new tests, since I am not able to reproduce the issue.
+
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::platformInitializeWebProcess):
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2020-04-08  Rob Buis  <rbuis@igalia.com>
 

trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

@@ -412 +412 @@
 
     SandboxExtension::Handle mapDBHandle;
-    SandboxExtension::createHandleForMachLookup("com.apple.lsd.mapdb", WTF::nullopt, mapDBHandle, SandboxExtension::Flags::NoReport);
-    parameters.mapDBExtensionHandle = WTFMove(mapDBHandle);
+    if (SandboxExtension::createHandleForMachLookup("com.apple.lsd.mapdb", WTF::nullopt, mapDBHandle, SandboxExtension::Flags::NoReport))
+        parameters.mapDBExtensionHandle = WTFMove(mapDBHandle);
 #endif
     

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -688 +688 @@
 )
 
-(deny mach-lookup
 #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101600
-    (with telemetry-backtrace)
+(deny mach-lookup (with telemetry-backtrace)
+#else
+(allow mach-lookup
 #endif
     (global-name "com.apple.lsd.mapdb")