Changeset 263287 in webkit

Timestamp:

Jun 19, 2020, 2:12:16 PM (6 years ago)

Author:

Brent Fulgham

Message:

[iOS, macOS] Allow access to the container manager to support Mail InjectedBundle
​https://bugs.webkit.org/show_bug.cgi?id=213357
<rdar://problem/63837247>

Reviewed by Darin Adler.

The Mail Injected Bundle requires access to the container manager to support certain OS operations. We do not need
this access for web browsing, and should limit this access to this one case.

This patch creates a dynamic mach extension to the container manager for this single use case. It also denies the
non-extension access case with a backtrace so we can see if any other clients are hitting this.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):

• Shared/WebProcessCreationParameters.h:
• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):

• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (2 diffs)
• Shared/WebProcessCreationParameters.cpp (modified) (2 diffs)
• Shared/WebProcessCreationParameters.h (modified) (1 diff)
• UIProcess/Cocoa/WebProcessPoolCocoa.mm (modified) (2 diffs)
• WebProcess/cocoa/WebProcessCocoa.mm (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-06-19  Brent Fulgham  <bfulgham@apple.com>
+
+        [iOS, macOS] Allow access to the container manager to support Mail InjectedBundle
+        https://bugs.webkit.org/show_bug.cgi?id=213357
+        <rdar://problem/63837247>
+
+        Reviewed by Darin Adler.
+
+        The Mail Injected Bundle requires access to the container manager to support certain OS operations. We do not need
+        this access for web browsing, and should limit this access to this one case.
+
+        This patch creates a dynamic mach extension to the container manager for this single use case. It also denies the
+        non-extension access case with a backtrace so we can see if any other clients are hitting this.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode const):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::platformInitializeWebProcess):
+        * WebProcess/cocoa/WebProcessCocoa.mm:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2020-06-19  Andres Gonzalez  <andresg_22@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -941 +941 @@
     (with no-log))
 
+(deny mach-lookup (with telemetry-backtrace)
+    (global-name "com.apple.containermanagerd")
+)
+
 (allow mach-lookup
     (require-all
@@ -947 +951 @@
             "com.apple.cfprefsd.agent"
             "com.apple.cfprefsd.daemon"
+            "com.apple.containermanagerd"
             "com.apple.diagnosticd"
             "com.apple.iphone.axserver-systemwide"

trunk/Source/WebKit/Shared/WebProcessCreationParameters.cpp

@@ -162 +162 @@
 #endif
 
+    encoder << containerManagerExtensionHandle;
+    
 #if PLATFORM(IOS_FAMILY)
     encoder << diagnosticsExtensionHandles;
@@ -436 +438 @@
 #endif
 
+    Optional<Optional<SandboxExtension::Handle>> containerManagerExtensionHandle;
+    decoder >> containerManagerExtensionHandle;
+    if (!containerManagerExtensionHandle)
+        return false;
+    parameters.containerManagerExtensionHandle = WTFMove(*containerManagerExtensionHandle);
+
 #if PLATFORM(IOS_FAMILY)
     Optional<SandboxExtension::HandleArray> diagnosticsExtensionHandles;

trunk/Source/WebKit/Shared/WebProcessCreationParameters.h

@@ -206 +206 @@
 #endif
 
+    Optional<SandboxExtension::Handle> containerManagerExtensionHandle;
+
 #if PLATFORM(IOS_FAMILY)
     SandboxExtension::HandleArray diagnosticsExtensionHandles;

trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

@@ -293 +293 @@
 #endif
 
+static bool requiresContainerManagerAccess()
+{
+#if PLATFORM(MAC)
+    return WebCore::MacApplication::isAppleMail();
+#elif PLATFORM(IOS)
+    return WebCore::IOSApplication::isMobileMail();
+#else
+    return false;
+#endif
+}
+
+
 void WebProcessPool::platformInitializeWebProcess(const WebProcessProxy& process, WebProcessCreationParameters& parameters)
 {
@@ -440 +452 @@
 #endif
     
+    if (requiresContainerManagerAccess()) {
+        SandboxExtension::Handle handle;
+        SandboxExtension::createHandleForMachLookup("com.apple.containermanagerd", WTF::nullopt, handle);
+        parameters.containerManagerExtensionHandle = WTFMove(handle);
+    }
+
 #if PLATFORM(IOS_FAMILY)
     parameters.currentUserInterfaceIdiomIsPad = currentUserInterfaceIdiomIsPad();

trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm

@@ -284 +284 @@
 #endif
 
+    if (parameters.containerManagerExtensionHandle)
+        SandboxExtension::consumePermanently(*parameters.containerManagerExtensionHandle);
+    
 #if PLATFORM(IOS_FAMILY)
     SandboxExtension::consumePermanently(parameters.diagnosticsExtensionHandles);

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -899 +899 @@
     (with no-log))
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101500
+(deny mach-lookup (with telemetry-backtrace)
+    (global-name "com.apple.containermanagerd")
+)
+#endif
+
 (allow mach-lookup
     (require-all
@@ -912 +918 @@
             "com.apple.cfprefsd.agent"
             "com.apple.cfprefsd.daemon"
+            "com.apple.containermanagerd"
             "com.apple.tccd"
             "com.apple.lsd.mapdb"