Changeset 271482 in webkit

Timestamp:

Jan 14, 2021, 7:31:19 AM (6 years ago)

Author:

pvollan@apple.com

Message:

[GPUP][iOS] Create sandbox extensions for cache and temp directory
​https://bugs.webkit.org/show_bug.cgi?id=220595
<rdar://problem/72450307>

Reviewed by Chris Dumez.

Source/WebKit:

Create sandbox extensions for GPU process access to cache and temp directory.

• GPUProcess/GPUProcess.cpp:

(WebKit::GPUProcess::initializeGPUProcess):

• GPUProcess/GPUProcessCreationParameters.cpp:

(WebKit::GPUProcessCreationParameters::encode const):
(WebKit::GPUProcessCreationParameters::decode):

• GPUProcess/GPUProcessCreationParameters.h:
• UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::GPUProcessProxy):

Source/WTF:

Add USE define for using sandbox extensions to grant access to cache and temp directory.

• wtf/PlatformUse.h:

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/PlatformUse.h (modified) (1 diff)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/GPUProcess/GPUProcess.cpp (modified) (1 diff)
• WebKit/GPUProcess/GPUProcessCreationParameters.cpp (modified) (2 diffs)
• WebKit/GPUProcess/GPUProcessCreationParameters.h (modified) (1 diff)
• WebKit/UIProcess/GPU/GPUProcessProxy.cpp (modified) (3 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2021-01-14  Per Arne Vollan  <pvollan@apple.com>
+
+        [GPUP][iOS] Create sandbox extensions for cache and temp directory
+        https://bugs.webkit.org/show_bug.cgi?id=220595
+        <rdar://problem/72450307>
+
+        Reviewed by Chris Dumez.
+
+        Add USE define for using sandbox extensions to grant access to cache and temp directory.
+
+        * wtf/PlatformUse.h:
+
 2021-01-13  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WTF/wtf/PlatformUse.h

@@ -327 +327 @@
 #define USE_OPENXR 0
 #endif
+
+#if PLATFORM(IOS_FAMILY)
+#define USE_SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS 1
+#endif

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-01-14  Per Arne Vollan  <pvollan@apple.com>
+
+        [GPUP][iOS] Create sandbox extensions for cache and temp directory
+        https://bugs.webkit.org/show_bug.cgi?id=220595
+        <rdar://problem/72450307>
+
+        Reviewed by Chris Dumez.
+
+        Create sandbox extensions for GPU process access to cache and temp directory.
+
+        * GPUProcess/GPUProcess.cpp:
+        (WebKit::GPUProcess::initializeGPUProcess):
+        * GPUProcess/GPUProcessCreationParameters.cpp:
+        (WebKit::GPUProcessCreationParameters::encode const):
+        (WebKit::GPUProcessCreationParameters::decode):
+        * GPUProcess/GPUProcessCreationParameters.h:
+        * UIProcess/GPU/GPUProcessProxy.cpp:
+        (WebKit::GPUProcessProxy::GPUProcessProxy):
+
 2021-01-13  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebKit/GPUProcess/GPUProcess.cpp

@@ -144 +144 @@
 #endif
 
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+    SandboxExtension::consumePermanently(parameters.containerCachesDirectoryExtensionHandle);
+    SandboxExtension::consumePermanently(parameters.containerTemporaryDirectoryExtensionHandle);
+#endif
+    
 #if HAVE(VISIBILITY_PROPAGATION_VIEW)
     m_contextForVisibilityPropagation = LayerHostingContext::createForExternalHostingProcess({

trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.cpp

@@ -51 +51 @@
 #endif
     encoder << parentPID;
+
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+    encoder << containerCachesDirectoryExtensionHandle;
+    encoder << containerTemporaryDirectoryExtensionHandle;
+#endif
 }
 
@@ -69 +74 @@
     if (!decoder.decode(result.parentPID))
         return false;
+
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+    Optional<SandboxExtension::Handle> containerCachesDirectoryExtensionHandle;
+    decoder >> containerCachesDirectoryExtensionHandle;
+    if (!containerCachesDirectoryExtensionHandle)
+        return false;
+    result.containerCachesDirectoryExtensionHandle = WTFMove(*containerCachesDirectoryExtensionHandle);
+
+    Optional<SandboxExtension::Handle> containerTemporaryDirectoryExtensionHandle;
+    decoder >> containerTemporaryDirectoryExtensionHandle;
+    if (!containerTemporaryDirectoryExtensionHandle)
+        return false;
+    result.containerTemporaryDirectoryExtensionHandle = WTFMove(*containerTemporaryDirectoryExtensionHandle);
+#endif
+
     return true;
 }

trunk/Source/WebKit/GPUProcess/GPUProcessCreationParameters.h

@@ -50 +50 @@
     ProcessID parentPID;
 
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+    SandboxExtension::Handle containerCachesDirectoryExtensionHandle;
+    SandboxExtension::Handle containerTemporaryDirectoryExtensionHandle;
+#endif
+
     void encode(IPC::Encoder&) const;
     static WARN_UNUSED_RETURN bool decode(IPC::Decoder&, GPUProcessCreationParameters&);

trunk/Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp

@@ -50 +50 @@
 #endif
 
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+#include "SandboxUtilities.h"
+#include <wtf/FileSystem.h>
+#endif
+
 #define MESSAGE_CHECK(assertion) MESSAGE_CHECK_BASE(assertion, this->connection())
 
@@ -106 +111 @@
     return singleton().get();
 }
+
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+static String gpuProcessCachesDirectory()
+{
+    String path = pathForProcessContainer() + "/Library/Caches/com.apple.WebKit.GPU/";
+    path = stringByResolvingSymlinksInPath(path);
+
+    FileSystem::makeAllDirectories(path);
+    
+    return path;
+}
+#endif
 
 GPUProcessProxy::GPUProcessProxy()
@@ -133 +150 @@
     parameters.parentPID = getCurrentProcessID();
 
+#if USE(SANDBOX_EXTENSIONS_FOR_CACHE_AND_TEMP_DIRECTORY_ACCESS)
+    auto containerCachesDirectory = resolveAndCreateReadWriteDirectoryForSandboxExtension(gpuProcessCachesDirectory());
+    auto containerTemporaryDirectory = resolveAndCreateReadWriteDirectoryForSandboxExtension(WebProcessPool::containerTemporaryDirectory());
+
+    if (!containerCachesDirectory.isEmpty())
+        SandboxExtension::createHandleWithoutResolvingPath(containerCachesDirectory, SandboxExtension::Type::ReadWrite, parameters.containerCachesDirectoryExtensionHandle);
+
+    if (!containerTemporaryDirectory.isEmpty())
+        SandboxExtension::createHandleWithoutResolvingPath(containerTemporaryDirectory, SandboxExtension::Type::ReadWrite, parameters.containerTemporaryDirectoryExtensionHandle);
+#endif
+
     // Initialize the GPU process.
     send(Messages::GPUProcess::InitializeGPUProcess(parameters), 0);