Changeset 275057 in webkit

Timestamp:

Mar 25, 2021, 2:23:45 PM (5 years ago)

Author:

pvollan@apple.com

Message:

Enforce notifyd message filtering
​https://bugs.webkit.org/show_bug.cgi?id=223601
<rdar://75098580>

Reviewed by Brent Fulgham.

Source/WebCore/PAL:

Add Notify SPI file.

• PAL.xcodeproj/project.pbxproj:
• pal/spi/cocoa/NotifySPI.h: Added.

Source/WebKit:

Enable Notify filtering by setting Notify options before entering sandbox.

• Shared/mac/AuxiliaryProcessMac.mm:

(WebKit::compileAndApplySandboxSlowCase):

Source/WTF:

Add ENABLE define for Notify filtering.

• wtf/PlatformEnableCocoa.h:

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/PlatformEnableCocoa.h (modified) (1 diff)
• WebCore/PAL/ChangeLog (modified) (1 diff)
• WebCore/PAL/PAL.xcodeproj/project.pbxproj (modified) (4 diffs)
• WebCore/PAL/pal/spi/cocoa/NotifySPI.h (added)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/Shared/mac/AuxiliaryProcessMac.mm (modified) (6 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2021-03-25  Per Arne  <pvollan@apple.com>
+
+        Enforce notifyd message filtering
+        https://bugs.webkit.org/show_bug.cgi?id=223601
+        <rdar://75098580>
+
+        Reviewed by Brent Fulgham.
+
+        Add ENABLE define for Notify filtering.
+
+        * wtf/PlatformEnableCocoa.h:
+
 2021-03-25  Don Olmstead  <don.olmstead@sony.com>
 

trunk/Source/WTF/wtf/PlatformEnableCocoa.h

@@ -662 +662 @@
 #define ENABLE_SEPARATED_MODEL 1
 #endif
+
+#if !defined(ENABLE_NOTIFY_FILTERING) && PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 120000
+#define ENABLE_NOTIFY_FILTERING 1
+#endif

trunk/Source/WebCore/PAL/ChangeLog

@@ +1 @@
+2021-03-25  Per Arne  <pvollan@apple.com>
+
+        Enforce notifyd message filtering
+        https://bugs.webkit.org/show_bug.cgi?id=223601
+        <rdar://75098580>
+
+        Reviewed by Brent Fulgham.
+
+        Add Notify SPI file.
+
+        * PAL.xcodeproj/project.pbxproj:
+        * pal/spi/cocoa/NotifySPI.h: Added.
+
 2021-03-19  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/PAL/PAL.xcodeproj/project.pbxproj

@@ -199 +199 @@
                 CDF91113220E4EEC001EA39E /* CelestialSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = CDF91112220E4EEC001EA39E /* CelestialSPI.h */; };
                 CE5673872151A7B9002F92D7 /* IOKitSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = CE5673862151A7B9002F92D7 /* IOKitSPI.h */; };
+                E327C0DF260BE436002281C5 /* NotifySPI.h in Headers */ = {isa = PBXBuildFile; fileRef = E327C0DE260BDC90002281C5 /* NotifySPI.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 E5D45D122106A07400D2B738 /* NSColorWellSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = E5D45D112106A07400D2B738 /* NSColorWellSPI.h */; };
                 E5D45D142106A18700D2B738 /* NSPopoverColorWellSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = E5D45D132106A18700D2B738 /* NSPopoverColorWellSPI.h */; };
@@ -411 +412 @@
                 CDF91112220E4EEC001EA39E /* CelestialSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CelestialSPI.h; sourceTree = "<group>"; };
                 CE5673862151A7B9002F92D7 /* IOKitSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IOKitSPI.h; sourceTree = "<group>"; };
+                E327C0DE260BDC90002281C5 /* NotifySPI.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = NotifySPI.h; sourceTree = "<group>"; };
                 E5D45D112106A07400D2B738 /* NSColorWellSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NSColorWellSPI.h; sourceTree = "<group>"; };
                 E5D45D132106A18700D2B738 /* NSPopoverColorWellSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NSPopoverColorWellSPI.h; sourceTree = "<group>"; };
@@ -511 +513 @@
                                 1CC3ACE722BD7EB800F360F0 /* MetalSPI.h */,
                                 0C2DA12D1F3BEB4900DBC317 /* NEFilterSourceSPI.h */,
+                                E327C0DE260BDC90002281C5 /* NotifySPI.h */,
                                 0C7785741F45130F00F4EBB6 /* NSAccessibilitySPI.h */,
                                 0C2DA12E1F3BEB4900DBC317 /* NSAttributedStringSPI.h */,
@@ -879 +882 @@
                                 0C5AF91E1F43A4C7002EAC02 /* MobileGestaltSPI.h in Headers */,
                                 0C2DA1491F3BEB4900DBC317 /* NEFilterSourceSPI.h in Headers */,
+                                E327C0DF260BE436002281C5 /* NotifySPI.h in Headers */,
                                 0C77858D1F45130F00F4EBB6 /* NSAccessibilitySPI.h in Headers */,
                                 1CCEE4F720D8743F0047B097 /* NSAppearanceSPI.h in Headers */,

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-25  Per Arne  <pvollan@apple.com>
+
+        Enforce notifyd message filtering
+        https://bugs.webkit.org/show_bug.cgi?id=223601
+        <rdar://75098580>
+
+        Reviewed by Brent Fulgham.
+
+        Enable Notify filtering by setting Notify options before entering sandbox.
+
+        * Shared/mac/AuxiliaryProcessMac.mm:
+        (WebKit::compileAndApplySandboxSlowCase):
+
 2021-03-25  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm

@@ -44 +44 @@
 #import <pal/spi/cocoa/CoreServicesSPI.h>
 #import <pal/spi/cocoa/LaunchServicesSPI.h>
+#import <pal/spi/cocoa/NotifySPI.h>
 #import <pwd.h>
 #import <stdlib.h>
@@ -66 +67 @@
 SOFT_LINK_SYSTEM_LIBRARY(libsystem_info)
 SOFT_LINK_OPTIONAL(libsystem_info, mbr_close_connections, int, (), ());
+
+#if ENABLE(NOTIFY_FILTERING)
+SOFT_LINK_SYSTEM_LIBRARY(libsystem_notify)
+SOFT_LINK_OPTIONAL(libsystem_notify, notify_set_options, void, __cdecl, (uint32_t));
+#endif
 
 #if PLATFORM(MAC)
@@ -443 +449 @@
 }
 
+static void setNotifyOptions()
+{
+#if ENABLE(NOTIFY_FILTERING)
+    if (notify_set_optionsPtr())
+        notify_set_optionsPtr()(NOTIFY_OPT_DISPATCH | NOTIFY_OPT_REGEN | NOTIFY_OPT_FILTERED);
+#endif
+}
+
 static bool tryApplyCachedSandbox(const SandboxInfo& info)
 {
@@ -506 +520 @@
     ASSERT(static_cast<void *>(sandboxDataPtr + profile.size) <= static_cast<void *>(cachedSandboxContents.data() + cachedSandboxContents.size()));
     profile.data = sandboxDataPtr;
+
+    setNotifyOptions();
 
     if (sandbox_apply(&profile)) {
@@ -545 +561 @@
     CString temp = isProfilePath ? FileSystem::fileSystemRepresentation(profileOrProfilePath) : profileOrProfilePath.utf8();
     uint64_t flags = isProfilePath ? SANDBOX_NAMED_EXTERNAL : 0;
+
+    setNotifyOptions();
+
     ALLOW_DEPRECATED_DECLARATIONS_BEGIN
     if (sandbox_init_with_parameters(temp.data(), flags, parameters.namedParameterArray(), &errorBuf)) {
@@ -604 +623 @@
         return compileAndApplySandboxSlowCase(profileOrProfilePath, isProfilePath, sandboxInitializationParameters);
 
+    setNotifyOptions();
+    
     if (sandbox_apply(sandboxProfile.get())) {
         WTFLogAlways("%s: Could not apply compiled sandbox: %s\n", getprogname(), strerror(errno));