⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 286624 in webkit


Ignore:
Timestamp:
Dec 7, 2021, 2:51:38 PM (5 years ago)
Author:
Ben Nham
Message:

webpushd should run with regular user permissions
​https://bugs.webkit.org/show_bug.cgi?id=233844

Reviewed by Brady Eidson.

Currently webpushd runs as root, which is unneessary. This patch makes it so that we run
with regular user permissions. This is done by specifying a UserName in the launchd plist on
iOS and by installing the plist to /System/Library/LaunchAgents on Mac. Since the plists now
differ based on platform, I changed the "Copy Daemon Plists" build phase in the WebKit
target to copy the appropriate plist to either /S/L/LaunchDaemons or /S/L/LaunchAgents.

Additionally, webpushd needs the aps-connection-initiate or
com.apple.private.aps-connection-initiate to receive pushes from apsd on iOS and Mac
respectively, so I gave the daemon those entitlements.

Finally, webpushd now registers for the com.apple.aps.webkit.webpushd.incoming-push Mach
service so that it can be launched on demand in response to a push. Right now we just
bootstrap_check_in to the service at launch time, but eventually we'll remove that and
use APSConnection to check in to the service instead. Since the bootstrap_check_in
call is temporary, I chose not to make a header file in wtf/spi and declared the prototype
in the implementation file instead.

  • Configurations/webpushd.xcconfig:
  • Scripts/process-entitlements.sh:
  • WebKit.xcodeproj/project.pbxproj:
  • webpushd/WebPushDaemonMain.mm:

(WebKit::WebPushDaemonMain):

  • webpushd/com.apple.webkit.webpushd.ios.plist: Added.
  • webpushd/com.apple.webkit.webpushd.mac.plist: Added.
  • webpushd/com.apple.webkit.webpushd.plist: Removed.
Location:
trunk/Source/WebKit
Files:
2 added
1 deleted
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r286609 r286624  
     12021-12-07  Ben Nham  <nham@apple.com>
     2
     3        webpushd should run with regular user permissions
     4        https://bugs.webkit.org/show_bug.cgi?id=233844
     5
     6        Reviewed by Brady Eidson.
     7
     8        Currently webpushd runs as root, which is unneessary. This patch makes it so that we run
     9        with regular user permissions. This is done by specifying a UserName in the launchd plist on
     10        iOS and by installing the plist to /System/Library/LaunchAgents on Mac. Since the plists now
     11        differ based on platform, I changed the "Copy Daemon Plists" build phase in the WebKit
     12        target to copy the appropriate plist to either /S/L/LaunchDaemons or /S/L/LaunchAgents.
     13
     14        Additionally, webpushd needs the `aps-connection-initiate` or
     15        `com.apple.private.aps-connection-initiate` to receive pushes from apsd on iOS and Mac
     16        respectively, so I gave the daemon those entitlements.
     17
     18        Finally, webpushd now registers for the `com.apple.aps.webkit.webpushd.incoming-push` Mach
     19        service so that it can be launched on demand in response to a push. Right now we just
     20        `bootstrap_check_in` to the service at launch time, but eventually we'll remove that and
     21        use APSConnection to check in to the service instead. Since the `bootstrap_check_in`
     22        call is temporary, I chose not to make a header file in wtf/spi and declared the prototype
     23        in the implementation file instead.
     24
     25        * Configurations/webpushd.xcconfig:
     26        * Scripts/process-entitlements.sh:
     27        * WebKit.xcodeproj/project.pbxproj:
     28        * webpushd/WebPushDaemonMain.mm:
     29        (WebKit::WebPushDaemonMain):
     30        * webpushd/com.apple.webkit.webpushd.ios.plist: Added.
     31        * webpushd/com.apple.webkit.webpushd.mac.plist: Added.
     32        * webpushd/com.apple.webkit.webpushd.plist: Removed.
     33
    1342021-12-07  Chris Dumez  <cdumez@apple.com>
    235

  • trunk/Source/WebKit/Configurations/webpushd.xcconfig

    r286564 r286624  
    2929LIBRARY_SEARCH_PATHS = $(BUILT_PRODUCTS_DIR);
    3030
     31// We want this to always be NO for non-simulator builds. If set to YES, Xcode will invoke codesign with an --entitlements parameter that points to the platform's BaseEntitlements.plist. This parameter would override any --entitlements parameter that we establish in WK_LIBRARY_VALIDATION_CODE_SIGN_FLAGS, causing our entitlements to be ignored.
     32CODE_SIGN_INJECT_BASE_ENTITLEMENTS = NO;
     33CODE_SIGN_INJECT_BASE_ENTITLEMENTS[sdk=*simulator] = YES;
     34
     35// For simulator builds, entitlements are added to a special __entitlements section on the binary rather than the signature.
     36CODE_SIGN_ENTITLEMENTS[sdk=*simulator] = Resources/ios/XPCService-embedded-simulator.entitlements
     37
    3138WK_PROCESSED_XCENT_FILE=$(TEMP_FILE_DIR)/$(FULL_PRODUCT_NAME).entitlements
     39
     40OTHER_CODE_SIGN_FLAGS = --entitlements $(WK_PROCESSED_XCENT_FILE);
    3241
    3342INSTALL_PATH[sdk=iphone*] = $(WEBKIT_FRAMEWORKS_DIR)/WebKit.framework/Daemons;

  • trunk/Source/WebKit/Scripts/process-entitlements.sh

    r286219 r286624  
    215215        plistbuddy Add :com.apple.security.cs.disable-library-validation bool YES
    216216    fi
     217}
     218
     219function mac_process_webpushd_entitlements()
     220{
     221    # FIXME: Add a sandbox profile for webpushd.
     222    echo "webpushd sandbox has not been implemented yet"
     223    plistbuddy Add :com.apple.private.aps-connection-initiate bool YES
    217224}
    218225
    … …  
    505512    # FIXME: Add a sandbox profile for webpushd and add it to the seatbelt-profiles array.
    506513    echo "webpushd sandbox has not been implemented yet"
     514    plistbuddy Add :aps-connection-initiate bool YES
    507515}
    508516
    … …  
    560568    elif [[ "${PRODUCT_NAME}" == com.apple.WebKit.GPU ]]; then mac_process_gpu_entitlements
    561569    elif [[ "${PRODUCT_NAME}" == com.apple.WebKit.WebAuthn ]]; then mac_process_webauthn_entitlements
    562     elif [[ "${PRODUCT_NAME}" != webpushd && "${PRODUCT_NAME}" != adattributiond ]]; then echo "Unsupported/unknown product: ${PRODUCT_NAME}"
     570    elif [[ "${PRODUCT_NAME}" == webpushd ]]; then mac_process_webpushd_entitlements
     571    elif [[ "${PRODUCT_NAME}" != adattributiond ]]; then echo "Unsupported/unknown product: ${PRODUCT_NAME}"
    563572    fi
    564573elif [[ "${WK_PLATFORM_NAME}" == maccatalyst || "${WK_PLATFORM_NAME}" == iosmac ]]

  • trunk/Source/WebKit/WebKit.xcodeproj/project.pbxproj

    r286601 r286624  
    48964896                5CB9310726E841CB0032B1C0 /* PrivateClickMeasurementXPCUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrivateClickMeasurementXPCUtilities.h; sourceTree = "<group>"; };
    48974897                5CB9310826E841CB0032B1C0 /* PrivateClickMeasurementXPCUtilities.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PrivateClickMeasurementXPCUtilities.mm; sourceTree = "<group>"; };
    4898                 5CBB6D4D271F67CC00FD1A5D /* com.apple.webkit.webpushd.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = com.apple.webkit.webpushd.plist; sourceTree = "<group>"; };
    48994898                5CBC9B891C6524A500A8FDCF /* NetworkDataTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkDataTask.h; sourceTree = "<group>"; };
    49004899                5CBC9B8B1C65257300A8FDCF /* NetworkDataTaskCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = NetworkDataTaskCocoa.mm; sourceTree = "<group>"; };
    … …  
    63746373                E5CB07DB20E1678F0022C183 /* WKFormColorControl.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; name = WKFormColorControl.mm; path = ios/forms/WKFormColorControl.mm; sourceTree = "<group>"; };
    63756374                E5DEFA6726F8F42600AB68DB /* PhotosUISPI.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PhotosUISPI.h; sourceTree = "<group>"; };
     6375                EB0D312D275AE13300863D8F /* com.apple.webkit.webpushd.mac.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = com.apple.webkit.webpushd.mac.plist; sourceTree = "<group>"; };
     6376                EB0D312E275AE13300863D8F /* com.apple.webkit.webpushd.ios.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = com.apple.webkit.webpushd.ios.plist; sourceTree = "<group>"; };
    63766377                ECA680D31E6904B500731D20 /* ExtraPrivateSymbolsForTAPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExtraPrivateSymbolsForTAPI.h; sourceTree = "<group>"; };
    63776378                ECBFC1DB1E6A4D66000300C7 /* ExtraPublicSymbolsForTAPI.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ExtraPublicSymbolsForTAPI.h; sourceTree = "<group>"; };
    … …  
    99539954                                5160E954274B887100567388 /* AppBundleRequest.h */,
    99549955                                5160E953274B887100567388 /* AppBundleRequest.mm */,
    9955                                 5CBB6D4D271F67CC00FD1A5D /* com.apple.webkit.webpushd.plist */,
     9956                                EB0D312E275AE13300863D8F /* com.apple.webkit.webpushd.ios.plist */,
     9957                                EB0D312D275AE13300863D8F /* com.apple.webkit.webpushd.mac.plist */,
    99569958                                51F7BB75274498BB00C45A72 /* MockAppBundleForTesting.h */,
    99579959                                51F7BB74274498BA00C45A72 /* MockAppBundleForTesting.mm */,
    … …  
    1499514997                        inputPaths = (
    1499614998                                "$(SRCROOT)/Shared/EntryPointUtilities/Cocoa/Daemon/com.apple.webkit.adattributiond.plist",
     14999                                "$(SRCROOT)/webpushd/com.apple.webkit.webpushd.ios.plist",
     15000                                "$(SRCROOT)/webpushd/com.apple.webkit.webpushd.mac.plist",
    1499715001                        );
    1499815002                        name = "Copy Daemon Plists";
    … …  
    1500115005                        outputPaths = (
    1500215006                                "$(DSTROOT)/System/Library/LaunchDaemons/com.apple.webkit.adattributiond.plist",
     15007                                "$(DSTROOT)/System/Library/LaunchDaemons/com.apple.webkit.webpushd.plist",
     15008                                "$(DSTROOT)/System/Library/LaunchAgents/com.apple.webkit.webpushd.plist",
    1500315009                        );
    1500415010                        runOnlyForDeploymentPostprocessing = 1;
    1500515011                        shellPath = /bin/sh;
    15006                         shellScript = "if [[ \"${WK_PLATFORM_NAME}\" == iphoneos ]]; then\n    ADATTRIBUTIOND_PLIST_SOURCE=\"${SRCROOT}/Shared/EntryPointUtilities/Cocoa/Daemon/com.apple.webkit.adattributiond.plist\"\n    ADATTRIBUTIOND_PLIST_DESTINATION=\"${DSTROOT}/System/Library/LaunchDaemons/com.apple.webkit.adattributiond.plist\"\n    echo \"copying adattributiond plist\"\n    echo plutil -convert binary1 -o \"${ADATTRIBUTIOND_PLIST_DESTINATION}\" \"${ADATTRIBUTIOND_PLIST_SOURCE}\"\n    plutil -convert binary1 -o \"${ADATTRIBUTIOND_PLIST_DESTINATION}\" \"${ADATTRIBUTIOND_PLIST_SOURCE}\"\nelse\n    echo \"not copying adattributiond plist\"\nfi\n\nif [[ \"${WK_PLATFORM_NAME}\" == iphoneos || \"${WK_PLATFORM_NAME}\" == macosx ]]; then\n    WEBPUSHD_PLIST_SOURCE=\"${SRCROOT}/webpushd/com.apple.webkit.webpushd.plist\"\n    WEBPUSHD_PLIST_DESTINATION=\"${DSTROOT}/System/Library/LaunchDaemons/com.apple.webkit.webpushd.plist\"\n    echo \"copying webpushd plist\"\n    echo plutil -convert binary1 -o \"${WEBPUSHD_PLIST_DESTINATION}\" \"${WEBPUSHD_PLIST_SOURCE}\"\n    plutil -convert binary1 -o \"${WEBPUSHD_PLIST_DESTINATION}\" \"${WEBPUSHD_PLIST_SOURCE}\"\nelse\n    echo \"not copying webpushd plist\"\nfi\n";
     15012                        shellScript = "if [[ \"${WK_PLATFORM_NAME}\" == iphoneos ]]; then\n    ADATTRIBUTIOND_PLIST_SOURCE=\"${SRCROOT}/Shared/EntryPointUtilities/Cocoa/Daemon/com.apple.webkit.adattributiond.plist\"\n    ADATTRIBUTIOND_PLIST_DESTINATION=\"${DSTROOT}/System/Library/LaunchDaemons/com.apple.webkit.adattributiond.plist\"\n    echo \"copying adattributiond plist\"\n    echo plutil -convert binary1 -o \"${ADATTRIBUTIOND_PLIST_DESTINATION}\" \"${ADATTRIBUTIOND_PLIST_SOURCE}\"\n    plutil -convert binary1 -o \"${ADATTRIBUTIOND_PLIST_DESTINATION}\" \"${ADATTRIBUTIOND_PLIST_SOURCE}\"\nelse\n    echo \"not copying adattributiond plist\"\nfi\n\nif [[ \"${WK_PLATFORM_NAME}\" == iphoneos || \"${WK_PLATFORM_NAME}\" == macosx ]]; then\n    if [[ \"${WK_PLATFORM_NAME}\" == iphoneos ]]; then\n        WEBPUSHD_PLIST_SOURCE=\"${SRCROOT}/webpushd/com.apple.webkit.webpushd.ios.plist\"\n        WEBPUSHD_PLIST_DESTINATION=\"${DSTROOT}/System/Library/LaunchDaemons/com.apple.webkit.webpushd.plist\"\n    else\n        WEBPUSHD_PLIST_SOURCE=\"${SRCROOT}/webpushd/com.apple.webkit.webpushd.mac.plist\"\n        WEBPUSHD_PLIST_DESTINATION=\"${DSTROOT}/System/Library/LaunchAgents/com.apple.webkit.webpushd.plist\"\n    fi\n\n    echo \"copying webpushd plist\"\n    echo plutil -convert binary1 -o \"${WEBPUSHD_PLIST_DESTINATION}\" \"${WEBPUSHD_PLIST_SOURCE}\"\n    plutil -convert binary1 -o \"${WEBPUSHD_PLIST_DESTINATION}\" \"${WEBPUSHD_PLIST_SOURCE}\"\nelse\n    echo \"not copying webpushd plist\"\nfi\n";
    1500715013                };
    1500815014                E1AC2E2C20F7B95800B0897D /* Unlock Keychain */ = {

  • trunk/Source/WebKit/webpushd/WebPushDaemonMain.mm

    r286564 r286624  
    3636#import <wtf/spi/darwin/XPCSPI.h>
    3737
     38#if USE(APPLE_INTERNAL_SDK)
     39#import <servers/bootstrap.h>
     40#else
     41#import <mach/std_types.h>
     42extern "C" {
     43extern kern_return_t bootstrap_check_in(mach_port_t bootstrapPort, const char *serviceName, mach_port_t*);
     44}
     45#endif
     46
    3847using WebKit::Daemon::EncodedMessage;
    3948using WebPushD::Daemon;
     49
     50static const char *incomingPushServiceName = "com.apple.aps.webkit.webpushd.incoming-push";
    4051
    4152namespace WebPushD {
    … …  
    7485    @autoreleasepool {
    7586        WebKit::startListeningForMachServiceConnections(machServiceName, "com.apple.private.webkit.webpush", connectionAdded, connectionRemoved, connectionEventHandler);
     87
     88        // TODO: remove this once we actually start using APSConnection.
     89        mach_port_t incomingMessagePort;
     90        if (bootstrap_check_in(bootstrap_port, incomingPushServiceName, &incomingMessagePort) != KERN_SUCCESS)
     91            NSLog(@"Couldn't register for incoming push launch port.");
     92       
    7693        WTF::initializeMainThread();
    7794    }
Note: See TracChangeset for help on using the changeset viewer.