Changeset 286865 in webkit

Timestamp:

Dec 10, 2021, 11:34:01 AM (5 years ago)

Author:

pvollan@apple.com

Message:

[WP] Block access to container manager service for Mail
​https://bugs.webkit.org/show_bug.cgi?id=234080
<rdar://problem/86269784>

Reviewed by Brent Fulgham.

Local testing is not showing access to this daemon when running Mail.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):

• Shared/WebProcessCreationParameters.h:
• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):

• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

• WebProcess/com.apple.WebProcess.sb.in:

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in (modified) (2 diffs)
• Shared/WebProcessCreationParameters.cpp (modified) (2 diffs)
• Shared/WebProcessCreationParameters.h (modified) (1 diff)
• UIProcess/Cocoa/WebProcessPoolCocoa.mm (modified) (2 diffs)
• WebProcess/cocoa/WebProcessCocoa.mm (modified) (1 diff)
• WebProcess/com.apple.WebProcess.sb.in (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-12-10  Per Arne Vollan  <pvollan@apple.com>
+
+        [WP] Block access to container manager service for Mail
+        https://bugs.webkit.org/show_bug.cgi?id=234080
+        <rdar://problem/86269784>
+
+        Reviewed by Brent Fulgham.
+
+        Local testing is not showing access to this daemon when running Mail.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
+        * Shared/WebProcessCreationParameters.cpp:
+        (WebKit::WebProcessCreationParameters::encode const):
+        (WebKit::WebProcessCreationParameters::decode):
+        * Shared/WebProcessCreationParameters.h:
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::platformInitializeWebProcess):
+        * WebProcess/cocoa/WebProcessCocoa.mm:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+        * WebProcess/com.apple.WebProcess.sb.in:
+
 2021-12-10  Said Abou-Hallawa  <said@apple.com>
 

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in

@@ -645 +645 @@
        (iokit-property "IORegistryEntryPropertyKeys"))
 
-(allow ipc-posix-sem-open
+(allow ipc-posix-sem-open (with telemetry)
        (ipc-posix-name "containermanagerd.fb_check"))
 
@@ -1085 +1085 @@
             "com.apple.cfprefsd.agent"
             "com.apple.cfprefsd.daemon"
-            "com.apple.containermanagerd"
             "com.apple.iphone.axserver-systemwide"
             "com.apple.mobileassetd.v2"

trunk/Source/WebKit/Shared/WebProcessCreationParameters.cpp

@@ -163 +163 @@
 #endif
 
-    encoder << containerManagerExtensionHandle;
     encoder << mobileGestaltExtensionHandle;
     encoder << launchServicesExtensionHandle;
@@ -458 +457 @@
 #endif
 
-    std::optional<std::optional<SandboxExtension::Handle>> containerManagerExtensionHandle;
-    decoder >> containerManagerExtensionHandle;
-    if (!containerManagerExtensionHandle)
-        return false;
-    parameters.containerManagerExtensionHandle = WTFMove(*containerManagerExtensionHandle);
-
     std::optional<std::optional<SandboxExtension::Handle>> mobileGestaltExtensionHandle;
     decoder >> mobileGestaltExtensionHandle;

trunk/Source/WebKit/Shared/WebProcessCreationParameters.h

@@ -202 +202 @@
 #endif
 
-    std::optional<SandboxExtension::Handle> containerManagerExtensionHandle;
     std::optional<SandboxExtension::Handle> mobileGestaltExtensionHandle;
     std::optional<SandboxExtension::Handle> launchServicesExtensionHandle;

trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

@@ -292 +292 @@
 }
 
-static bool requiresContainerManagerAccess()
-{
-#if PLATFORM(MAC)
-    return WebCore::MacApplication::isAppleMail();
-#elif PLATFORM(IOS)
-    return WebCore::IOSApplication::isMobileMail();
-#else
-    return false;
-#endif
-}
-
 void WebProcessPool::platformInitializeWebProcess(const WebProcessProxy& process, WebProcessCreationParameters& parameters)
 {
@@ -427 +416 @@
     parameters.systemHasBattery = systemHasBattery();
     parameters.systemHasAC = cachedSystemHasAC().value_or(true);
-
-    if (requiresContainerManagerAccess()) {
-        if (auto handle = SandboxExtension::createHandleForMachLookup("com.apple.containermanagerd"_s, std::nullopt))
-            parameters.containerManagerExtensionHandle = WTFMove(*handle);
-    }
 
 #if PLATFORM(IOS_FAMILY)

trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm

@@ -410 +410 @@
 #endif
 
-    if (parameters.containerManagerExtensionHandle)
-        SandboxExtension::consumePermanently(*parameters.containerManagerExtensionHandle);
-    
 #if PLATFORM(IOS_FAMILY)
     SandboxExtension::consumePermanently(parameters.dynamicIOKitExtensionHandles);

trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in

@@ -1763 +1763 @@
             "com.apple.cfprefsd.agent"
             "com.apple.cfprefsd.daemon"
-            "com.apple.containermanagerd"
             "com.apple.coreservices.launchservicesd"
             "com.apple.iconservices"