Changeset 149217 in webkit


Ignore:
Timestamp:
Apr 26, 2013, 3:22:53 PM (12 years ago)
Author:
ap@apple.com
Message:

2013-04-26 Simon Cooper <​scooper@apple.com>

Permit ~/Library or ~/Library/Preferences to be symlinks
​https://bugs.webkit.org/show_bug.cgi?id=115142
<rdar://problem/12953603>

Reviewed by Alexey Proskuryakov.

Pass in two new parameters which are the resolved paths to ~/Library
and ~/Library/Preferences. Added new expansion functions and
substituted the new functions for home-regex, home-subpath and
home-literal for places referencing resources in "~/Library" or
"~/Library/Preferences".

  • Resources/PlugInSandboxProfiles/com.apple.QuickTime Plugin.plugin.sb:
  • Resources/PlugInSandboxProfiles/com.apple.WebKit.plugin-common.sb:
  • Resources/PlugInSandboxProfiles/com.apple.ist.ds.appleconnect.webplugin.sb:
  • Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb:
  • Resources/PlugInSandboxProfiles/com.microsoft.SilverlightPlugin.sb:
  • Resources/PlugInSandboxProfiles/com.oracle.java.JavaAppletPlugin.sb:
  • Shared/mac/ChildProcessMac.mm: (WebKit::ChildProcess::initializeSandbox):
Location:
trunk/Source/WebKit2
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r149212 r149217  
     12013-04-26  Simon Cooper  <scooper@apple.com>
     2
     3        Permit ~/Library or ~/Library/Preferences to be symlinks
     4        https://bugs.webkit.org/show_bug.cgi?id=115142
     5        <rdar://problem/12953603>
     6
     7        Reviewed by Alexey Proskuryakov.
     8
     9        Pass in two new parameters which are the resolved paths to ~/Library
     10        and ~/Library/Preferences. Added new expansion functions and
     11        substituted the new functions for home-regex, home-subpath and
     12        home-literal for places referencing resources in "~/Library" or
     13        "~/Library/Preferences".
     14
     15        * Resources/PlugInSandboxProfiles/com.apple.QuickTime Plugin.plugin.sb:
     16        * Resources/PlugInSandboxProfiles/com.apple.WebKit.plugin-common.sb:
     17        * Resources/PlugInSandboxProfiles/com.apple.ist.ds.appleconnect.webplugin.sb:
     18        * Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb:
     19        * Resources/PlugInSandboxProfiles/com.microsoft.SilverlightPlugin.sb:
     20        * Resources/PlugInSandboxProfiles/com.oracle.java.JavaAppletPlugin.sb:
     21        * Shared/mac/ChildProcessMac.mm:
     22        (WebKit::ChildProcess::initializeSandbox):
     23
    1242013-04-26  Alexey Proskuryakov  <ap@apple.com>
    225

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.apple.QuickTime Plugin.plugin.sb

    r148902 r149217  
    33
    44(allow file-read* file-write*
    5     (home-subpath "/Library/Caches/QuickTime")
    6     (home-literal "/Library/Preferences/QuickTime Preferences"))
     5    (home-library-subpath "/Caches/QuickTime")
     6    (home-library-preferences-literal "/QuickTime Preferences"))
    77
    88(allow network-inbound (local udp))

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.apple.WebKit.plugin-common.sb

    r148902 r149217  
    66
    77;; Utility functions
    8 (define (home-regex home-relative-regex)
    9     (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex)))
    10 
    11 (define (home-subpath home-relative-subpath)
    12     (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
    13 
    148(define (home-literal home-relative-literal)
    159    (literal (string-append (param "HOME_DIR") home-relative-literal)))
     10
     11(define (home-library-regex home-library-relative-regex)
     12    (regex (string-append "^" (regex-quote (param "HOME_LIBRARY_DIR")) home-library-relative-regex)))
     13
     14(define (home-library-subpath home-library-relative-subpath)
     15    (subpath (string-append (param "HOME_LIBRARY_DIR") home-library-relative-subpath)))
     16
     17(define (home-library-literal home-library-relative-literal)
     18    (literal (string-append (param "HOME_LIBRARY_DIR") home-library-relative-literal)))
     19
     20(define (home-library-preferences-regex home-library-preferences-relative-regex)
     21    (regex (string-append "^" (regex-quote (param "HOME_LIBRARY_PREFERENCES_DIR")) home-library-preferences-relative-regex)))
     22
     23(define (home-library-preferences-subpath home-library-preferences-relative-subpath)
     24    (subpath (string-append (param "HOME_LIBRARY_PREFERENCES_DIR") home-library-preferences-relative-subpath)))
     25
     26(define (home-library-preferences-literal home-library-preferences-relative-literal)
     27    (literal (string-append (param "HOME_LIBRARY_PREFERENCES_DIR") home-library-preferences-relative-literal)))
    1628
    1729(define (shared-preferences-read . domains)
    … …  
    2335                (allow file-read*
    2436                       (literal (string-append "/Library/Preferences/" domain ".plist"))
    25                        (home-literal (string-append "/Library/Preferences/" domain ".plist"))
    26                        (home-regex (string-append #"/Library/Preferences/ByHost/" (regex-quote domain) #"\..*\.plist$")))))
     37                       (home-library-preferences-literal (string-append "/" domain ".plist"))
     38                       (home-library-preferences-regex (string-append #"/ByHost/" (regex-quote domain) #"\..*\.plist$")))))
    2739            domains))
    2840
    … …  
    3547                (allow file-read* file-write*
    3648                       (literal (string-append "/Library/Preferences/" domain ".plist"))
    37                        (home-literal (string-append "/Library/Preferences/" domain ".plist"))
    38                        (home-regex (string-append #"/Library/Preferences/ByHost/" (regex-quote domain) #"\..*\.plist$")))))
     49                       (home-library-preferences-literal (string-append "/" domain ".plist"))
     50                       (home-library-preferences-regex (string-append #"/ByHost/" (regex-quote domain) #"\..*\.plist$")))))
    3951            domains))
    4052
    … …  
    8193    "com.apple.universalaccess"
    8294    "com.apple.WebFoundation"
     95    "com.apple.WebKit.PluginProcess"
    8396    "pbs"
    8497    "com.apple.ServicesMenu.Services")
    … …  
    92105    (regex #"^/Library/Preferences/com\.apple\.security")
    93106    (home-literal "/.CFUserTextEncoding")
    94     (home-subpath "/Library/Audio")
    95     (home-subpath "/Library/ColorPickers")
    96     (home-subpath "/Library/ColorSync")
    97     (home-subpath "/Library/Components")
     107    (home-library-subpath "/Audio")
     108    (home-library-subpath "/ColorPickers")
     109    (home-library-subpath "/ColorSync")
     110    (home-library-subpath "/Components")
    98111    (subpath "/Library/Contextual Menu Items")
    99     (home-subpath "/Library/Input Methods")
    100     (home-subpath "/Library/KeyBindings")
    101     (home-subpath "/Library/Keyboard Layouts")
     112    (home-library-subpath "/Input Methods")
     113    (home-library-subpath "/KeyBindings")
     114    (home-library-subpath "/Keyboard Layouts")
    102115    (subpath "/Library/Fonts")
    103     (home-subpath "/Library/Fonts")
     116    (home-library-subpath "/Fonts")
    104117    (subpath "/Library/Spelling")
    105     (home-subpath "/Library/Spelling")
     118    (home-library-subpath "/Spelling")
    106119    (subpath "/Library/PDF Services")
    107     (home-subpath "/Library/PDF Services")
    108     (home-literal "/Library/Preferences/QuickTime Preferences")
    109 
    110     (home-literal "/Library/Caches/com.apple.coreaudio.components.plist")
     120    (home-library-subpath "/PDF Services")
     121    (home-library-preferences-literal "/QuickTime Preferences")
     122
     123    (home-library-literal "/Caches/com.apple.coreaudio.components.plist")
    111124
    112125    (subpath "/Library/Audio/Plug-Ins/Components")
    113     (home-subpath "/Library/Audio/Plug-Ins/Components")
     126    (home-library-subpath "/Audio/Plug-Ins/Components")
    114127    (subpath "/Library/Audio/Plug-Ins/HAL")
    115128    (subpath "/Library/QuickTime")
    116     (home-subpath "/Library/QuickTime")
     129    (home-library-subpath "/QuickTime")
    117130    (subpath "/Library/Video/Plug-Ins")
    118     (home-subpath "/Library/Caches/QuickTime")
     131    (home-library-subpath "/Caches/QuickTime")
    119132
    120133    (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
    121134
    122     (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
     135    (home-library-literal "/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")
    123136
    124137    (subpath "/Library/ColorSync")
    … …  
    130143;; Read-write preferences and data
    131144(allow file*
    132     (home-regex #"/Library/Preferences/com\.apple\.WebKit\.PluginProcess\.plist")
    133 
    134145    ;; FIXME: This should be removed when <rdar://problem/10479685> is fixed.
    135     (home-subpath "/Library/Keychains"))
     146    (home-library-subpath "/Keychains"))
    136147
    137148;; IOKit user clients
    … …  
    227238        (subpath "/private/etc/cups/ppd")
    228239        (subpath "/private/var/run/cupsd")
    229         (home-literal "/Library/Preferences/org.cups.PrintingPrefs.plist")))
     240        (shared-preferences-read "org.cups.PrintingPrefs")))
    230241
    231242;; Text Services Manager
    … …  
    247258;; Silently block access to some resources
    248259(deny file-read* file-write* (with no-log)
    249     (home-regex #"/Library/Preferences/com\.apple\.internetconfigpriv\.plist")
    250     (home-regex #"/Library/Preferences/com\.apple\.internetconfig\.plist")
     260    (home-library-preferences-regex #"/com\.apple\.internetconfig(priv)?\.plist")
    251261
    252262    ;; FIXME: Should be removed after <rdar://problem/9422957> is fixed.
    253     (home-literal "/Library/Caches/Cache.db")
     263    (home-library-literal "/Caches/Cache.db")
    254264
    255265    ;; FIXME: Should be removed after <rdar://problem/10463881> is fixed.
    256     (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")
    257     (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))
     266    (home-library-preferences-literal "/com.apple.LaunchServices.QuarantineEventsV2")
     267    (home-library-preferences-literal "/com.apple.LaunchServices.QuarantineEventsV2-journal"))
    258268
    259269(deny mach-lookup (with no-log)

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.apple.ist.ds.appleconnect.webplugin.sb

    r148902 r149217  
    2323    (subpath "/Library/KerberosPlugins/GSSAPI")
    2424    (literal "/Library/Preferences/edu.mit.Kerberos")
    25     (home-literal "/Library/Preferences/edu.mit.Kerberos"))
     25    (home-library-preferences-literal "/edu.mit.Kerberos"))
    2626
    2727(allow file-read*

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.macromedia.Flash Player.plugin.sb

    r149044 r149217  
    66
    77(deny file-read-xattr (with no-log)
    8     (home-literal "/Library/Caches")
    9     (home-literal "/Library/Preferences"))
     8    (home-library-literal "/Caches")
     9    (home-library-preferences-literal "/"))
    1010
    1111(allow file-read* file-write-create file-write-mode
    12     (home-literal "/Library/Caches/Adobe")
    13     (home-literal "/Library/Preferences/Macromedia"))
     12    (home-library-literal "/Caches/Adobe")
     13    (home-library-preferences-literal "/Macromedia"))
    1414
    1515(allow file-read* file-write*
    1616    (literal "/Library/Application Support/Macromedia/mms.cfg")
    17     (home-literal "/Library/Application Support/Macromedia/mms.cfg")
    18     (home-subpath "/Library/Caches/Adobe/Flash Player")
    19     (home-subpath "/Library/Preferences/Macromedia/Flash Player"))
     17    (home-library-literal "/Application Support/Macromedia/mms.cfg")
     18    (home-library-subpath "/Caches/Adobe/Flash Player")
     19    (home-library-preferences-subpath "/Macromedia/Flash Player"))
    2020
    2121(allow file-read*
    2222    (literal "/Library/PreferencePanes/Flash Player.prefPane")
    23     (home-literal "/Library/PreferencePanes/Flash Player.prefPane")
    24     (home-regex "/Library/Application Support/Macromedia/ss\.(cfg|cfn|sgn)$"))
     23    (home-library-literal "/PreferencePanes/Flash Player.prefPane")
     24    (home-library-regex "/Application Support/Macromedia/ss\.(cfg|cfn|sgn)$"))
    2525
    2626(allow file-read* file-write*

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.microsoft.SilverlightPlugin.sb

    r148902 r149217  
    99
    1010(allow file-write-create
    11     (home-literal "/Library/Application Support/Microsoft"))
     11    (home-library-literal "/Application Support/Microsoft"))
    1212
    1313(allow file-read* file-write*
    1414    ;; Sigh, mode 777 in /Library.
    1515    (subpath "/Library/Application Support/Microsoft/PlayReady")
    16     (home-subpath "/Library/Application Support/Microsoft/PlayReady")
    17     (home-subpath "/Library/Application Support/Microsoft/Silverlight")
    18     (home-subpath "/Library/Caches/TemporaryItems"))
     16    (home-library-subpath "/Application Support/Microsoft/PlayReady")
     17    (home-library-subpath "/Application Support/Microsoft/Silverlight")
     18    (home-library-subpath "/Caches/TemporaryItems"))
    1919
    2020;; FIXME: <rdar://problem/13636078>

  • trunk/Source/WebKit2/Resources/PlugInSandboxProfiles/com.oracle.java.JavaAppletPlugin.sb

    r148902 r149217  
    2020
    2121(allow file-read* file-write*
    22     (home-subpath "/Library/Saved Application State/net.java.openjdk.cmd.savedState")
    23     (home-subpath "/Library/Application Support/Oracle/Java/Deployment")
    24     (home-subpath "/Library/Caches/Java"))
     22    (home-library-subpath "/Saved Application State/net.java.openjdk.cmd.savedState")
     23    (home-library-subpath "/Application Support/Oracle/Java/Deployment")
     24    (home-library-subpath "/Caches/Java"))
    2525
    2626(allow file-write-create
    27     (home-literal "/Library/Application Support/Oracle")
    28     (home-literal "/Library/Application Support/Oracle/Java"))
     27    (home-library-literal "/Application Support/Oracle")
     28    (home-library-literal "/Application Support/Oracle/Java"))
    2929
    3030(allow network-bind network-outbound (subpath (param "DARWIN_USER_TEMP_DIR")))

  • trunk/Source/WebKit2/Shared/mac/ChildProcessMac.mm

    r148905 r149217  
    140140    sandboxParameters.addPathParameter("HOME_DIR", pwd.pw_dir);
    141141
     142    String path = String::fromUTF8(pwd.pw_dir);
     143    path.append("/Library");
     144
     145    sandboxParameters.addPathParameter("HOME_LIBRARY_DIR", fileSystemRepresentation(path).data());
     146
     147    path.append("/Preferences");
     148
     149    sandboxParameters.addPathParameter("HOME_LIBRARY_PREFERENCES_DIR", fileSystemRepresentation(path).data());
     150
    142151    switch (sandboxParameters.mode()) {
    143152    case SandboxInitializationParameters::UseDefaultSandboxProfilePath:
Note: See TracChangeset for help on using the changeset viewer.