Changeset 169938 in webkit


Ignore:
Timestamp:
Jun 13, 2014, 11:04:34 AM (11 years ago)
Author:
mitz@apple.com
Message:

[iOS] Networking process always decodes keys
​https://bugs.webkit.org/show_bug.cgi?id=133863

Reviewed by Anders Carlsson.

  • Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:

(WebKit::XPCServiceInitializer): Call checkEntitlements on iOS, too.

  • Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm:

(WebKit::XPCServiceInitializerDelegate::checkEntitlements): On iOS, allow decoding keys
if the application has the appropriate keychain access group.

  • Shared/cf/ArgumentCodersCF.cpp:

(IPC::setAllowsDecodingSecKeyRef): Added. Sets static bool.
(IPC::decode): Check the secKeyRefDecodingAllowed bool before decoding a key.

  • Shared/cf/ArgumentCodersCF.h:
Location:
trunk/Source/WebKit2
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit2/ChangeLog

    r169937 r169938  
     12014-06-13  Dan Bernstein  <mitz@apple.com>
     2
     3        [iOS] Networking process always decodes keys
     4        https://bugs.webkit.org/show_bug.cgi?id=133863
     5
     6        Reviewed by Anders Carlsson.
     7
     8        * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:
     9        (WebKit::XPCServiceInitializer): Call checkEntitlements on iOS, too.
     10        * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm:
     11        (WebKit::XPCServiceInitializerDelegate::checkEntitlements): On iOS, allow decoding keys
     12        if the application has the appropriate keychain access group.
     13
     14        * Shared/cf/ArgumentCodersCF.cpp:
     15        (IPC::setAllowsDecodingSecKeyRef): Added. Sets static bool.
     16        (IPC::decode): Check the secKeyRefDecodingAllowed bool before decoding a key.
     17        * Shared/cf/ArgumentCodersCF.h:
     18
    1192014-06-12  Anders Carlsson  <andersca@apple.com>
    220

  • trunk/Source/WebKit2/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h

    r169546 r169938  
    5151    virtual ~XPCServiceInitializerDelegate();
    5252
    53 #if PLATFORM(MAC)
    5453    virtual bool checkEntitlements();
    55 #endif
    5654
    5755    virtual bool getConnectionIdentifier(IPC::Connection::Identifier& identifier);
    … …  
    7977    InitializeWebKit2();
    8078
    81 #if PLATFORM(MAC)
    8279    if (!delegate.checkEntitlements())
    8380        exit(EXIT_FAILURE);
    84 #endif
    8581
    8682    ChildProcessInitializationParameters parameters;

  • trunk/Source/WebKit2/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm

    r169457 r169938  
    2626#import "config.h"
    2727
     28#import "ArgumentCodersCF.h"
    2829#import "SandboxUtilities.h"
    2930#import "XPCServiceEntryPoint.h"
    … …  
    4243}
    4344
    44 #if PLATFORM(MAC)
    4545bool XPCServiceInitializerDelegate::checkEntitlements()
    4646{
     47#if PLATFORM(MAC)
    4748    if (!isClientSandboxed())
    4849        return true;
    … …  
    5354        return false;
    5455    }
     56#endif
     57#if PLATFORM(IOS)
     58    auto value = IPC::adoptXPC(xpc_connection_copy_entitlement_value(m_connection.get(), "keychain-access-groups"));
     59    if (value && xpc_get_type(value.get()) == XPC_TYPE_ARRAY) {
     60        xpc_array_apply(value.get(), ^bool(size_t index, xpc_object_t object) {
     61            if (xpc_get_type(object) == XPC_TYPE_STRING && !strcmp(xpc_string_get_string_ptr(object), "com.apple.identities")) {
     62                IPC::setAllowsDecodingSecKeyRef(true);
     63                return false;
     64            }
     65            return true;
     66        });
     67    }
     68#endif
    5569
    5670    return true;
    5771}
    58 #endif
    5972
    6073bool XPCServiceInitializerDelegate::getConnectionIdentifier(IPC::Connection::Identifier& identifier)

  • trunk/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp

    r169682 r169938  
    592592}
    593593
     594#if PLATFORM(IOS)
     595static bool secKeyRefDecodingAllowed;
     596
     597void setAllowsDecodingSecKeyRef(bool allowsDecodingSecKeyRef)
     598{
     599    secKeyRefDecodingAllowed = allowsDecodingSecKeyRef;
     600}
     601#endif
     602
    594603void encode(ArgumentEncoder& encoder, SecIdentityRef identity)
    595604{
    … …  
    637646    SecKeyRef key = nullptr;
    638647#if PLATFORM(IOS)
    639     SecKeyFindWithPersistentRef(keyData.get(), &key);
     648    if (secKeyRefDecodingAllowed)
     649        SecKeyFindWithPersistentRef(keyData.get(), &key);
    640650#endif
    641651#if PLATFORM(MAC)

  • trunk/Source/WebKit2/Shared/cf/ArgumentCodersCF.h

    r169682 r169938  
    8989#endif
    9090
     91#if PLATFORM(IOS)
     92void setAllowsDecodingSecKeyRef(bool);
     93#endif
     94
    9195CFTypeRef tokenNullTypeRef();
    9296
Note: See TracChangeset for help on using the changeset viewer.