Changeset 261238 in webkit

Timestamp:

May 6, 2020, 10:32:01 AM (5 years ago)

Author:

Brent Fulgham

Message:

[MacCatalyst] Processes should check for network entitlement as we do for macOS apps
​https://bugs.webkit.org/show_bug.cgi?id=211474
<rdar://problem/61182060>

Reviewed by Alexey Proskuryakov.

We should make the same entitlement checks in MacCatalyst as we do for macOS.

• Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceEntryPoint.mm:

(WebKit::XPCServiceInitializerDelegate::checkEntitlements):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceEntryPoint.mm (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-05-06  Brent Fulgham  <bfulgham@apple.com>
+
+        [MacCatalyst] Processes should check for network entitlement as we do for macOS apps
+        https://bugs.webkit.org/show_bug.cgi?id=211474
+        <rdar://problem/61182060>
+
+        Reviewed by Alexey Proskuryakov.
+
+        We should make the same entitlement checks in MacCatalyst as we do for macOS.
+
+        * Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceEntryPoint.mm:
+        (WebKit::XPCServiceInitializerDelegate::checkEntitlements):
+
 2020-05-06  Darin Adler  <darin@apple.com>
 

trunk/Source/WebKit/Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceEntryPoint.mm

@@ -1 +1 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31 +31 @@
 #import <WebCore/ProcessIdentifier.h>
 #import <wtf/cocoa/Entitlements.h>
+#import <wtf/spi/darwin/SandboxSPI.h>
 
 namespace WebKit {
@@ -41 +42 @@
 bool XPCServiceInitializerDelegate::checkEntitlements()
 {
-#if PLATFORM(MAC)
-    if (!isClientSandboxed())
-        return true;
-
-    // FIXME: Once we're 100% sure that a process can't access the network we can get rid of this requirement for all processes.
-    if (!hasEntitlement("com.apple.security.network.client")) {
-        NSLog(@"Application does not have the 'com.apple.security.network.client' entitlement.");
-        return false;
+#if PLATFORM(MAC) || PLATFORM(MACCATALYST)
+    if (isClientSandboxed()) {
+        audit_token_t auditToken = { };
+        xpc_connection_get_audit_token(m_connection.get(), &auditToken);
+        if (auto rc = sandbox_check_by_audit_token(auditToken, "mach-lookup", static_cast<enum sandbox_filter_type>(SANDBOX_FILTER_GLOBAL_NAME | SANDBOX_CHECK_NO_REPORT), "com.apple.nsurlsessiond")) {
+            // FIXME (rdar://problem/54178641): This requirement is too strict, it should be possible to load file:// resources without network access.
+            NSLog(@"Application does not have permission to communicate with network resources. rc=%d : errno=%d", rc, errno);
+            return false;
+        }
     }
 #endif