Changeset 289566 in webkit


Ignore:
Timestamp:
Feb 10, 2022, 12:13:19 PM (4 years ago)
Author:
Ben Nham
Message:

Apply default sandbox to webpushd on Mac
​https://bugs.webkit.org/show_bug.cgi?id=236342

Reviewed by Per Arne Vollan.

This applies a default sandbox profile that allows and logs all operations by webpushd on
the Mac. In future patches we'll tighten the sandbox based on the sandbox logs that we
receive.

To do this, I refactored the sandbox initialization logic in AuxiliaryProcess so that it can
be called without creating an AuxiliaryProcess instance. This probably should be refactored
further (e.g. since webpushd isn't an AuxiliaryProcess, but rather a system daemon). But I
wanted to keep the amount of refactoring low for now while we're still figuring things out.

We also do not currently support compiling and caching the sandbox profiles. We'll add that
support later.

  • DerivedSources-input.xcfilelist:
  • DerivedSources-output.xcfilelist:
  • DerivedSources.make:
  • PlatformMac.cmake:
  • Shared/AuxiliaryProcess.cpp:

(WebKit::applySandboxProfileForDaemon):

  • Shared/AuxiliaryProcess.h:
  • Shared/mac/AuxiliaryProcessMac.mm:

(WebKit::getUserDirectorySuffix):
(WebKit::populateSandboxInitializationParameters):
(WebKit::AuxiliaryProcess::initializeSandbox):
(WebKit::AuxiliaryProcess::applySandboxProfileForDaemon):

  • WebKit.xcodeproj/project.pbxproj:
  • webpushd/WebPushDaemonMain.mm:

(WebKit::applySandbox):
(WebKit::WebPushDaemonMain):

  • webpushd/mac/com.apple.WebKit.webpushd.sb.in: Added.
Location:
trunk/Source/WebKit
Files:
2 added
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r289552 r289566  
     12022-02-10  Ben Nham  <nham@apple.com>
     2
     3        Apply default sandbox to webpushd on Mac
     4        https://bugs.webkit.org/show_bug.cgi?id=236342
     5
     6        Reviewed by Per Arne Vollan.
     7
     8        This applies a default sandbox profile that allows and logs all operations by webpushd on
     9        the Mac. In future patches we'll tighten the sandbox based on the sandbox logs that we
     10        receive.
     11
     12        To do this, I refactored the sandbox initialization logic in AuxiliaryProcess so that it can
     13        be called without creating an AuxiliaryProcess instance. This probably should be refactored
     14        further (e.g. since webpushd isn't an AuxiliaryProcess, but rather a system daemon). But I
     15        wanted to keep the amount of refactoring low for now while we're still figuring things out.
     16
     17        We also do not currently support compiling and caching the sandbox profiles. We'll add that
     18        support later.
     19
     20        * DerivedSources-input.xcfilelist:
     21        * DerivedSources-output.xcfilelist:
     22        * DerivedSources.make:
     23        * PlatformMac.cmake:
     24        * Shared/AuxiliaryProcess.cpp:
     25        (WebKit::applySandboxProfileForDaemon):
     26        * Shared/AuxiliaryProcess.h:
     27        * Shared/mac/AuxiliaryProcessMac.mm:
     28        (WebKit::getUserDirectorySuffix):
     29        (WebKit::populateSandboxInitializationParameters):
     30        (WebKit::AuxiliaryProcess::initializeSandbox):
     31        (WebKit::AuxiliaryProcess::applySandboxProfileForDaemon):
     32        * WebKit.xcodeproj/project.pbxproj:
     33        * webpushd/WebPushDaemonMain.mm:
     34        (WebKit::applySandbox):
     35        (WebKit::WebPushDaemonMain):
     36        * webpushd/mac/com.apple.WebKit.webpushd.sb.in: Added.
     37
    1382022-02-10  Wenson Hsieh  <wenson_hsieh@apple.com>
    239

  • trunk/Source/WebKit/Configurations/WebKit.xcconfig

    r289091 r289566  
    180180EXCLUDED_IOS_RESOURCE_FILE_NAMES[sdk=iphone*] = ;
    181181
    182 EXCLUDED_MACOS_PLUGIN_FILE_NAMES[sdk=iphone*] = SecItemShim.dylib WebProcessShim.dylib *.pdf Resources/mac/* com.apple.WebKit.NetworkProcess.sb com.apple.WebKit.GPUProcess.sb com.apple.WebKit.WebAuthnProcess.sb com.apple.WebProcess.sb;
     182EXCLUDED_MACOS_PLUGIN_FILE_NAMES[sdk=iphone*] = SecItemShim.dylib WebProcessShim.dylib *.pdf Resources/mac/* com.apple.WebKit.NetworkProcess.sb com.apple.WebKit.GPUProcess.sb com.apple.WebKit.WebAuthnProcess.sb com.apple.WebKit.webpushd.sb com.apple.WebProcess.sb;
    183183
    184184INSTALLHDRS_SCRIPT_PHASE = YES;

  • trunk/Source/WebKit/DerivedSources-input.xcfilelist

    r289525 r289566  
    249249$(PROJECT_DIR)/WebProcess/cocoa/VideoFullscreenManager.messages.in
    250250$(PROJECT_DIR)/WebProcess/com.apple.WebProcess.sb.in
     251$(PROJECT_DIR)/webpushd/mac/com.apple.WebKit.webpushd.sb.in

  • trunk/Source/WebKit/DerivedSources-output.xcfilelist

    r289525 r289566  
    646646$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/com.apple.WebKit.WebContent.sb
    647647$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/com.apple.WebKit.plugin-common.sb
     648$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/com.apple.WebKit.webpushd.sb
    648649$(BUILT_PRODUCTS_DIR)/DerivedSources/WebKit/com.apple.WebProcess.sb
    649650<<<<<<< HEAD

  • trunk/Source/WebKit/DerivedSources.make

    r289525 r289566  
    105105    $(WebKit2)/UIProcess/mac \
    106106    $(WebKit2)/UIProcess/ios \
     107    $(WebKit2)/webpushd/mac \
    107108    $(WEBKITADDITIONS_HEADER_SEARCH_PATHS) \
    108109#
    … …  
    352353        com.apple.WebKit.NetworkProcess.sb \
    353354        com.apple.WebKit.GPUProcess.sb \
    354         com.apple.WebKit.WebAuthnProcess.sb
     355        com.apple.WebKit.WebAuthnProcess.sb \
     356        com.apple.WebKit.webpushd.sb
    355357       
    356358SANDBOX_PROFILES_IOS = \

  • trunk/Source/WebKit/PlatformMac.cmake

    r288345 r289566  
    839839        list(APPEND WebKit_SB_FILES ${WebKit_RESOURCES_DIR}/com.apple.WebKit.WebAuthnProcess.sb)
    840840    endif ()
     841    if (ENABLE_BUILT_IN_NOTIFICATIONS)
     842        add_custom_command(OUTPUT ${WebKit_RESOURCES_DIR}/com.apple.WebKit.webpushd.sb COMMAND
     843            grep -o "^[^;]*" ${WEBKIT_DIR}/webpushd/mac/com.apple.WebKit.webpushd.sb.in | clang -E -P -w -include wtf/Platform.h -I ${WTF_FRAMEWORK_HEADERS_DIR} -I ${bmalloc_FRAMEWORK_HEADERS_DIR} -I ${WEBKIT_DIR} - > ${WebKit_RESOURCES_DIR}/com.apple.WebKit.webpushd.sb
     844            VERBATIM)
     845        list(APPEND WebKit_SB_FILES ${WebKit_RESOURCES_DIR}/com.apple.WebKit.webpushd.sb)
     846    endif ()
    841847    add_custom_target(WebKitSandboxProfiles ALL DEPENDS ${WebKit_SB_FILES})
    842848    add_dependencies(WebKit WebKitSandboxProfiles)

  • trunk/Source/WebKit/Shared/AuxiliaryProcess.cpp

    r287556 r289566  
    278278#endif
    279279
     280#if !PLATFORM(MAC)
     281static void applySandboxProfileForDaemon(const String&, const String&)
     282{
     283}
     284#endif
     285
    280286#endif // !PLATFORM(COCOA)
    281287

  • trunk/Source/WebKit/Shared/AuxiliaryProcess.h

    r287720 r289566  
    8888#endif
    8989
     90    static void applySandboxProfileForDaemon(const String& profilePath, const String& userDirectorySuffix);
     91
    9092    IPC::Connection* parentProcessConnection() const { return m_connection.get(); }
    9193

  • trunk/Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm

    r286071 r289566  
    638638}
    639639
    640 static void initializeSandboxParameters(const AuxiliaryProcessInitializationParameters& parameters, SandboxInitializationParameters& sandboxParameters)
    641 {
    642     // Verify user directory suffix.
    643     if (sandboxParameters.userDirectorySuffix().isNull()) {
    644         auto userDirectorySuffix = parameters.extraInitializationData.find("user-directory-suffix");
    645         if (userDirectorySuffix != parameters.extraInitializationData.end()) {
    646             String suffix = userDirectorySuffix->value;
    647             auto firstPathSeparator = suffix.find("/");
    648             if (firstPathSeparator != notFound)
    649                 suffix.truncate(firstPathSeparator);
    650             sandboxParameters.setUserDirectorySuffix(suffix);
    651         } else {
    652             String clientIdentifier = codeSigningIdentifier(parameters.connectionIdentifier.xpcConnection.get());
    653             if (clientIdentifier.isNull())
    654                 clientIdentifier = parameters.clientIdentifier;
    655             sandboxParameters.setUserDirectorySuffix(makeString([[NSBundle mainBundle] bundleIdentifier], '+', clientIdentifier));
    656         }
    657     }
     640static String getUserDirectorySuffix(const AuxiliaryProcessInitializationParameters& parameters)
     641{
     642    auto userDirectorySuffix = parameters.extraInitializationData.find("user-directory-suffix");
     643    if (userDirectorySuffix != parameters.extraInitializationData.end()) {
     644        String suffix = userDirectorySuffix->value;
     645        auto firstPathSeparator = suffix.find("/");
     646        if (firstPathSeparator != notFound)
     647            suffix.truncate(firstPathSeparator);
     648        return suffix;
     649    }
     650
     651    String clientIdentifier = codeSigningIdentifier(parameters.connectionIdentifier.xpcConnection.get());
     652    if (clientIdentifier.isNull())
     653        clientIdentifier = parameters.clientIdentifier;
     654    return makeString([[NSBundle mainBundle] bundleIdentifier], '+', clientIdentifier);
     655}
     656
     657static void populateSandboxInitializationParameters(SandboxInitializationParameters& sandboxParameters)
     658{
     659    RELEASE_ASSERT(!sandboxParameters.userDirectorySuffix().isNull());
    658660
    659661    String osSystemMarketingVersion = systemMarketingVersion();
    … …  
    715717
    716718#if USE(CACHE_COMPILED_SANDBOX)
    717     // This must be called before initializeSandboxParameters so that the path does not include the user directory suffix.
     719    // This must be called before populateSandboxInitializationParameters so that the path does not include the user directory suffix.
    718720    // We don't want the user directory suffix because we want all processes of the same type to use the same cache directory.
    719721    String dataVaultParentDirectory { sandboxDataVaultParentDirectory() };
    … …  
    728730    sandboxParameters.addParameter("ENABLE_SANDBOX_MESSAGE_FILTER", enableMessageFilter ? "YES" : "NO");
    729731
    730     initializeSandboxParameters(parameters, sandboxParameters);
     732    if (sandboxParameters.userDirectorySuffix().isNull())
     733        sandboxParameters.setUserDirectorySuffix(getUserDirectorySuffix(parameters));
     734
     735    populateSandboxInitializationParameters(sandboxParameters);
    731736
    732737    if (!applySandbox(parameters, sandboxParameters, dataVaultParentDirectory)) {
    … …  
    745750}
    746751
     752void AuxiliaryProcess::applySandboxProfileForDaemon(const String& profilePath, const String& userDirectorySuffix)
     753{
     754    TraceScope traceScope(InitializeSandboxStart, InitializeSandboxEnd);
     755
     756    SandboxInitializationParameters parameters { };
     757    parameters.setOverrideSandboxProfilePath(profilePath);
     758    parameters.setUserDirectorySuffix(userDirectorySuffix);
     759    populateSandboxInitializationParameters(parameters);
     760
     761    String profileOrProfilePath;
     762    bool isProfilePath;
     763    getSandboxProfileOrProfilePath(parameters, profileOrProfilePath, isProfilePath);
     764    RELEASE_ASSERT(!profileOrProfilePath.isEmpty());
     765
     766    bool success = compileAndApplySandboxSlowCase(profileOrProfilePath, isProfilePath, parameters);
     767    RELEASE_ASSERT(success);
     768}
     769
    747770#if USE(APPKIT)
    748771void AuxiliaryProcess::stopNSAppRunLoop()

  • trunk/Source/WebKit/WebKit.xcodeproj/project.pbxproj

    r289525 r289566  
    20122012                EB36B16827A7B4500050E00D /* PushService.h in Headers */ = {isa = PBXBuildFile; fileRef = EB36B16627A7B4500050E00D /* PushService.h */; };
    20132013                EB36B16927A7B4500050E00D /* PushService.mm in Sources */ = {isa = PBXBuildFile; fileRef = EB36B16727A7B4500050E00D /* PushService.mm */; };
     2014                EB7D252B27B31B77009CB586 /* com.apple.WebKit.webpushd.sb in Resources */ = {isa = PBXBuildFile; fileRef = EB7D252A27B31B3F009CB586 /* com.apple.WebKit.webpushd.sb */; };
    20142015                EBA8D3AB27A5E31300CB7900 /* ApplePushServiceSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = EBA8D3AA27A5E31300CB7900 /* ApplePushServiceSPI.h */; };
    20152016                EBA8D3B227A5E33F00CB7900 /* ApplePushServiceConnection.mm in Sources */ = {isa = PBXBuildFile; fileRef = EBA8D3AC27A5E33E00CB7900 /* ApplePushServiceConnection.mm */; };
    … …  
    65076508                EB36B16627A7B4500050E00D /* PushService.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PushService.h; sourceTree = "<group>"; };
    65086509                EB36B16727A7B4500050E00D /* PushService.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PushService.mm; sourceTree = "<group>"; };
     6510                EB7D252927B316A6009CB586 /* com.apple.WebKit.webpushd.sb.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = com.apple.WebKit.webpushd.sb.in; sourceTree = "<group>"; };
     6511                EB7D252A27B31B3F009CB586 /* com.apple.WebKit.webpushd.sb */ = {isa = PBXFileReference; lastKnownFileType = file; name = com.apple.WebKit.webpushd.sb; path = DerivedSources/WebKit/com.apple.WebKit.webpushd.sb; sourceTree = BUILT_PRODUCTS_DIR; };
    65096512                EBA8D3AA27A5E31300CB7900 /* ApplePushServiceSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplePushServiceSPI.h; sourceTree = "<group>"; };
    65106513                EBA8D3AC27A5E33E00CB7900 /* ApplePushServiceConnection.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ApplePushServiceConnection.mm; sourceTree = "<group>"; };
    … …  
    1016110164                        isa = PBXGroup;
    1016210165                        children = (
     10166                                EB7D252827B316A6009CB586 /* mac */,
    1016310167                                517B5F63275A8D5C002DC22D /* webpushtool */,
    1016410168                                5160E954274B887100567388 /* AppBundleRequest.h */,
    … …  
    1209512099                                572EBBC32536AB84000552B3 /* com.apple.WebKit.WebAuthnProcess.sb */,
    1209612100                                E30CFB9D2660663C0094D9C0 /* com.apple.WebKit.WebContent.sb */,
     12101                                EB7D252A27B31B3F009CB586 /* com.apple.WebKit.webpushd.sb */,
    1209712102                                E1967E37150AB5E200C73169 /* com.apple.WebProcess.sb */,
    1209812103                                1AB7D6171288B9D900CFD08C /* DownloadProxyMessageReceiver.cpp */,
    … …  
    1274112746                        );
    1274212747                        path = cache;
     12748                        sourceTree = "<group>";
     12749                };
     12750                EB7D252827B316A6009CB586 /* mac */ = {
     12751                        isa = PBXGroup;
     12752                        children = (
     12753                                EB7D252927B316A6009CB586 /* com.apple.WebKit.webpushd.sb.in */,
     12754                        );
     12755                        path = mac;
    1274312756                        sourceTree = "<group>";
    1274412757                };
    … …  
    1343213445                                570AB8F320AE3BD700B8BE87 /* SecKeyProxyStore.h in Headers */,
    1343313446                                514D9F5719119D35000063A7 /* ServicesController.h in Headers */,
     13447                                5164658027A9C77400E1F2BA /* ServiceWorkerNotificationHandler.h in Headers */,
    1343413448                                1AFDE65A1954A42B00C48FFA /* SessionState.h in Headers */,
    1343513449                                1A002D49196B345D00B9AD44 /* SessionStateCoding.h in Headers */,
    … …  
    1464414658                                E17AE2C316B9C63A001C42F1 /* com.apple.WebKit.NetworkProcess.sb in Resources */,
    1464514659                                572EBBC42536AB84000552B3 /* com.apple.WebKit.WebAuthnProcess.sb in Resources */,
     14660                                EB7D252B27B31B77009CB586 /* com.apple.WebKit.webpushd.sb in Resources */,
    1464614661                                E11D35AE16B63D1B006D23D7 /* com.apple.WebProcess.sb in Resources */,
    1464714662                                6BE969C11E54D452008B7483 /* corePrediction_model in Resources */,

  • trunk/Source/WebKit/webpushd/WebPushDaemonMain.mm

    r289353 r289566  
    2727#import "WebPushDaemonMain.h"
    2828
     29#import "AuxiliaryProcess.h"
    2930#import "DaemonConnection.h"
    3031#import "DaemonDecoder.h"
    … …  
    7273namespace WebKit {
    7374
     75static void applySandbox()
     76{
     77#if PLATFORM(MAC)
     78    NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebKit"];
     79    auto profilePath = makeString(String([bundle resourcePath]), "/com.apple.WebKit.webpushd.sb");
     80    AuxiliaryProcess::applySandboxProfileForDaemon(profilePath, "com.apple.webkit.webpushd"_s);
     81#endif
     82}
     83
    7484int WebPushDaemonMain(int argc, char** argv)
    7585{
    7686    @autoreleasepool {
    7787        WTF::initializeMainThread();
     88
     89        applySandbox();
    7890
    7991#if !LOG_DISABLED || !RELEASE_LOG_DISABLED
Note: See TracChangeset for help on using the changeset viewer.