Changeset 167603 in webkit

Timestamp:

Apr 21, 2014 12:10:33 PM (10 years ago)

Author:

andersca@apple.com

Message:

Check the com.apple.security.network.client entitlement for all processes
​https://bugs.webkit.org/show_bug.cgi?id=131942
<rdar://problem/12354188>

Reviewed by Dan Bernstein.

• NetworkProcess/EntryPoint/mac/XPCService/NetworkServiceEntryPoint.mm:

(WebKit::NetworkServiceInitializerDelegate::NetworkServiceInitializerDelegate):

• Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:
• Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm:

(WebKit::XPCServiceInitializerDelegate::checkEntitlements):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• NetworkProcess/EntryPoint/mac/XPCService/NetworkServiceEntryPoint.mm (modified) (1 diff)
• Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h (modified) (1 diff)
• Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-04-21  Anders Carlsson  <andersca@apple.com>
+
+        Check the com.apple.security.network.client entitlement for all processes
+        https://bugs.webkit.org/show_bug.cgi?id=131942
+        <rdar://problem/12354188>
+
+        Reviewed by Dan Bernstein.
+
+        * NetworkProcess/EntryPoint/mac/XPCService/NetworkServiceEntryPoint.mm:
+        (WebKit::NetworkServiceInitializerDelegate::NetworkServiceInitializerDelegate):
+        * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:
+        * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm:
+        (WebKit::XPCServiceInitializerDelegate::checkEntitlements):
+
 2014-04-20  Dan Bernstein  <mitz@apple.com>
 

trunk/Source/WebKit2/NetworkProcess/EntryPoint/mac/XPCService/NetworkServiceEntryPoint.mm

@@ -39 +39 @@
     {
     }
-
-#if PLATFORM(MAC)
-    virtual bool checkEntitlements() override
-    {
-        if (!isClientSandboxed())
-            return true;
-
-        if (!hasEntitlement("com.apple.security.network.client")) {
-            NSLog(@"Application does not have the 'com.apple.security.network.client' entitlement.");
-            return false;
-        }
-
-        return true;
-    }
-#endif
-
 };
 

trunk/Source/WebKit2/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h

@@ -43 +43 @@
     virtual ~XPCServiceInitializerDelegate();
 
+#if PLATFORM(MAC)
     virtual bool checkEntitlements();
+#endif
+
     virtual bool getConnectionIdentifier(IPC::Connection::Identifier& identifier);
     virtual bool getClientIdentifier(String& clientIdentifier);

trunk/Source/WebKit2/Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.mm

@@ -51 +51 @@
 }
 
+#if PLATFORM(MAC)
 bool XPCServiceInitializerDelegate::checkEntitlements()
 {
+    if (!isClientSandboxed())
+        return true;
+
+    // FIXME: Once we're 100% sure that a process can't access the network we can get rid of this requirement for all processes.
+    if (!hasEntitlement("com.apple.security.network.client")) {
+        NSLog(@"Application does not have the 'com.apple.security.network.client' entitlement.");
+        return false;
+    }
+
     return true;
+#endif
 }