Changeset 239440 in webkit

Timestamp:

Dec 20, 2018 8:18:26 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

[GTK][WPE] Grant the sandbox read access to XDG_DATA_HOME/prgname
​https://bugs.webkit.org/show_bug.cgi?id=192929

Patch by Patrick Griffis <Patrick Griffis> on 2018-12-20
Reviewed by Michael Catanzaro.

• UIProcess/API/glib/WebKitWebContext.cpp:
• UIProcess/Launcher/glib/BubblewrapLauncher.cpp:

(WebKit::bubblewrapSpawn):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/glib/WebKitWebContext.cpp (modified) (1 diff)
• UIProcess/Launcher/glib/BubblewrapLauncher.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-12-20  Patrick Griffis  <pgriffis@igalia.com>
+
+        [GTK][WPE] Grant the sandbox read access to XDG_DATA_HOME/prgname
+        https://bugs.webkit.org/show_bug.cgi?id=192929
+
+        Reviewed by Michael Catanzaro.
+
+        * UIProcess/API/glib/WebKitWebContext.cpp:
+        * UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
+        (WebKit::bubblewrapSpawn):
+
 2018-12-20  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp

@@ -1160 +1160 @@
  * This is only implemented on Linux and is a no-op otherwise.
  *
- * If you read from `$XDG_CONFIG_HOME/g_get_prgname()` or `$XDG_CACHE_HOME/g_get_prgname()`
- * in your WebProcess you must ensure it exists before subprocesses are created.
- * This behavior may change in the future.
+ * The web process is granted read-only access to the subdirectory matching g_get_prgname()
+ * in `$XDG_CONFIG_HOME`, `$XDG_CACHE_HOME`, and `$XDG_DATA_HOME` if it exists before the
+ * process is created. This behavior may change in the future.
  *
  * Since: 2.24

trunk/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

@@ -780 +780 @@
         GUniquePtr<char> configDir(g_build_filename(g_get_user_config_dir(), g_get_prgname(), nullptr));
         GUniquePtr<char> cacheDir(g_build_filename(g_get_user_cache_dir(), g_get_prgname(), nullptr));
+        GUniquePtr<char> dataDir(g_build_filename(g_get_user_data_dir(), g_get_prgname(), nullptr));
+
+        sandboxArgs.appendVector(Vector<CString>({
+            "--ro-bind-try", cacheDir.get(), cacheDir.get(),
+            "--ro-bind-try", configDir.get(), configDir.get(),
+            "--ro-bind-try", dataDir.get(), dataDir.get(),
+        }));
 
         Vector<String> extraPaths = { "applicationCacheDirectory", "waylandSocket"};
@@ -787 +794 @@
                 sandboxArgs.appendVector(Vector<CString>({ "--bind-try", extraPath.utf8(), extraPath.utf8() }));
         }
-
-        sandboxArgs.appendVector(Vector<CString>({
-            "--ro-bind-try", cacheDir.get(), cacheDir.get(),
-            "--ro-bind-try", configDir.get(), configDir.get(),
-        }));
 
         bindDBusSession(sandboxArgs, proxy);