Changeset 242807 in webkit

Timestamp:

Mar 12, 2019 11:51:13 AM (5 years ago)

Author:

pvollan@apple.com

Message:

[iOS] Block access to backboardd service
​https://bugs.webkit.org/show_bug.cgi?id=195484

Reviewed by Brent Fulgham.

This patch is addressing blocking the backboardd service "com.apple.backboard.hid.services". Getting the
backlight level in the WebContent process will initiate a connection with this service. To be able to
block the service, the backlight level is queried in the UI process and sent to the WebContent process
when the WebContent process is started, and when the backlight level is changed. On the WebContent side,
the method getting the backlight level is swizzled to return the value sent from the UI process.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::displayBrightness):
(WebKit::WebProcessPool::backlightLevelDidChangeCallback):
(WebKit::WebProcessPool::registerNotificationObservers):
(WebKit::WebProcessPool::unregisterNotificationObservers):

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::initializeNewWebProcess):

• UIProcess/WebProcessPool.h:
• WebProcess/WebProcess.h:
• WebProcess/WebProcess.messages.in:
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::currentBacklightLevel):
(WebKit::WebProcess::backlightLevelDidChange):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/spi/ios/UIKitSPI.h (modified) (2 diffs)
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (modified) (1 diff)
• UIProcess/Cocoa/WebProcessPoolCocoa.mm (modified) (5 diffs)
• UIProcess/WebProcessPool.cpp (modified) (1 diff)
• UIProcess/WebProcessPool.h (modified) (1 diff)
• WebProcess/WebProcess.h (modified) (3 diffs)
• WebProcess/WebProcess.messages.in (modified) (1 diff)
• WebProcess/cocoa/WebProcessCocoa.mm (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-03-12  Per Arne Vollan  <pvollan@apple.com>
+
+        [iOS] Block access to backboardd service
+        https://bugs.webkit.org/show_bug.cgi?id=195484
+
+        Reviewed by Brent Fulgham.
+
+        This patch is addressing blocking the backboardd service "com.apple.backboard.hid.services". Getting the
+        backlight level in the WebContent process will initiate a connection with this service. To be able to
+        block the service, the backlight level is queried in the UI process and sent to the WebContent process
+        when the WebContent process is started, and when the backlight level is changed. On the WebContent side,
+        the method getting the backlight level is swizzled to return the value sent from the UI process.
+
+        * Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
+        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
+        (WebKit::WebProcessPool::displayBrightness):
+        (WebKit::WebProcessPool::backlightLevelDidChangeCallback):
+        (WebKit::WebProcessPool::registerNotificationObservers):
+        (WebKit::WebProcessPool::unregisterNotificationObservers):
+        * UIProcess/WebProcessPool.cpp:
+        (WebKit::WebProcessPool::initializeNewWebProcess):
+        * UIProcess/WebProcessPool.h:
+        * WebProcess/WebProcess.h:
+        * WebProcess/WebProcess.messages.in:
+        * WebProcess/cocoa/WebProcessCocoa.mm:
+        (WebKit::currentBacklightLevel):
+        (WebKit::WebProcess::backlightLevelDidChange):
+
 2019-03-12  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebKit/Platform/spi/ios/UIKitSPI.h

@@ -1125 +1125 @@
 #endif
 
+@interface UIDevice ()
+@property (nonatomic, setter=_setBacklightLevel:) float _backlightLevel;
+@end
+
 static inline bool currentUserInterfaceIdiomIsPad()
 {
@@ -1188 +1192 @@
 UIEdgeInsets UIEdgeInsetsAdd(UIEdgeInsets lhs, UIEdgeInsets rhs, UIRectEdge);
 
+extern NSString *const UIBacklightLevelChangedNotification;
+
 WTF_EXTERN_C_END

trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb

@@ -450 +450 @@
     (global-name "com.apple.coremedia.decompressionsession")
     (global-name "com.apple.coremedia.videoqueue"))
+
+;; FIXME: remove the send-signal when this rule is no longer generating crashes.
+(deny mach-lookup (with send-signal SIGKILL)
+    (global-name "com.apple.backboard.hid.services"))
 
 ;; These services have been identified as unused during living-on.

trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

@@ -78 +78 @@
 #endif
 
+#if PLATFORM(IOS)
+SOFT_LINK_PRIVATE_FRAMEWORK(BackBoardServices)
+SOFT_LINK(BackBoardServices, BKSDisplayBrightnessGetCurrent, float, (), ());
+#endif
+
 namespace WebKit {
 using namespace WebCore;
@@ -382 +387 @@
 }
 
+#if PLATFORM(IOS)
+float WebProcessPool::displayBrightness()
+{
+    return BKSDisplayBrightnessGetCurrent();
+}
+    
+void WebProcessPool::backlightLevelDidChangeCallback(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
+{
+    WebProcessPool* pool = reinterpret_cast<WebProcessPool*>(observer);
+    pool->sendToAllProcesses(Messages::WebProcess::BacklightLevelDidChange(BKSDisplayBrightnessGetCurrent()));
+}
+#endif
+
 void WebProcessPool::registerNotificationObservers()
 {
@@ -428 +446 @@
         setApplicationIsActive(false);
     }];
-
+#elif PLATFORM(IOS)
+    CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenter(), this, backlightLevelDidChangeCallback, static_cast<CFStringRef>(UIBacklightLevelChangedNotification), nullptr, CFNotificationSuspensionBehaviorCoalesce);
 #endif // !PLATFORM(IOS_FAMILY)
 }
@@ -435 +454 @@
 {
 #if !PLATFORM(IOS_FAMILY)
-    [[NSNotificationCenter defaultCenter] removeObserver:m_enhancedAccessibilityObserver.get()];    
+    [[NSNotificationCenter defaultCenter] removeObserver:m_enhancedAccessibilityObserver.get()];
     [[NSNotificationCenter defaultCenter] removeObserver:m_automaticTextReplacementNotificationObserver.get()];
     [[NSNotificationCenter defaultCenter] removeObserver:m_automaticSpellingCorrectionNotificationObserver.get()];
@@ -446 +465 @@
     [[NSNotificationCenter defaultCenter] removeObserver:m_activationObserver.get()];
     [[NSNotificationCenter defaultCenter] removeObserver:m_deactivationObserver.get()];
+#elif PLATFORM(IOS)
+    CFNotificationCenterRemoveObserver(CFNotificationCenterGetDarwinNotifyCenter(), this, static_cast<CFStringRef>(UIBacklightLevelChangedNotification) , nullptr);
 #endif // !PLATFORM(IOS_FAMILY)
 }

trunk/Source/WebKit/UIProcess/WebProcessPool.cpp

@@ -998 +998 @@
     }
 
+#if PLATFORM(IOS)
+    process.send(Messages::WebProcess::BacklightLevelDidChange(displayBrightness()), 0);
+#endif
+
 #if ENABLE(REMOTE_INSPECTOR)
     // Initialize remote inspector connection now that we have a sub-process that is hosting one of our web views.

trunk/Source/WebKit/UIProcess/WebProcessPool.h

@@ -573 +573 @@
     void updateMaxSuspendedPageCount();
 
+#if PLATFORM(IOS)
+    static float displayBrightness();
+    static void backlightLevelDidChangeCallback(CFNotificationCenterRef, void *observer, CFStringRef name, const void *, CFDictionaryRef userInfo);    
+#endif
+
     Ref<API::ProcessPoolConfiguration> m_configuration;
 

trunk/Source/WebKit/WebProcess/WebProcess.h

@@ -247 +247 @@
 #endif
 
+#if PLATFORM(IOS)
+    float backlightLevel() const { return m_backlightLevel; }
+#endif
+
 #if PLATFORM(COCOA)
     void setMediaMIMETypes(const Vector<String>);
@@ -410 +414 @@
 #endif
 
+#if PLATFORM(IOS)
+    void backlightLevelDidChange(float backlightLevel);
+#endif
+
 #if ENABLE(VIDEO)
     void suspendAllMediaBuffering();
@@ -507 +515 @@
     HashMap<String, RefPtr<SandboxExtension>> m_mediaCaptureSandboxExtensions;
 #endif
+
+#if PLATFORM(IOS)
+    float m_backlightLevel { 0 };
+#endif
 };
 

trunk/Source/WebKit/WebProcess/WebProcess.messages.in

@@ -135 +135 @@
 #endif
 
+#if PLATFORM(IOS)
+    BacklightLevelDidChange(float backlightLevel)
+#endif
+
     IsJITEnabled() -> (bool enabled) Async
 

trunk/Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm

@@ -75 +75 @@
 #import <wtf/cocoa/NSURLExtras.h>
 
+#if PLATFORM(IOS)
+#import "UIKitSPI.h"
+#endif
+
 #if PLATFORM(IOS_FAMILY)
 #import "WKAccessibilityWebPageObjectIOS.h"
@@ -699 +703 @@
 #endif
 
+#if PLATFORM(IOS)
+static float currentBacklightLevel()
+{
+    return WebProcess::singleton().backlightLevel();
+}
+
+void WebProcess::backlightLevelDidChange(float backlightLevel)
+{
+    m_backlightLevel = backlightLevel;
+
+    static std::once_flag onceFlag;
+    std::call_once(
+        onceFlag,
+        [] {
+            Method methodToPatch = class_getInstanceMethod([UIDevice class], @selector(_backlightLevel));
+            method_setImplementation(methodToPatch, reinterpret_cast<IMP>(currentBacklightLevel));
+        });
+}
+#endif
+
 void WebProcess::setMediaMIMETypes(const Vector<String> types)
 {