Skip to content
This repository was archived by the owner on Jun 24, 2022. It is now read-only.

Commit 51ecb2f

Browse files
author
[email protected]
committed
We should cache the compiled sandbox profile in a data vault
https://bugs.webkit.org/show_bug.cgi?id=184991 Patch by Ben Richards <[email protected]> on 2018-08-03 Reviewed by Ryosuke Niwa. Source/WebCore: Added functionality to FileHandle so that it can lock a file while open. Added a function to FileSystem to delete non empty directories. * platform/FileHandle.cpp: (WebCore::FileHandle::FileHandle): (WebCore::FileHandle::open): (WebCore::FileHandle::close): * platform/FileHandle.h: * platform/FileSystem.h: * platform/cocoa/FileSystemCocoa.mm: (WebCore::FileSystem::deleteNonEmptyDirectory): Source/WebKit: This patch changes a few things (note: data vaults and sandbox entitlements are only used in internal builds): (1) Instead of compiling a sandbox every time a process is launched, processes now look for a cached sandbox in a process specific data vault on macOS platforms. (ChildProcessMac.mm) (2) If a valid cached sandbox is not found, a process will create the data vault (or ensure that it exists), compile a sandbox, and cache it. (3) In order to create process specific data vaults, each process now has their own <process name>-OSX-sandbox.entitlements file which contains an entitlement with a process specific "storage class" which ensures that each process can only ever access its own data vault. (See the article on confluence "Data Vaults and Restricted Files" for more info) (4) The sandbox entitlements file for the Network, WebContent and Plugin services are loaded dynamically through Scripts/<process name>-process-entitlements.sh which is triggered in a new build phase for each service. The Storage process sandbox entitlements are loaded directly in Configurations/StorageService.xcconfig. The reason that the sandbox entitlements are applied dynamically is so that these sandbox entitlements are only applied when WK_USE_RESTRICTED_ENTITLEMENTS is YES. This means that open source builds will still work. * Configurations/Network-OSX-sandbox.entitlements: Added. * Configurations/Plugin-OSX-sandbox.entitlements: Added. * Configurations/Storage-OSX-sandbox.entitlements: Added. * Configurations/StorageService.xcconfig: * Configurations/WebContent-OSX-sandbox.entitlements: Added. * Configurations/WebKit.xcconfig: * NetworkProcess/NetworkProcess.h: * PluginProcess/PluginProcess.h: * Scripts/process-network-entitlements.sh: Added. * Scripts/process-plugin-entitlements.sh: Added. * Scripts/process-webcontent-entitlements.sh: * Shared/ChildProcess.h: * Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h: (WebKit::XPCServiceInitializer): * Shared/SandboxInitializationParameters.h: (WebKit::SandboxInitializationParameters::setOverrideSandboxProfilePath): (WebKit::SandboxInitializationParameters::overrideSandboxProfilePath const): (WebKit::SandboxInitializationParameters::setSandboxProfile): (WebKit::SandboxInitializationParameters::sandboxProfile const): (): Deleted. * Shared/mac/ChildProcessMac.mm: (WebKit::SandboxProfileDeleter::operator()): (WebKit::SandboxParametersDeleter::operator()): (WebKit::SandboxInfo::SandboxInfo): (WebKit::fileContents): (WebKit::processStorageClass): (WebKit::setAndSerializeSandboxParameters): (WebKit::getUserCacheDirectory): (WebKit::sandboxDataVaultParentDirectory): (WebKit::sandboxDirectory): (WebKit::sandboxFilePath): (WebKit::ensureSandboxCacheDirectory): (WebKit::writeSandboxDataToCacheFile): (WebKit::compileAndCacheSandboxProfile): (WebKit::tryApplyCachedSandbox): (WebKit::webKit2Bundle): (WebKit::sandboxProfilePath): (WebKit::compileAndApplySandboxSlowCase): (WebKit::applySandbox): (WebKit::initializeSandboxParameters): (WebKit::ChildProcess::initializeSandbox): * Shared/mac/SandboxInitialiationParametersMac.mm: (WebKit::SandboxInitializationParameters::SandboxInitializationParameters): * StorageProcess/StorageProcess.h: * WebKit.xcodeproj/project.pbxproj: * WebProcess/WebProcess.h: Source/WTF: Added trace points for sandbox initialization and exposed functions needed for sandbox caching * wtf/SystemTracing.h: * wtf/spi/darwin/SandboxSPI.h: Tools: Added trace points for sandbox initialization * Tracing/SystemTracePoints.plist: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@234569 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 8943dca commit 51ecb2f

28 files changed

+800
-79
lines changed

‎Source/WTF/ChangeLog

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
2018-08-03 Ben Richards <[email protected]>
2+
3+
We should cache the compiled sandbox profile in a data vault
4+
https://bugs.webkit.org/show_bug.cgi?id=184991
5+
6+
Reviewed by Ryosuke Niwa.
7+
8+
Added trace points for sandbox initialization and exposed functions needed for sandbox caching
9+
10+
* wtf/SystemTracing.h:
11+
* wtf/spi/darwin/SandboxSPI.h:
12+
113
2018-08-02 Saam Barati <[email protected]>
214

315
Reading instructionPointer from PlatformRegisters may fail when using pointer tagging

‎Source/WTF/wtf/SystemTracing.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ enum TracePointCode {
9696
CommitLayerTreeEnd,
9797
ProcessLaunchStart,
9898
ProcessLaunchEnd,
99+
InitializeSandboxStart,
100+
InitializeSandboxEnd,
99101
};
100102

101103
#ifdef __cplusplus

‎Source/WTF/wtf/spi/darwin/SandboxSPI.h

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,21 @@ enum sandbox_filter_type {
4242

4343
WTF_EXTERN_C_BEGIN
4444

45+
typedef struct {
46+
char* builtin;
47+
unsigned char* data;
48+
size_t size;
49+
#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED < 101300
50+
char* trace;
51+
#endif
52+
} *sandbox_profile_t;
53+
54+
typedef struct {
55+
const char **params;
56+
size_t size;
57+
size_t available;
58+
} *sandbox_params_t;
59+
4560
extern const char *const APP_SANDBOX_READ;
4661
extern const char *const APP_SANDBOX_READ_WRITE;
4762
extern const enum sandbox_filter_type SANDBOX_CHECK_NO_REPORT;
@@ -54,6 +69,12 @@ int sandbox_container_path_for_pid(pid_t, char *buffer, size_t bufsize);
5469
int sandbox_extension_release(int64_t extension_handle);
5570
int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);
5671
int64_t sandbox_extension_consume(const char *extension_token);
72+
sandbox_params_t sandbox_create_params(void);
73+
int sandbox_set_param(sandbox_params_t, const char *key, const char *value);
74+
void sandbox_free_params(sandbox_params_t);
75+
sandbox_profile_t sandbox_compile_file(const char *path, sandbox_params_t, char **error);
76+
void sandbox_free_profile(sandbox_profile_t);
77+
int sandbox_apply(sandbox_profile_t);
5778

5879
WTF_EXTERN_C_END
5980

‎Source/WebCore/ChangeLog

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
2018-08-03 Ben Richards <[email protected]>
2+
3+
We should cache the compiled sandbox profile in a data vault
4+
https://bugs.webkit.org/show_bug.cgi?id=184991
5+
6+
Reviewed by Ryosuke Niwa.
7+
8+
Added functionality to FileHandle so that it can lock a file while open.
9+
Added a function to FileSystem to delete non empty directories.
10+
11+
* platform/FileHandle.cpp:
12+
(WebCore::FileHandle::FileHandle):
13+
(WebCore::FileHandle::open):
14+
(WebCore::FileHandle::close):
15+
* platform/FileHandle.h:
16+
* platform/FileSystem.h:
17+
* platform/cocoa/FileSystemCocoa.mm:
18+
(WebCore::FileSystem::deleteNonEmptyDirectory):
19+
120
2018-08-03 Justin Fan <[email protected]>
221

322
WebGL 2 conformance: vertex_arrays/vertex_array_object.html

‎Source/WebCore/platform/FileHandle.cpp

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,23 @@
3232
namespace WebCore {
3333

3434
FileHandle::FileHandle(const String& path, FileSystem::FileOpenMode mode)
35-
: m_path(path)
36-
, m_mode(mode)
35+
: m_path { path }
36+
, m_mode { mode }
3737
{
3838
}
3939

4040
FileHandle::FileHandle(FileHandle&& other)
41-
: m_path(WTFMove(other.m_path))
42-
, m_mode(WTFMove(other.m_mode))
43-
, m_fileHandle(std::exchange(other.m_fileHandle, FileSystem::invalidPlatformFileHandle))
41+
: m_path { WTFMove(other.m_path) }
42+
, m_mode { WTFMove(other.m_mode) }
43+
, m_fileHandle { std::exchange(other.m_fileHandle, FileSystem::invalidPlatformFileHandle) }
44+
{
45+
}
46+
47+
FileHandle::FileHandle(const String& path, FileSystem::FileOpenMode mode, OptionSet<FileSystem::FileLockMode> lockMode)
48+
: m_path { path }
49+
, m_mode { mode }
50+
, m_shouldLock { true }
51+
, m_lockMode { lockMode }
4452
{
4553
}
4654

@@ -77,7 +85,7 @@ bool FileHandle::open(const String& path, FileSystem::FileOpenMode mode)
7785
bool FileHandle::open()
7886
{
7987
if (!*this)
80-
m_fileHandle = FileSystem::openFile(m_path, m_mode);
88+
m_fileHandle = m_shouldLock ? FileSystem::openAndLockFile(m_path, m_mode, m_lockMode) : FileSystem::openFile(m_path, m_mode);
8189
return static_cast<bool>(*this);
8290
}
8391

@@ -115,7 +123,11 @@ bool FileHandle::printf(const char* format, ...)
115123

116124
void FileHandle::close()
117125
{
118-
FileSystem::closeFile(m_fileHandle);
126+
if (m_shouldLock && *this) {
127+
// FileSystem::unlockAndCloseFile requires the file handle to be valid while closeFile does not
128+
FileSystem::unlockAndCloseFile(m_fileHandle);
129+
} else
130+
FileSystem::closeFile(m_fileHandle);
119131
}
120132

121133
} // namespace WebCore

‎Source/WebCore/platform/FileHandle.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ class WEBCORE_EXPORT FileHandle final {
3838
public:
3939
FileHandle() = default;
4040
FileHandle(const String& path, FileSystem::FileOpenMode);
41+
FileHandle(const String& path, FileSystem::FileOpenMode, OptionSet<FileSystem::FileLockMode>);
4142
FileHandle(const FileHandle& other) = delete;
4243
FileHandle(FileHandle&& other);
4344

@@ -59,6 +60,8 @@ class WEBCORE_EXPORT FileHandle final {
5960
String m_path;
6061
FileSystem::FileOpenMode m_mode { FileSystem::FileOpenMode::Read };
6162
FileSystem::PlatformFileHandle m_fileHandle { FileSystem::invalidPlatformFileHandle };
63+
bool m_shouldLock { false };
64+
OptionSet<FileSystem::FileLockMode> m_lockMode;
6265
};
6366

6467
} // namespace WebCore

‎Source/WebCore/platform/FileSystem.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ String roamingUserSpecificStorageDirectory();
184184

185185
#if PLATFORM(COCOA)
186186
WEBCORE_EXPORT NSString *createTemporaryDirectory(NSString *directoryPrefix);
187+
WEBCORE_EXPORT bool deleteNonEmptyDirectory(const String&);
187188
#endif
188189

189190
WEBCORE_EXPORT String realPath(const String&);

‎Source/WebCore/platform/cocoa/FileSystemCocoa.mm

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,5 +134,10 @@ bool getVolumeFreeSpace(const String& path, uint64_t& freeSpace)
134134
return [[NSFileManager defaultManager] stringWithFileSystemRepresentation:path.data() length:length];
135135
}
136136

137+
bool deleteNonEmptyDirectory(const String& path)
138+
{
139+
return [[NSFileManager defaultManager] removeItemAtPath:path error:nil];
140+
}
141+
137142
} // namespace FileSystem
138143
} // namespace WebCore

‎Source/WebKit/ChangeLog

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,71 @@
1+
2018-08-03 Ben Richards <[email protected]>
2+
3+
We should cache the compiled sandbox profile in a data vault
4+
https://bugs.webkit.org/show_bug.cgi?id=184991
5+
6+
Reviewed by Ryosuke Niwa.
7+
8+
This patch changes a few things (note: data vaults and sandbox entitlements are only used in internal builds):
9+
(1) Instead of compiling a sandbox every time a process is launched, processes now look for a cached sandbox
10+
in a process specific data vault on macOS platforms. (ChildProcessMac.mm)
11+
(2) If a valid cached sandbox is not found, a process will create the data vault (or ensure that it exists),
12+
compile a sandbox, and cache it.
13+
(3) In order to create process specific data vaults, each process now has their own <process name>-OSX-sandbox.entitlements
14+
file which contains an entitlement with a process specific "storage class" which ensures that each process
15+
can only ever access its own data vault. (See the article on confluence "Data Vaults and Restricted Files" for more info)
16+
(4) The sandbox entitlements file for the Network, WebContent and Plugin services are loaded dynamically
17+
through Scripts/<process name>-process-entitlements.sh which is triggered in a new build phase for each service.
18+
The Storage process sandbox entitlements are loaded directly in Configurations/StorageService.xcconfig.
19+
The reason that the sandbox entitlements are applied dynamically is so that these sandbox entitlements
20+
are only applied when WK_USE_RESTRICTED_ENTITLEMENTS is YES. This means that open source builds will still work.
21+
22+
* Configurations/Network-OSX-sandbox.entitlements: Added.
23+
* Configurations/Plugin-OSX-sandbox.entitlements: Added.
24+
* Configurations/Storage-OSX-sandbox.entitlements: Added.
25+
* Configurations/StorageService.xcconfig:
26+
* Configurations/WebContent-OSX-sandbox.entitlements: Added.
27+
* Configurations/WebKit.xcconfig:
28+
* NetworkProcess/NetworkProcess.h:
29+
* PluginProcess/PluginProcess.h:
30+
* Scripts/process-network-entitlements.sh: Added.
31+
* Scripts/process-plugin-entitlements.sh: Added.
32+
* Scripts/process-webcontent-entitlements.sh:
33+
* Shared/ChildProcess.h:
34+
* Shared/EntryPointUtilities/mac/XPCService/XPCServiceEntryPoint.h:
35+
(WebKit::XPCServiceInitializer):
36+
* Shared/SandboxInitializationParameters.h:
37+
(WebKit::SandboxInitializationParameters::setOverrideSandboxProfilePath):
38+
(WebKit::SandboxInitializationParameters::overrideSandboxProfilePath const):
39+
(WebKit::SandboxInitializationParameters::setSandboxProfile):
40+
(WebKit::SandboxInitializationParameters::sandboxProfile const):
41+
(): Deleted.
42+
* Shared/mac/ChildProcessMac.mm:
43+
(WebKit::SandboxProfileDeleter::operator()):
44+
(WebKit::SandboxParametersDeleter::operator()):
45+
(WebKit::SandboxInfo::SandboxInfo):
46+
(WebKit::fileContents):
47+
(WebKit::processStorageClass):
48+
(WebKit::setAndSerializeSandboxParameters):
49+
(WebKit::getUserCacheDirectory):
50+
(WebKit::sandboxDataVaultParentDirectory):
51+
(WebKit::sandboxDirectory):
52+
(WebKit::sandboxFilePath):
53+
(WebKit::ensureSandboxCacheDirectory):
54+
(WebKit::writeSandboxDataToCacheFile):
55+
(WebKit::compileAndCacheSandboxProfile):
56+
(WebKit::tryApplyCachedSandbox):
57+
(WebKit::webKit2Bundle):
58+
(WebKit::sandboxProfilePath):
59+
(WebKit::compileAndApplySandboxSlowCase):
60+
(WebKit::applySandbox):
61+
(WebKit::initializeSandboxParameters):
62+
(WebKit::ChildProcess::initializeSandbox):
63+
* Shared/mac/SandboxInitialiationParametersMac.mm:
64+
(WebKit::SandboxInitializationParameters::SandboxInitializationParameters):
65+
* StorageProcess/StorageProcess.h:
66+
* WebKit.xcodeproj/project.pbxproj:
67+
* WebProcess/WebProcess.h:
68+
169
2018-08-03 Alex Christensen <[email protected]>
270

371
Fix spelling of "overridden"

‎Source/WebKit/Configurations/Network-OSX-sandbox.entitlements

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.rootless.storage.WebKitNetworkingSandbox</key>
6+
<true/>
7+
</dict>
8+
</plist>

0 commit comments

Comments
 (0)