Skip to content

Commit 95dcfb0

Browse files
darryl-applecdumez
darryl-apple
authored and
cdumez
committed
Fix sandbox extension file access failures on MacCatalyst caused by multiple entitlement lookups
https://bugs.webkit.org/show_bug.cgi?id=305190 rdar://166738679 Reviewed by Per Arne Vollan. WebContent processes on MacCatalyst were experiencing sandbox extension file access failures. Investigation suggests that inferring security mode from missing entitlements required multiple lookups, contributing to a race condition. This patch switches to explicit entitlement-based detection for internal SDK builds, reducing the number of entitlement lookups required to determine the security mode. * Source/WebKit/Scripts/compile-sandbox.sh: * Source/WebKit/Scripts/process-entitlements.sh: * Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm: (WebKit::WebProcess::accessibilityFocusedUIElement): * Source/WebKit/WebProcess/com.apple.WebProcess.sb.in: Canonical link: https://commits.webkit.org/305495@main
1 parent e3c42f2 commit 95dcfb0

4 files changed

Lines changed: 41 additions & 43 deletions

File tree

‎Source/WebKit/Scripts/compile-sandbox.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ if [[ $SDK_NAME =~ "mac" ]]; then
4040
# Use the IMPORT_DIR of the build host.
4141
# That's acceptable for syntax check purposes, but will prevent adoption of
4242
# new rules in imports, e.g. when the build host runs an older macOS version.
43-
xcrun --sdk $SDK_NAME sbutil compile -D IMPORT_DIR=/System/Library/Sandbox/Profiles -D ENABLE_SANDBOX_MESSAGE_FILTER=YES -D WEBKIT2_FRAMEWORK_DIR=dir -D HOME_DIR=dir -D HOME_LIBRARY_PREFERENCES_DIR=dir -D DARWIN_USER_CACHE_DIR=dir -D DARWIN_USER_TEMP_DIR=dir $SANDBOX_PATH > /dev/null;
43+
xcrun --sdk $SDK_NAME sbutil compile -D IMPORT_DIR=/System/Library/Sandbox/Profiles -D ENABLE_SANDBOX_MESSAGE_FILTER=YES -D WEBKIT2_FRAMEWORK_DIR=dir -D HOME_DIR=dir -D HOME_LIBRARY_PREFERENCES_DIR=dir -D DARWIN_USER_CACHE_DIR=dir -D DARWIN_USER_TEMP_DIR=dir -D WEBCONTENT_IS_LOCKDOWN_MODE=NO -D WEBCONTENT_IS_ENHANCED_SECURITY=NO $SANDBOX_PATH > /dev/null;
4444
if [[ $? != 0 ]]; then
4545
exit 1;
4646
fi

‎Source/WebKit/Scripts/process-entitlements.sh‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ function mac_process_webcontent_enhancedsecurity_entitlements()
8282

8383
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
8484
then
85-
plistbuddy Add :com.apple.private.webkit.enhanced-security bool YES
8685
plistbuddy Add :com.apple.private.webkit.use-xpc-endpoint bool YES
8786
plistbuddy Add :com.apple.rootless.storage.WebKitWebContentSandbox bool YES
8887
plistbuddy Add :com.apple.QuartzCore.webkit-end-points bool YES
@@ -443,7 +442,6 @@ function maccatalyst_process_webcontent_enhancedsecurity_entitlements()
443442

444443
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
445444
then
446-
plistbuddy Add :com.apple.private.webkit.enhanced-security bool YES
447445
plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
448446
fi
449447

‎Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1031,6 +1031,11 @@ static void registerLogClient(bool isDebugLoggingEnabled, std::unique_ptr<LogCli
10311031
registerVorbisDecoderIfNeeded();
10321032
#endif
10331033

1034+
if (parameters.extraInitializationData.get<HashTranslatorASCIILiteral>("enable-lockdown-mode"_s) == "1"_s)
1035+
sandboxParameters.addParameter("WEBCONTENT_IS_LOCKDOWN_MODE"_s, "YES"_span);
1036+
else if (parameters.extraInitializationData.get<HashTranslatorASCIILiteral>("enable-enhanced-security"_s) == "1"_s)
1037+
sandboxParameters.addParameter("WEBCONTENT_IS_ENHANCED_SECURITY"_s, "YES"_span);
1038+
10341039
auto webKitBundle = [NSBundle bundleForClass:NSClassFromString(@"WKWebView")];
10351040

10361041
sandboxParameters.setOverrideSandboxProfilePath(makeString(String([webKitBundle resourcePath]), "/com.apple.WebProcess.sb"_s));

‎Source/WebKit/WebProcess/com.apple.WebProcess.sb.in‎

Lines changed: 35 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,10 @@
2626

2727

2828
(define (enhanced-security)
29-
(require-any
30-
(require-all
31-
(require-not (require-entitlement "com.apple.security.cs.allow-jit"))
32-
(require-not (require-entitlement "com.apple.private.verified-jit"))
33-
(require-not (require-entitlement "com.apple.security.cs.single-jit"))))
34-
(require-entitlement "com.apple.private.webkit.enhanced-security")
35-
)
29+
(equal? (param "WEBCONTENT_IS_ENHANCED_SECURITY") "YES"))
3630

3731
(define (lockdown-mode)
38-
(require-all
39-
(require-not (require-entitlement "com.apple.security.cs.allow-jit"))
40-
(require-not (enhanced-security))))
32+
(equal? (param "WEBCONTENT_IS_LOCKDOWN_MODE") "YES"))
4133

4234
#define FALSE #f
4335

@@ -51,9 +43,9 @@
5143

5244
#if USE(SANDBOX_VERSION_3)
5345
(allow dynamic-code-generation)
54-
(with-filter (lockdown-mode)
46+
(when (lockdown-mode)
5547
(deny dynamic-code-generation))
56-
(with-filter (enhanced-security)
48+
(when (enhanced-security)
5749
(deny dynamic-code-generation))
5850

5951
(with-filter (mac-policy-name "Sandbox")
@@ -1117,16 +1109,15 @@
11171109

11181110
; Needed for [CAContext remoteContextWithOptions]
11191111
#if HAVE(SANDBOX_STATE_FLAGS) && PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 140000
1120-
(with-filter
1121-
(require-all
1122-
(require-not (lockdown-mode))
1112+
(when (not (lockdown-mode))
1113+
(with-filter
11231114
(require-any
11241115
(require-not (state-flag "UnifiedPDFEnabled"))
1125-
(require-not (state-flag "BlockIOKitInWebContentSandbox"))))
1126-
(allow mach-lookup
1127-
(require-all
1128-
(extension "com.apple.webkit.extension.mach")
1129-
(global-name "com.apple.CARenderServer"))))
1116+
(require-not (state-flag "BlockIOKitInWebContentSandbox")))
1117+
(allow mach-lookup
1118+
(require-all
1119+
(extension "com.apple.webkit.extension.mach")
1120+
(global-name "com.apple.CARenderServer")))))
11301121
#else
11311122
(allow mach-lookup (global-name "com.apple.CARenderServer"))
11321123
#endif
@@ -1627,8 +1618,9 @@
16271618
#endif
16281619
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
16291620
(allow syscall-unix (syscall-unix-downlevels)))
1630-
(with-filter (require-all (require-not (lockdown-mode)) (require-not (state-flag "BlockIOKitInWebContentSandbox")))
1631-
(allow syscall-unix (syscall-unix-downlevels-blocked-in-lockdown-mode)))
1621+
(when (not (lockdown-mode))
1622+
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
1623+
(allow syscall-unix (syscall-unix-downlevels-blocked-in-lockdown-mode))))
16321624
#else
16331625
(allow syscall-unix
16341626
(syscall-unix-only-in-use-before-launch)
@@ -1643,11 +1635,11 @@
16431635

16441636
#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED <= 140000
16451637
(allow syscall-unix (syscall-unix-downlevels))
1646-
(with-filter (require-not (lockdown-mode))
1638+
(when (not (lockdown-mode))
16471639
(allow syscall-unix (syscall-unix-downlevels-blocked-in-lockdown-mode)))
16481640
#endif
16491641

1650-
(with-filter (require-not (lockdown-mode))
1642+
(when (not (lockdown-mode))
16511643
(allow syscall-unix (syscall-unix-blocked-in-lockdown-mode))
16521644
(when (equal? (param "CPU") "arm64")
16531645
(allow syscall-unix (syscall-unix-apple-silicon)))
@@ -1666,7 +1658,7 @@
16661658
(allow syscall-unix (syscall-number SYS_quotactl)))
16671659
#endif
16681660

1669-
(with-filter (lockdown-mode)
1661+
(when (lockdown-mode)
16701662
(deny syscall-unix (with telemetry) (syscall-unix-blocked-in-lockdown-mode))
16711663
(deny syscall-unix (with telemetry) (syscalls-rarely-used-blocked-in-lockdown-mode))
16721664
(when (equal? (param "CPU") "arm64")
@@ -1793,10 +1785,10 @@
17931785

17941786
(when (defined? 'syscall-mig)
17951787
(deny syscall-mig)
1796-
(with-filter (require-not (lockdown-mode))
1788+
(when (not (lockdown-mode))
17971789
(allow-mach-exceptions syscall-mig)
17981790
(allow syscall-mig (kernel-mig-routines-blocked-in-lockdown-mode)))
1799-
(with-filter (lockdown-mode)
1791+
(when (lockdown-mode)
18001792
(deny syscall-mig (with telemetry) (kernel-mig-routines-blocked-in-lockdown-mode)))
18011793
(allow syscall-mig (kernel-mig-routines-in-use))
18021794
#if HAVE(MACH_RANGE_CREATE)
@@ -1810,24 +1802,25 @@
18101802
(allow syscall-mig (kernel-mig-routines-iokit-service)))
18111803
(with-filter (state-flag "BlockIOKitInWebContentSandbox")
18121804
(deny syscall-mig (with no-report) (kernel-mig-routines-iokit-service)))
1813-
(with-filter (require-all (require-not (lockdown-mode)) (require-not (state-flag "BlockIOKitInWebContentSandbox")))
1814-
(allow syscall-mig (kernel-mig-routines-downlevels-blocked-in-lockdown-mode))))
1805+
(when (not (lockdown-mode))
1806+
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
1807+
(allow syscall-mig (kernel-mig-routines-downlevels-blocked-in-lockdown-mode)))))
18151808

18161809
(if (and (equal? (param "ENABLE_SANDBOX_MESSAGE_FILTER") "YES") (and (defined? 'mach-kernel-endpoint) (not (defined? 'syscall-mig))))
18171810
(allow mach-kernel-endpoint
18181811
(apply-message-filter
18191812
(deny mach-message-send)
1820-
(with-filter (require-not (lockdown-mode))
1813+
(when (not (lockdown-mode))
18211814
(allow mach-message-send (kernel-mig-routines-blocked-in-lockdown-mode)))
1822-
(with-filter (lockdown-mode)
1815+
(when (lockdown-mode)
18231816
(deny mach-message-send (with telemetry) (kernel-mig-routines-blocked-in-lockdown-mode)))
1824-
(with-filter (require-not (lockdown-mode))
1817+
(when (not (lockdown-mode))
18251818
(allow-mach-exceptions mach-message-send))
18261819

18271820
(allow mach-message-send (kernel-mig-routines-in-use))
18281821
#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED <= 140000
18291822
(allow mach-message-send (kernel-mig-routines-downlevels))
1830-
(with-filter (require-not (lockdown-mode))
1823+
(when (not (lockdown-mode))
18311824
(allow mach-message-send (kernel-mig-routines-downlevels-blocked-in-lockdown-mode)))
18321825
#endif
18331826
#if HAVE(SANDBOX_STATE_FLAGS)
@@ -1842,8 +1835,9 @@
18421835
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
18431836
(allow mach-message-send (kernel-mig-routines-downlevels))
18441837
(allow mach-message-send (kernel-mig-routines-iokit)))
1845-
(with-filter (require-all (require-not (lockdown-mode)) (require-not (state-flag "BlockIOKitInWebContentSandbox")))
1846-
(allow mach-message-send (kernel-mig-routines-downlevels-blocked-in-lockdown-mode)))
1838+
(when (not (lockdown-mode))
1839+
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
1840+
(allow mach-message-send (kernel-mig-routines-downlevels-blocked-in-lockdown-mode))))
18471841
#else
18481842
(allow mach-message-send (kernel-mig-routines-iokit))
18491843
(allow mach-message-send (kernel-mig-routines-iokit-service))
@@ -1910,17 +1904,18 @@
19101904
#if HAVE(SANDBOX_STATE_FLAGS)
19111905
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
19121906
(allow syscall-mach (syscall-mach-downlevels)))
1913-
(with-filter (require-all (require-not (lockdown-mode)) (require-not (state-flag "BlockIOKitInWebContentSandbox")))
1914-
(allow syscall-mach (syscall-mach-downlevels-blocked-in-lockdown-mode)))
1907+
(when (not (lockdown-mode))
1908+
(with-filter (require-not (state-flag "BlockIOKitInWebContentSandbox"))
1909+
(allow syscall-mach (syscall-mach-downlevels-blocked-in-lockdown-mode))))
19151910
#endif
19161911
#if !PLATFORM(MAC) || __MAC_OS_X_VERSION_MIN_REQUIRED <= 140000
19171912
(allow syscall-mach (syscall-mach-downlevels))
1918-
(with-filter (require-not (lockdown-mode))
1913+
(when (not (lockdown-mode))
19191914
(allow syscall-mach (syscall-mach-downlevels-blocked-in-lockdown-mode)))
19201915
#endif
1921-
(with-filter (require-not (lockdown-mode))
1916+
(when (not (lockdown-mode))
19221917
(allow syscall-mach (syscall-mach-blocked-in-lockdown-mode)))
1923-
(with-filter (lockdown-mode)
1918+
(when (lockdown-mode)
19241919
(deny syscall-mach (with telemetry) (syscall-mach-blocked-in-lockdown-mode)))
19251920
(when (defined? 'MSC_mach_msg2_trap)
19261921
(allow syscall-mach (machtrap-number MSC_mach_msg2_trap))))

0 commit comments

Comments
 (0)