Skip to content

Commit

Permalink
Fix CARenderServer sandbox violation
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=274884
rdar://128983768

Reviewed by Chris Dumez.

Fix CARenderServer sandbox violation under WebPage::platformInitialize on macOS.
Do not try to eagerly open up a Mach connection to CARenderServer when unified
PDF is enabled, since this access is not required and blocked in the sandbox in
that case.

* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:
(WebKit::WebPage::platformInitialize):

Canonical link: https://commits.webkit.org/279511@main
  • Loading branch information
pvollan committed May 30, 2024
1 parent e1aad25 commit e42a325
Showing 1 changed file with 11 additions and 4 deletions.
15 changes: 11 additions & 4 deletions Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm
Original file line number Diff line number Diff line change
Expand Up @@ -125,13 +125,20 @@
#if USE(LIBWEBRTC)
LibWebRTCCodecs::setCallbacks(m_page->settings().webRTCPlatformCodecsInGPUProcessEnabled(), m_page->settings().webRTCRemoteVideoFrameEnabled());
LibWebRTCCodecs::setWebRTCMediaPipelineAdditionalLoggingEnabled(m_page->settings().webRTCMediaPipelineAdditionalLoggingEnabled());
#endif
#endif

#if PLATFORM(MAC)
// In order to be able to block launchd on macOS, we need to eagerly open up a connection to CARenderServer here.
// This is because PDF rendering on macOS requires access to CARenderServer, unless we're in Lockdown mode.
if (!WebProcess::singleton().isLockdownModeEnabled())
CARenderServerGetServerPort(nullptr);
// This is because PDF rendering on macOS requires access to CARenderServer, unless unified PDF is enabled.
// In Lockdown mode we always block access to CARenderServer.
bool pdfRenderingRequiresRenderServerAccess = true;
#if ENABLE(UNIFIED_PDF)
pdfRenderingRequiresRenderServerAccess = !m_page->settings().unifiedPDFEnabled();
#endif
if (pdfRenderingRequiresRenderServerAccess && !WebProcess::singleton().isLockdownModeEnabled())
CARenderServerGetServerPort(nullptr);
#endif // PLATFORM(MAC)

#if PLATFORM(IOS_FAMILY)
setInsertionPointColor(parameters.insertionPointColor);
setHardwareKeyboardState(parameters.hardwareKeyboardState);
Expand Down

0 comments on commit e42a325

Please sign in to comment.