Skip to content

Allow owning app id names on the a11y bus - #5898

Merged
GeorgesStavracas merged 4 commits into
flatpak:mainfrom
GeorgesStavracas:gbsneto/a11y-own-name
Aug 29, 2024
Merged

Allow owning app id names on the a11y bus#5898
GeorgesStavracas merged 4 commits into
flatpak:mainfrom
GeorgesStavracas:gbsneto/a11y-own-name

Conversation

@GeorgesStavracas

@GeorgesStavracas GeorgesStavracas commented Aug 14, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

This is necessary for WebKit, and potentially LibreOffice, that may spawn a Flatpak subsandbox proceess with an a11y tree, and may need to connect both trees.

Add --a11y-own-name to flatpak-run, and a corresponding way to pass this value through the Flatpak portal.

@GeorgesStavracas
GeorgesStavracas marked this pull request as draft August 14, 2024 18:22
@TingPing
TingPing self-requested a review August 14, 2024 21:11
@GeorgesStavracas
GeorgesStavracas marked this pull request as ready for review August 14, 2024 21:37
GeorgesStavracas added a commit to GeorgesStavracas/flatpak-xdg-utils that referenced this pull request Aug 14, 2024
@GeorgesStavracas
flatpak-spawn: Add "--sandbox-a11y-own-name"
a3b91cd 
This is the flatpak-spawn counterpart to the new option of the Flatpak
portal.

See flatpak/flatpak#5898
@GeorgesStavracas GeorgesStavracas mentioned this pull request Aug 14, 2024
Merged
@GeorgesStavracas

GeorgesStavracas commented Aug 14, 2024

Copy link
Copy Markdown
Member Author

flatpak/flatpak-xdg-utils#67 adds --sandbox-a11y-own-name to flatpak-spawn

@GeorgesStavracas GeorgesStavracas mentioned this pull request Aug 15, 2024
Merged
smcv
smcv approved these changes Aug 22, 2024
View reviewed changes

@smcv smcv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense to me

GeorgesStavracas and others added 4 commits August 29, 2024 14:03
@GeorgesStavracas
context: Add a new FlatpakBus enum
a461e1f 
This helps keep this particular function sane, and will allow adding
an a11y bus variant in the future.
@GeorgesStavracas
context: Add --a11y-own-name
eeedfa2 
This option allows the application (or subsandbox) to own the specified
name on the a11y bus. This will be useful for WebKit, that has a strict
security need that the Web processes cannot talk or see each other.

An alternative approach would be to make xdg-dbus-proxy permissions
modifiable at runtime, but that seems a lot riskier than this. Owning
a well known name based on the app id has proven to be a robust and
secure approach after all.
@GeorgesStavracas
portal: Add 'sandboxed-a11y-own-names' option
d10d272 
In context of the previous commit, this allows Flatpak apps to spawn
subsandboxes with `--a11y-own-name=DBUS_NAME`, where `DBUS_NAME` must
have the app id as prefix.

For example, `org.webkitgtk.MiniBrowser` would be able to spawn a Web
process using the Flatpak portal, and by passing
`org.webkitgtk.MiniBrowser.Sandboxed.WebProcess0`, this Web process
would be able to own this name in the a11y bus. This allows the Web
process and the main WebKit process to connect their a11y trees across
sandboxes.
@GeorgesStavracas
Allow org.a11y.atspi.Socket.Embedded() calls to subsandboxes
27dcbf8 
This is required for AT-SPI plugs and sockets to be able to connect.
@GeorgesStavracas
GeorgesStavracas merged commit 0bbb2bf into flatpak:main Aug 29, 2024
@GeorgesStavracas
GeorgesStavracas deleted the gbsneto/a11y-own-name branch August 29, 2024 17:11
GeorgesStavracas added a commit to flatpak/flatpak-xdg-utils that referenced this pull request Aug 29, 2024
@GeorgesStavracas
flatpak-spawn: Add "--sandbox-a11y-own-name"
cc9b05e 
This is the flatpak-spawn counterpart to the new option of the Flatpak
portal.

See flatpak/flatpak#5898
webkit-commit-queue pushed a commit to GeorgesStavracas/WebKit that referenced this pull request Oct 9, 2024
@GeorgesStavracas
[GTK][WPE] Own well-known bus name on a11y bus
3672c42 
https://bugs.webkit.org/show_bug.cgi?id=273245

Reviewed by Michael Catanzaro.

Currently WebKit on Linux is not accesible when running under Flatpak,
because the Web process and the UI process cannot communicate across
sandbox boundaries and connect their a11y trees.

Fundamentally, the problem is that Flatpak creates a separate sandbox
for the Web process, but doesn't let the UI process sandbox talk to it.
It cannot, after all - Flatpak cannot know ahead of time which D-Bus
name the Web process sandboxes will end up having!

One way to circumvent this in a well tested manner, is to use well-known
names to identify the Web process in the a11y bus. The idea is that the
UI process will talk to a bus name that Flatpak can verify at runtime,
e.g. org.gnome.Epiphany.Sandboxed.WebProcess-UUID, instead of an opaque
unique name (e.g. :1.321).

This is possible on Flatpak as per portal version 7, which introduces
the necessary plumbing for the a11y bus ownership to pass through.

The Bubblewrap code path does the same, it lets the Web process own
the specific a11y bus name assigned from the UI process. To do that,
change XDGDBusProxy to spawn once for each Web process, instead of
once for all Web processes.

See flatpak/flatpak#5898
See flatpak/flatpak-xdg-utils#67

* Source/WTF/wtf/glib/Sandbox.cpp:
(WTF::checkFlatpakPortalVersion):
(WTF::sandboxedAccessibilityBusName):
(WTF::setSandboxedAccessibilityBusName):
* Source/WTF/wtf/glib/Sandbox.h:
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp:
(WebCore::AccessibilityAtspi::connect):
(WebCore::AccessibilityAtspi::didConnect):
(WebCore::AccessibilityAtspi::didOwnName):
(WebCore::AccessibilityAtspi::registerRoot):
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.h:
* Source/WebKit/Shared/WebProcessCreationParameters.h:
* Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:
* Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseSetPlugID):
* Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp:
(WebKit::flatpakSpawn):
* Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:
(WebKit::ProcessLauncher::launchProcess):
* Source/WebKit/UIProcess/Launcher/glib/XDGDBusProxy.cpp:
(WebKit::XDGDBusProxy::accessibilityProxy):
* Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp:
(WebKit::WebProcessPool::platformInitializeWebProcess):
* Source/WebKit/UIProcess/gtk/WebPageProxyGtk.cpp:
(WebKit::WebPageProxy::bindAccessibilityTree):
* Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:
(WebKit::WebProcess::platformInitializeWebProcess):

Canonical link: https://commits.webkit.org/284894@main
aperezdc pushed a commit to WebKit/WebKit that referenced this pull request Oct 9, 2024
@GeorgesStavracas @aperezdc
Cherry-pick 284894@main (3672c42). https://bugs.webkit.org/show_bug.c…
3077494 
…gi?id=273245

    [GTK][WPE] Own well-known bus name on a11y bus
    https://bugs.webkit.org/show_bug.cgi?id=273245

    Reviewed by Michael Catanzaro.

    Currently WebKit on Linux is not accesible when running under Flatpak,
    because the Web process and the UI process cannot communicate across
    sandbox boundaries and connect their a11y trees.

    Fundamentally, the problem is that Flatpak creates a separate sandbox
    for the Web process, but doesn't let the UI process sandbox talk to it.
    It cannot, after all - Flatpak cannot know ahead of time which D-Bus
    name the Web process sandboxes will end up having!

    One way to circumvent this in a well tested manner, is to use well-known
    names to identify the Web process in the a11y bus. The idea is that the
    UI process will talk to a bus name that Flatpak can verify at runtime,
    e.g. org.gnome.Epiphany.Sandboxed.WebProcess-UUID, instead of an opaque
    unique name (e.g. :1.321).

    This is possible on Flatpak as per portal version 7, which introduces
    the necessary plumbing for the a11y bus ownership to pass through.

    The Bubblewrap code path does the same, it lets the Web process own
    the specific a11y bus name assigned from the UI process. To do that,
    change XDGDBusProxy to spawn once for each Web process, instead of
    once for all Web processes.

    See flatpak/flatpak#5898
    See flatpak/flatpak-xdg-utils#67

    * Source/WTF/wtf/glib/Sandbox.cpp:
    (WTF::checkFlatpakPortalVersion):
    (WTF::sandboxedAccessibilityBusName):
    (WTF::setSandboxedAccessibilityBusName):
    * Source/WTF/wtf/glib/Sandbox.h:
    * Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp:
    (WebCore::AccessibilityAtspi::connect):
    (WebCore::AccessibilityAtspi::didConnect):
    (WebCore::AccessibilityAtspi::didOwnName):
    (WebCore::AccessibilityAtspi::registerRoot):
    * Source/WebCore/accessibility/atspi/AccessibilityAtspi.h:
    * Source/WebKit/Shared/WebProcessCreationParameters.h:
    * Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:
    * Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp:
    (webkitWebViewBaseSetPlugID):
    * Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp:
    (WebKit::flatpakSpawn):
    * Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:
    (WebKit::ProcessLauncher::launchProcess):
    * Source/WebKit/UIProcess/Launcher/glib/XDGDBusProxy.cpp:
    (WebKit::XDGDBusProxy::accessibilityProxy):
    * Source/WebKit/UIProcess/glib/WebProcessPoolGLib.cpp:
    (WebKit::WebProcessPool::platformInitializeWebProcess):
    * Source/WebKit/UIProcess/gtk/WebPageProxyGtk.cpp:
    (WebKit::WebPageProxy::bindAccessibilityTree):
    * Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:
    (WebKit::WebProcess::platformInitializeWebProcess):

    Canonical link: https://commits.webkit.org/284894@main

Canonical link: https://commits.webkit.org/282416.203@webkitglib/2.46
@chrisawi chrisawi mentioned this pull request Jan 6, 2025
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smcv smcv smcv approved these changes
@TingPing TingPing Awaiting requested review from TingPing

Assignees

No one assigned

Labels

enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@GeorgesStavracas @smcv