Modified: trunk/Source/WebKit2/ChangeLog (111462 => 111463)
--- trunk/Source/WebKit2/ChangeLog 2012-03-20 23:27:00 UTC (rev 111462)
+++ trunk/Source/WebKit2/ChangeLog 2012-03-20 23:30:39 UTC (rev 111463)
@@ -1,3 +1,25 @@
+2012-03-20 Alexey Proskuryakov <[email protected]>
+
+ Sandboxed PluginProcess should use private temporary and cache directories
+ https://bugs.webkit.org/show_bug.cgi?id=81702
+ <rdar://problem/10792047>
+
+ Reviewed by Anders Carlsson.
+
+ * Platform/Module.h:
+ * Platform/mac/ModuleMac.mm:
+ (WebKit::Module::bundleIdentifier):
+ Expose plug-in's bundle identifier.
+
+ * PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in: Some unerlated fixes to make
+ networking functional on my testing platforms. These serveices are already allowed for
+ WebProcess.
+
+ * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm:
+ (readSandboxProfile): Unrelated fix - I've been made to rename the profile file, but
+ didn't update where it's read from!
+ (WKN_EnterSandbox): Add a suffix to user directories.
+
2012-03-20 Sheriff Bot <[email protected]>
Unreviewed, rolling out r111445 and r111446.
Modified: trunk/Source/WebKit2/Platform/Module.h (111462 => 111463)
--- trunk/Source/WebKit2/Platform/Module.h 2012-03-20 23:27:00 UTC (rev 111462)
+++ trunk/Source/WebKit2/Platform/Module.h 2012-03-20 23:30:39 UTC (rev 111463)
@@ -58,6 +58,10 @@
// live Objective-C objects whose methods come from that bundle.
void unload();
+#if PLATFORM(MAC)
+ String bundleIdentifier() const;
+#endif
+
template<typename FunctionType> FunctionType functionPointer(const char* functionName) const;
#if PLATFORM(MAC) && !defined(__LP64__)
Modified: trunk/Source/WebKit2/Platform/mac/ModuleMac.mm (111462 => 111463)
--- trunk/Source/WebKit2/Platform/mac/ModuleMac.mm 2012-03-20 23:27:00 UTC (rev 111462)
+++ trunk/Source/WebKit2/Platform/mac/ModuleMac.mm 2012-03-20 23:30:39 UTC (rev 111463)
@@ -69,6 +69,11 @@
return CFBundleGetFunctionPointerForName(m_bundle.get(), functionNameString.get());
}
+String Module::bundleIdentifier() const
+{
+ return CFBundleGetIdentifier(m_bundle.get());
+}
+
#if !defined(__LP64__)
CFBundleRefNum Module::bundleResourceMap()
{
Modified: trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in (111462 => 111463)
--- trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in 2012-03-20 23:27:00 UTC (rev 111462)
+++ trunk/Source/WebKit2/PluginProcess/mac/com.apple.WebKit.PluginProcess.sb.in 2012-03-20 23:30:39 UTC (rev 111463)
@@ -110,12 +110,15 @@
(global-name "com.apple.ImageCaptureExtension2.presence")
(global-name "com.apple.SecurityServer")
(global-name "com.apple.SystemConfiguration.configd")
+ (global-name "com.apple.SystemConfiguration.PPPController")
+ (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
(global-name "com.apple.audio.VDCAssistant")
(global-name "com.apple.audio.audiohald")
(global-name "com.apple.audio.coreaudiod")
(global-name "com.apple.cmio.VDCAssistant")
(global-name "com.apple.cookied") ;; FIXME: <rdar://problem/10790768> Limit access to cookies.
(global-name "com.apple.cvmsServ")
+ (global-name "com.apple.networkd")
(global-name "com.apple.ocspd")
(global-name "com.apple.pasteboard.1")
(global-name "com.apple.window_proxies")
Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm (111462 => 111463)
--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm 2012-03-20 23:27:00 UTC (rev 111462)
+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm 2012-03-20 23:30:39 UTC (rev 111463)
@@ -29,6 +29,7 @@
#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
#import "PluginProcess.h"
+#import "NetscapePluginModule.h"
#import "WebKitSystemInterface.h"
#import <WebCore/FileSystem.h>
#import <WebCore/SoftLinking.h>
@@ -59,7 +60,7 @@
static CString readSandboxProfile()
{
- RetainPtr<CFURLRef> profileURL(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), CFSTR("plugin"), CFSTR("sb"), 0));
+ RetainPtr<CFURLRef> profileURL(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), CFSTR("com.apple.WebKit.PluginProcess"), CFSTR("sb"), 0));
char profilePath[PATH_MAX];
if (!CFURLGetFileSystemRepresentation(profileURL.get(), false, reinterpret_cast<UInt8*>(profilePath), sizeof(profilePath))) {
fprintf(stderr, "Could not get file system representation of plug-in sandbox URL\n");
@@ -100,6 +101,19 @@
if (profile.isNull())
exit(EX_NOPERM);
+#if !defined(BUILDING_ON_LION)
+ // Use private temporary and cache directories.
+ String systemDirectorySuffix = "com.apple.WebKit.PluginProcess+" + PluginProcess::shared().netscapePluginModule()->module()->bundleIdentifier();
+ setenv("DIRHELPER_USER_DIR_SUFFIX", fileSystemRepresentation(systemDirectorySuffix).data(), 0);
+ char temporaryDirectory[PATH_MAX];
+ if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryDirectory, sizeof(temporaryDirectory))) {
+ fprintf(stderr, "PluginProcess: couldn't retrieve private temporary directory path: %d\n", errno);
+ exit(EX_NOPERM);
+ }
+ setenv("TMPDIR", temporaryDirectory, 1);
+#endif
+
+
Vector<const char*> extendedReadOnlyPaths;
if (readOnlyPaths) {
for (unsigned i = 0; readOnlyPaths[i]; ++i)
@@ -122,15 +136,12 @@
extendedReadWritePaths.append(readWritePaths[i]);
}
- // FIXME: <rdar://problem/10785457> Use a custom temporary directory.
char darwinUserTempDirectory[PATH_MAX];
if (confstr(_CS_DARWIN_USER_TEMP_DIR, darwinUserTempDirectory, PATH_MAX) > 0)
extendedReadWritePaths.append(darwinUserTempDirectory);
- // FIXME: <rdar://problem/10792047> Use a custom cache directory.
char darwinUserCacheDirectory[PATH_MAX];
- size_t darwinUserCachePathSize = confstr(_CS_DARWIN_USER_CACHE_DIR, darwinUserCacheDirectory, PATH_MAX);
- if (darwinUserCachePathSize > 0)
+ if (confstr(_CS_DARWIN_USER_CACHE_DIR, darwinUserCacheDirectory, PATH_MAX) > 0)
extendedReadWritePaths.append(darwinUserCacheDirectory);
RetainPtr<CFStringRef> cachePath(AdoptCF, WKCopyFoundationCacheDirectory());
