Attachment #249491 for bug #140064

View Details Raw Unified Return to Bug 140064

| Differences between



2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>

        [Linux] SeccompFilters: improve the port-agnostic whitelist
        https://bugs.webkit.org/show_bug.cgi?id=140064

        Reviewed by NOBODY (OOPS!).

        Allow the web process to access several files and directories that it
        was previously prohibited from accessing. This makes the web process
        much less likely to break.

        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:
        (WebKit::SyscallPolicy::addDefaultWebProcessPolicy):

2015-03-25  Zan Dobersek  <zdobersek@igalia.com>

        [WK2] WebUserMediaClient::pageDestroyed() virtual method should be marked as override

Lines 135-141 void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp_sec1
- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp -3 / +43 lines
135		135
136	// Shared libraries, plugins and fonts.	136	// Shared libraries, plugins and fonts.
137	addDirectoryPermission(ASCIILiteral("/lib"), Read);	137	addDirectoryPermission(ASCIILiteral("/lib"), Read);
		138	addDirectoryPermission(ASCIILiteral("/lib32"), Read);
		139	addDirectoryPermission(ASCIILiteral("/lib64"), Read);
138	addDirectoryPermission(ASCIILiteral("/usr/lib"), Read);	140	addDirectoryPermission(ASCIILiteral("/usr/lib"), Read);
		141	addDirectoryPermission(ASCIILiteral("/usr/lib32"), Read);
		142	addDirectoryPermission(ASCIILiteral("/usr/lib64"), Read);
139	addDirectoryPermission(ASCIILiteral("/usr/share"), Read);	143	addDirectoryPermission(ASCIILiteral("/usr/share"), Read);
140		144
141	// SSL Certificates.	145	// SSL Certificates.
Lines 186-198 void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp_sec2
186	// Needed by D-Bus.	190	// Needed by D-Bus.
187	addFilePermission(ASCIILiteral("/var/lib/dbus/machine-id"), Read);	191	addFilePermission(ASCIILiteral("/var/lib/dbus/machine-id"), Read);
188		192
		193	// Needed by at-spi2.
		194	// FIXME This is too permissive: https://bugs.webkit.org/show_bug.cgi?id=143004
		195	addDirectoryPermission("/run/user/" + String::number(getuid()), ReadAndWrite);
		196
		197	// Needed by WebKit's memory pressure handler
		198	addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/memory.pressure_level"), Read);
		199	addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/cgroup.event_control"), Read);
		200
189	char* homeDir = getenv("HOME");	201	char* homeDir = getenv("HOME");
190	if (homeDir) {	202	if (homeDir) {
191	// X11 connection token.	203	// X11 connection token.
192	addFilePermission(String::fromUTF8(homeDir) + "/.Xauthority", Read);	204	addFilePermission(String::fromUTF8(homeDir) + "/.Xauthority", Read);
193	// MIME type resolution.
194	addDirectoryPermission(String::fromUTF8(homeDir) + "/.local/share/mime", Read);
195	}	205	}
		206
		207	// MIME type resolution.
		208	char* dataHomeDir = getenv("XDG_DATA_HOME");
		209	if (dataHomeDir)
		210	addDirectoryPermission(String::fromUTF8(dataHomeDir) + "/mime", Read);
		211	else if (homeDir)
		212	addDirectoryPermission(String::fromUTF8(homeDir) + "/.local/share/mime", Read);
		213
		214	#if ENABLE(WEBGL) \|\| ENABLE(ACCELERATED_2D_CANVAS)
		215	// Needed on most non-Debian distros by libxshmfence <= 1.1, or newer
		216	// libxshmfence with older kernels (linux <= 3.16), for DRI3 shared memory.
		217	// FIXME Try removing this permission when we can rely on a newer libxshmfence.
		218	// See http://code.google.com/p/chromium/issues/detail?id=415681
		219	addDirectoryPermission(ASCIILiteral("/var/tmp"), ReadAndWrite);
		220
		221	// Optional Mesa DRI configuration file
		222	addFilePermission(ASCIILiteral("/etc/drirc"), Read);
		223	if (homeDir)
		224	addFilePermission(String::fromUTF8(homeDir) + "/.drirc", Read);
		225
		226	// Mesa uses udev.
		227	addDirectoryPermission(ASCIILiteral("/etc/udev"), Read);
		228	addDirectoryPermission(ASCIILiteral("/run/udev"), Read);
		229	addDirectoryPermission(ASCIILiteral("/sys/bus"), Read);
		230	addDirectoryPermission(ASCIILiteral("/sys/class"), Read);
		231	addDirectoryPermission(ASCIILiteral("/sys/devices"), Read);
		232	#endif
		233
		234	// Needed by NVIDIA proprietary graphics driver
		235	if (homeDir)
		236	addDirectoryPermission(String::fromUTF8(homeDir) + "/.nv", ReadAndWrite);
196	}	237	}
197		238
198	} // namespace WebKit	239	} // namespace WebKit
199	-

Return to Bug 140064

Lines 1-3 a/Source/WebKit2/ChangeLog_sec1
- a/Source/WebKit2/ChangeLog +14 lines
		1	2015-01-04 Michael Catanzaro <mcatanzaro@igalia.com>
		2
		3	[Linux] SeccompFilters: improve the port-agnostic whitelist
		4	https://bugs.webkit.org/show_bug.cgi?id=140064
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Allow the web process to access several files and directories that it
		9	was previously prohibited from accessing. This makes the web process
		10	much less likely to break.
		11
		12	* Shared/linux/SeccompFilters/SyscallPolicy.cpp:
		13	(WebKit::SyscallPolicy::addDefaultWebProcessPolicy):
		14
1	2015-03-25 Zan Dobersek <zdobersek@igalia.com>	15	2015-03-25 Zan Dobersek <zdobersek@igalia.com>
2		16
3	[WK2] WebUserMediaClient::pageDestroyed() virtual method should be marked as override	17	[WK2] WebUserMediaClient::pageDestroyed() virtual method should be marked as override