| Differences between
and this patch
- a/Source/WebKit2/ChangeLog +18 lines
Lines 1-5 a/Source/WebKit2/ChangeLog_sec1
1
2015-07-13  Michael Catanzaro  <mcatanzaro@igalia.com>
1
2015-07-13  Michael Catanzaro  <mcatanzaro@igalia.com>
2
2
3
        [GTK] Add seccomp filters support
4
        https://bugs.webkit.org/show_bug.cgi?id=110014
5
6
        Reviewed by NOBODY (OOPS!).
7
8
        Based on work by Thiago Marcos P. Santos <thiago.santos@intel.com>
9
10
        * PlatformGTK.cmake: Support ENABLE_SECCOMP_FILTERS build option.
11
        * WebProcess/gtk/SeccompFiltersWebProcessGtk.cpp: Added.
12
        (WebKit::SeccompFiltersWebProcessGtk::SeccompFiltersWebProcessGtk):
13
        (WebKit::SeccompFiltersWebProcessGtk::platformInitialize):
14
        * WebProcess/gtk/SeccompFiltersWebProcessGtk.h: Added.
15
        * WebProcess/soup/WebProcessSoup.cpp:
16
        (WebKit::WebProcess::platformInitializeWebProcess): Initialize default
17
        GTK+ web process seccomp filters.
18
19
2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>
20
3
        [GTK] Rename LIBEXECDIR to PKGLIBEXECDIR
21
        [GTK] Rename LIBEXECDIR to PKGLIBEXECDIR
4
        https://bugs.webkit.org/show_bug.cgi?id=140070
22
        https://bugs.webkit.org/show_bug.cgi?id=140070
5
23
- a/Source/WebKit2/PlatformGTK.cmake +21 lines
Lines 15-23 configure_file(webkit2gtk-web-extension.pc.in ${WebKit2WebExtension_PKGCONFIG_FI a/Source/WebKit2/PlatformGTK.cmake_sec1
15
15
16
add_definitions(-DBUILDING_WEBKIT)
16
add_definitions(-DBUILDING_WEBKIT)
17
add_definitions(-DWEBKIT2_COMPILATION)
17
add_definitions(-DWEBKIT2_COMPILATION)
18
add_definitions(-DLIBEXECDIR="${CMAKE_INSTALL_FULL_LIBEXECDIR}")
18
add_definitions(-DPKGLIBEXECDIR="${LIBEXEC_INSTALL_DIR}")
19
add_definitions(-DPKGLIBEXECDIR="${LIBEXEC_INSTALL_DIR}")
19
add_definitions(-DPACKAGE_LOCALE_DIR="${CMAKE_INSTALL_FULL_LOCALEDIR}")
20
add_definitions(-DPACKAGE_LOCALE_DIR="${CMAKE_INSTALL_FULL_LOCALEDIR}")
20
add_definitions(-DLIBDIR="${LIB_INSTALL_DIR}")
21
add_definitions(-DLIBDIR="${LIB_INSTALL_DIR}")
22
add_definitions(-DDATADIR="${CMAKE_INSTALL_FULL_DATADIR}")
21
23
22
set(WebKit2_USE_PREFIX_HEADER ON)
24
set(WebKit2_USE_PREFIX_HEADER ON)
23
25
Lines 339-344 list(APPEND WebKit2_SOURCES a/Source/WebKit2/PlatformGTK.cmake_sec2
339
    WebProcess/WebPage/gtk/WebPageGtk.cpp
341
    WebProcess/WebPage/gtk/WebPageGtk.cpp
340
    WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp
342
    WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp
341
343
344
    WebProcess/gtk/SeccompFiltersWebProcessGtk.cpp
345
    WebProcess/gtk/SeccompFiltersWebProcessGtk.h
342
    WebProcess/gtk/WebGtkExtensionManager.cpp
346
    WebProcess/gtk/WebGtkExtensionManager.cpp
343
    WebProcess/gtk/WebGtkInjectedBundleMain.cpp
347
    WebProcess/gtk/WebGtkInjectedBundleMain.cpp
344
    WebProcess/gtk/WebProcessMainGtk.cpp
348
    WebProcess/gtk/WebProcessMainGtk.cpp
Lines 473-478 list(APPEND WebKit2_INCLUDE_DIRECTORIES a/Source/WebKit2/PlatformGTK.cmake_sec3
473
    "${WEBKIT2_DIR}/Shared/Downloads/soup"
477
    "${WEBKIT2_DIR}/Shared/Downloads/soup"
474
    "${WEBKIT2_DIR}/Shared/Plugins/unix"
478
    "${WEBKIT2_DIR}/Shared/Plugins/unix"
475
    "${WEBKIT2_DIR}/Shared/gtk"
479
    "${WEBKIT2_DIR}/Shared/gtk"
480
    "${WEBKIT2_DIR}/Shared/linux"
481
    "${WEBKIT2_DIR}/Shared/linux/SeccompFilters"
476
    "${WEBKIT2_DIR}/Shared/soup"
482
    "${WEBKIT2_DIR}/Shared/soup"
477
    "${WEBKIT2_DIR}/Shared/unix"
483
    "${WEBKIT2_DIR}/Shared/unix"
478
    "${WEBKIT2_DIR}/UIProcess/API/C/cairo"
484
    "${WEBKIT2_DIR}/UIProcess/API/C/cairo"
Lines 557-562 list(APPEND WebKit2_LIBRARIES a/Source/WebKit2/PlatformGTK.cmake_sec4
557
)
563
)
558
endif ()
564
endif ()
559
565
566
if (ENABLE_SECCOMP_FILTERS)
567
    list(APPEND WebKit2_LIBRARIES
568
        ${LIBSECCOMP_LIBRARIES}
569
    )
570
    list(APPEND WebKit2_INCLUDE_DIRECTORIES
571
        ${LIBSECCOMP_INCLUDE_DIRS}
572
    )
573
574
    # If building with WebKit jhbuild (not GNOME jhbuild), add the root build
575
    # directory to the filesystem access policy.
576
    if (IS_DIRECTORY ${CMAKE_SOURCE_DIR}/WebKitBuild/DependenciesGTK)
577
        add_definitions(-DSOURCE_DIR=\"${CMAKE_SOURCE_DIR}\")
578
    endif ()
579
endif ()
580
560
ADD_WHOLE_ARCHIVE_TO_LIBRARIES(WebKit2_LIBRARIES)
581
ADD_WHOLE_ARCHIVE_TO_LIBRARIES(WebKit2_LIBRARIES)
561
582
562
set(WebKit2_MARSHAL_LIST ${WEBKIT2_DIR}/UIProcess/API/gtk/webkit2marshal.list)
583
set(WebKit2_MARSHAL_LIST ${WEBKIT2_DIR}/UIProcess/API/gtk/webkit2marshal.list)
- a/Source/WebKit2/WebProcess/gtk/SeccompFiltersWebProcessGtk.cpp +70 lines
Line 0 a/Source/WebKit2/WebProcess/gtk/SeccompFiltersWebProcessGtk.cpp_sec1
1
/*
2
 * Copyright (C) 2013 Intel Corporation. All rights reserved.
3
 * Copyright (C) 2014 Igalia S.L.
4
 *
5
 * Redistribution and use in source and binary forms, with or without
6
 * modification, are permitted provided that the following conditions
7
 * are met:
8
 * 1. Redistributions of source code must retain the above copyright
9
 *    notice, this list of conditions and the following disclaimer.
10
 * 2. Redistributions in binary form must reproduce the above copyright
11
 *    notice, this list of conditions and the following disclaimer in the
12
 *    documentation and/or other materials provided with the distribution.
13
 *
14
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
15
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
16
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
18
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
24
 * THE POSSIBILITY OF SUCH DAMAGE.
25
 */
26
27
#include "config.h"
28
#include "SeccompFiltersWebProcessGtk.h"
29
30
#if ENABLE(SECCOMP_FILTERS)
31
32
#include "SeccompBroker.h"
33
#include "WebProcessCreationParameters.h"
34
#include <glib.h>
35
#include <sys/types.h>
36
#include <unistd.h>
37
38
namespace WebKit {
39
40
SeccompFiltersWebProcessGtk::SeccompFiltersWebProcessGtk(const WebProcessCreationParameters& parameters)
41
    : SeccompFilters(Allow)
42
{
43
    m_policy.addDefaultWebProcessPolicy(parameters);
44
}
45
46
void SeccompFiltersWebProcessGtk::platformInitialize()
47
{
48
    // TODO: We should block all the syscalls and whitelist
49
    // what we need + trap what should be handled by the broker.
50
    addRule("open", Trap);
51
    addRule("openat", Trap);
52
    addRule("creat", Trap);
53
54
#if USE(GSTREAMER)
55
    m_policy.addDirectoryPermission(String::fromUTF8(g_get_user_cache_dir()) + "/gstreamer-1.0", SyscallPolicy::ReadAndWrite);
56
    m_policy.addDirectoryPermission(String::fromUTF8(g_get_user_data_dir()) + "/gstreamer-1.0", SyscallPolicy::ReadAndWrite);
57
    m_policy.addDirectoryPermission(String::fromUTF8(LIBEXECDIR) + "/gstreamer-1.0", SyscallPolicy::Read);
58
#endif
59
60
    m_policy.addDirectoryPermission(String::fromUTF8(g_get_user_data_dir()) + "/gvfs-metadata", SyscallPolicy::ReadAndWrite);
61
62
    // For libXau
63
    m_policy.addDirectoryPermission(ASCIILiteral("/run/gdm"), SyscallPolicy::Read);
64
65
    SeccompBroker::launchProcess(this, m_policy);
66
}
67
68
} // namespace WebKit
69
70
#endif // ENABLE(SECCOMP_FILTERS)
- a/Source/WebKit2/WebProcess/gtk/SeccompFiltersWebProcessGtk.h +52 lines
Line 0 a/Source/WebKit2/WebProcess/gtk/SeccompFiltersWebProcessGtk.h_sec1
1
/*
2
 * Copyright (C) 2013 Intel Corporation. All rights reserved.
3
 *
4
 * Redistribution and use in source and binary forms, with or without
5
 * modification, are permitted provided that the following conditions
6
 * are met:
7
 * 1. Redistributions of source code must retain the above copyright
8
 *    notice, this list of conditions and the following disclaimer.
9
 * 2. Redistributions in binary form must reproduce the above copyright
10
 *    notice, this list of conditions and the following disclaimer in the
11
 *    documentation and/or other materials provided with the distribution.
12
 *
13
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
14
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
15
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
17
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
23
 * THE POSSIBILITY OF SUCH DAMAGE.
24
 */
25
26
#ifndef SeccompFiltersWebProcessGtk_h
27
#define SeccompFiltersWebProcessGtk_h
28
29
#if ENABLE(SECCOMP_FILTERS)
30
31
#include "SeccompFilters.h"
32
#include "SyscallPolicy.h"
33
34
namespace WebKit {
35
36
class WebProcessCreationParameters;
37
38
class SeccompFiltersWebProcessGtk : public SeccompFilters {
39
public:
40
    SeccompFiltersWebProcessGtk(const WebProcessCreationParameters&);
41
42
private:
43
    virtual void platformInitialize();
44
45
    SyscallPolicy m_policy;
46
};
47
48
} // namespace WebKit
49
50
#endif // ENABLE(SECCOMP_FILTERS)
51
52
#endif // SeccompFiltersWebProcessGtk_h
- a/Source/WebKit2/WebProcess/soup/WebProcessSoup.cpp +4 lines
Lines 29-34 a/Source/WebKit2/WebProcess/soup/WebProcessSoup.cpp_sec1
29
29
30
#if PLATFORM(EFL)
30
#if PLATFORM(EFL)
31
#include "SeccompFiltersWebProcessEfl.h"
31
#include "SeccompFiltersWebProcessEfl.h"
32
#elif PLATFORM(GTK)
33
#include "SeccompFiltersWebProcessGtk.h"
32
#endif
34
#endif
33
35
34
#include "CertificateInfo.h"
36
#include "CertificateInfo.h"
Lines 127-132 void WebProcess::platformInitializeWebProcess(WebProcessCreationParameters&& par a/Source/WebKit2/WebProcess/soup/WebProcessSoup.cpp_sec2
127
    {
129
    {
128
#if PLATFORM(EFL)
130
#if PLATFORM(EFL)
129
        SeccompFiltersWebProcessEfl seccompFilters(parameters);
131
        SeccompFiltersWebProcessEfl seccompFilters(parameters);
132
#elif PLATFORM(GTK)
133
        SeccompFiltersWebProcessGtk seccompFilters(parameters);
130
#endif
134
#endif
131
        seccompFilters.initialize();
135
        seccompFilters.initialize();
132
    }
136
    }
- a/Source/cmake/OptionsGTK.cmake +7 lines
Lines 338-343 if (ENABLE_PLUGIN_PROCESS_GTK2) a/Source/cmake/OptionsGTK.cmake_sec1
338
    find_package(GDK2 2.24.10 REQUIRED)
338
    find_package(GDK2 2.24.10 REQUIRED)
339
endif ()
339
endif ()
340
340
341
if (ENABLE_SECCOMP_FILTERS)
342
    find_package(LibSeccomp)
343
    if (NOT LIBSECCOMP_FOUND)
344
        message(FATAL_ERROR "libseccomp is required for ENABLE_SECCOMP_FILTERS")
345
    endif ()
346
endif ()
347
341
if (ENABLE_SPELLCHECK)
348
if (ENABLE_SPELLCHECK)
342
    find_package(Enchant)
349
    find_package(Enchant)
343
    if (NOT PC_ENCHANT_FOUND)
350
    if (NOT PC_ENCHANT_FOUND)
- a/Tools/ChangeLog +11 lines
Lines 1-3 a/Tools/ChangeLog_sec1
1
2015-07-13  Michael Catanzaro  <mcatanzaro@igalia.com>
2
3
        [GTK] Add seccomp filters support
4
        https://bugs.webkit.org/show_bug.cgi?id=110014
5
6
        Reviewed by NOBODY (OOPS!).
7
8
        Add libseccomp to jhbuild modulesets.
9
10
        * gtk/jhbuild.modules:
11
1
2015-07-10  Brent Fulgham  <bfulgham@apple.com>
12
2015-07-10  Brent Fulgham  <bfulgham@apple.com>
2
13
3
        [Mac] Unable to dismiss context menu during test runs
14
        [Mac] Unable to dismiss context menu during test runs
- a/Tools/gtk/jhbuild.modules +7 lines
Lines 32-37 a/Tools/gtk/jhbuild.modules_sec1
32
      <dep package="xserver"/>
32
      <dep package="xserver"/>
33
      <dep package="mesa"/>
33
      <dep package="mesa"/>
34
      <dep package="openwebrtc"/>
34
      <dep package="openwebrtc"/>
35
      <dep package="libseccomp"/>
35
    </dependencies>
36
    </dependencies>
36
  </metamodule>
37
  </metamodule>
37
38
Lines 61-66 a/Tools/gtk/jhbuild.modules_sec2
61
      href="http://download.savannah.gnu.org/releases/"/>
62
      href="http://download.savannah.gnu.org/releases/"/>
62
  <repository type="git" name="freedesktop-git"
63
  <repository type="git" name="freedesktop-git"
63
      href="http://anongit.freedesktop.org/git"/>
64
      href="http://anongit.freedesktop.org/git"/>
65
  <repository type="tarball" name="sourceforge.net"
66
      href="http://sourceforge.net/projects/"/>
64
67
65
  <autotools id="cairo"
68
  <autotools id="cairo"
66
             autogenargs="--enable-gl=yes --enable-egl=yes --enable-glx=yes ac_cv_func_rsvg_pixbuf_from_file=no"
69
             autogenargs="--enable-gl=yes --enable-egl=yes --enable-glx=yes ac_cv_func_rsvg_pixbuf_from_file=no"
Lines 119-124 a/Tools/gtk/jhbuild.modules_sec3
119
             md5sum="f5898b29bbfd70502831a212d9249d10"/>
122
             md5sum="f5898b29bbfd70502831a212d9249d10"/>
120
  </autotools>
123
  </autotools>
121
124
125
  <autotools id="libseccomp" autogen-sh="./autogen.sh; ./configure">
126
    <branch repo="github.com" module="seccomp/libseccomp.git" tag="v2.2.0"/>
127
  </autotools>
128
122
  <autotools id="gdk-pixbuf" autogen-sh="configure"
129
  <autotools id="gdk-pixbuf" autogen-sh="configure"
123
             autogenargs="--disable-introspection">
130
             autogenargs="--disable-introspection">
124
    <dependencies>
131
    <dependencies>
- a/ChangeLog +11 lines
Lines 1-3 a/ChangeLog_sec1
1
2015-07-13  Michael Catanzaro  <mcatanzaro@igalia.com>
2
3
        [GTK] Add seccomp filters support
4
        https://bugs.webkit.org/show_bug.cgi?id=110014
5
6
        Reviewed by NOBODY (OOPS!).
7
8
        Find needed compiler and linker flags for libseccomp.
9
10
        * Source/cmake/OptionsGTK.cmake:
11
1
2015-07-10  Michael Catanzaro  <mcatanzaro@igalia.com>
12
2015-07-10  Michael Catanzaro  <mcatanzaro@igalia.com>
2
13
3
        [GTK] ar warning when linking static libraries
14
        [GTK] ar warning when linking static libraries

Return to Bug 110014