Attachment 249491 Details for Bug 140064 – [Linux] SeccompFilters: improve the port-agnostic whitelist

[patch] [Linux] SeccompFilters: improve the port-agnostic whitelist

Linux-SeccompFilters-improve-the-port-agnostic-whi.patch (text/plain), 4.54 KB, created by Michael Catanzaro on 2015-03-26 08:59:21 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Catanzaro

Created: 2015-03-26 08:59:21 PDT

Size: 4.54 KB

patch

obsolete

>From 8582e3ff61832ba77fb68cafdde91e66fe5b6db6 Mon Sep 17 00:00:00 2001
>From: Michael Catanzaro <mcatanzaro@igalia.com>
>Date: Sat, 27 Dec 2014 11:43:11 -0600
>Subject: [PATCH] [Linux] SeccompFilters: improve the port-agnostic whitelist
>
>https://bugs.webkit.org/show_bug.cgi?id=140064
>---
> Source/WebKit2/ChangeLog                           | 14 +++++++
> .../Shared/linux/SeccompFilters/SyscallPolicy.cpp  | 45 +++++++++++++++++++++-
> 2 files changed, 57 insertions(+), 2 deletions(-)
>
>diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
>index c36c5b8..3c470e1 100644
>--- a/Source/WebKit2/ChangeLog
>+++ b/Source/WebKit2/ChangeLog
>@@ -1,3 +1,17 @@
>+2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>
>+
>+        [Linux] SeccompFilters: improve the port-agnostic whitelist
>+        https://bugs.webkit.org/show_bug.cgi?id=140064
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Allow the web process to access several files and directories that it
>+        was previously prohibited from accessing. This makes the web process
>+        much less likely to break.
>+
>+        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:
>+        (WebKit::SyscallPolicy::addDefaultWebProcessPolicy):
>+
> 2015-03-25  Zan Dobersek  <zdobersek@igalia.com>
> 
>         [WK2] WebUserMediaClient::pageDestroyed() virtual method should be marked as override
>diff --git a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>index 15cb2cf..7fc21bb 100644
>--- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>+++ b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>@@ -135,7 +135,11 @@ void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter
> 
>     // Shared libraries, plugins and fonts.
>     addDirectoryPermission(ASCIILiteral("/lib"), Read);
>+    addDirectoryPermission(ASCIILiteral("/lib32"), Read);
>+    addDirectoryPermission(ASCIILiteral("/lib64"), Read);
>     addDirectoryPermission(ASCIILiteral("/usr/lib"), Read);
>+    addDirectoryPermission(ASCIILiteral("/usr/lib32"), Read);
>+    addDirectoryPermission(ASCIILiteral("/usr/lib64"), Read);
>     addDirectoryPermission(ASCIILiteral("/usr/share"), Read);
> 
>     // SSL Certificates.
>@@ -186,13 +190,50 @@ void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter
>     // Needed by D-Bus.
>     addFilePermission(ASCIILiteral("/var/lib/dbus/machine-id"), Read);
> 
>+    // Needed by at-spi2.
>+    // FIXME This is too permissive: https://bugs.webkit.org/show_bug.cgi?id=143004
>+    addDirectoryPermission("/run/user/" + String::number(getuid()), ReadAndWrite);
>+
>+    // Needed by WebKit's memory pressure handler
>+    addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/memory.pressure_level"), Read);
>+    addFilePermission(ASCIILiteral("/sys/fs/cgroup/memory/cgroup.event_control"), Read);
>+
>     char* homeDir = getenv("HOME");
>     if (homeDir) {
>         // X11 connection token.
>         addFilePermission(String::fromUTF8(homeDir) + "/.Xauthority", Read);
>-        // MIME type resolution.
>-        addDirectoryPermission(String::fromUTF8(homeDir) +  "/.local/share/mime", Read);
>     }
>+
>+    // MIME type resolution.
>+    char* dataHomeDir = getenv("XDG_DATA_HOME");
>+    if (dataHomeDir)
>+        addDirectoryPermission(String::fromUTF8(dataHomeDir) + "/mime", Read);
>+    else if (homeDir)
>+        addDirectoryPermission(String::fromUTF8(homeDir) + "/.local/share/mime", Read);
>+
>+#if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
>+    // Needed on most non-Debian distros by libxshmfence <= 1.1, or newer
>+    // libxshmfence with older kernels (linux <= 3.16), for DRI3 shared memory.
>+    // FIXME Try removing this permission when we can rely on a newer libxshmfence.
>+    // See http://code.google.com/p/chromium/issues/detail?id=415681
>+    addDirectoryPermission(ASCIILiteral("/var/tmp"), ReadAndWrite);
>+
>+    // Optional Mesa DRI configuration file
>+    addFilePermission(ASCIILiteral("/etc/drirc"), Read);
>+    if (homeDir)
>+        addFilePermission(String::fromUTF8(homeDir) + "/.drirc", Read);
>+
>+    // Mesa uses udev.
>+    addDirectoryPermission(ASCIILiteral("/etc/udev"), Read);
>+    addDirectoryPermission(ASCIILiteral("/run/udev"), Read);
>+    addDirectoryPermission(ASCIILiteral("/sys/bus"), Read);
>+    addDirectoryPermission(ASCIILiteral("/sys/class"), Read);
>+    addDirectoryPermission(ASCIILiteral("/sys/devices"), Read);
>+#endif
>+
>+    // Needed by NVIDIA proprietary graphics driver
>+    if (homeDir)
>+        addDirectoryPermission(String::fromUTF8(homeDir) + "/.nv", ReadAndWrite);
> }
> 
> } // namespace WebKit
>-- 
>2.1.0

Actions: View | Formatted Diff | Diff

Attachments on bug 140064: 243951 | 249298 | 249490 | 249491