Attachment 256701 Details for Bug 140066 – [Linux] SeccompFilters: whitelist source directory on all ports

[patch] [Linux] SeccompFilters: whitelist source directory on all ports

bug-140066-20150713101735.patch (text/plain), 3.27 KB, created by Michael Catanzaro on 2015-07-13 08:18:40 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Catanzaro

Created: 2015-07-13 08:18:40 PDT

Size: 3.27 KB

patch

obsolete

>Subversion Revision: 186761
>diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
>index 9a6ceb5ae722c519aa32b395cba08e4732ad27a8..0e69b92bffabba5a727288be96281627ac6fa93a 100644
>--- a/Source/WebKit2/ChangeLog
>+++ b/Source/WebKit2/ChangeLog
>@@ -1,5 +1,19 @@
> 2015-07-13  Michael Catanzaro  <mcatanzaro@igalia.com>
> 
>+        [Linux] SeccompFilters: whitelist source directory on all ports
>+        https://bugs.webkit.org/show_bug.cgi?id=140066
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Move this from EFL to port-independent code.
>+
>+        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:
>+        (WebKit::SyscallPolicy::addDefaultWebProcessPolicy):
>+        * WebProcess/efl/SeccompFiltersWebProcessEfl.cpp:
>+        (WebKit::SeccompFiltersWebProcessEfl::platformInitialize):
>+
>+2015-01-04  Michael Catanzaro  <mcatanzaro@igalia.com>
>+
>         [Linux] SeccompFilters: handle alternate install prefixes
>         https://bugs.webkit.org/show_bug.cgi?id=140065
> 
>diff --git a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>index 1dcd95e8b605faafcf7f60582d245f54a61bc476..5234455dd16a4865f5196a2d3594e0e5d964449f 100644
>--- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>+++ b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>@@ -238,6 +238,17 @@ void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter
>     // Needed by NVIDIA proprietary graphics driver
>     if (homeDir)
>         addDirectoryPermission(String::fromUTF8(homeDir) + "/.nv", ReadAndWrite);
>+
>+#if ENABLE(DEVELOPER_MODE) && defined(SOURCE_DIR)
>+    // Developers using build-webkit expect some libraries to be loaded
>+    // from the build root directory and they also need access to layout test
>+    // files.
>+    char* sourceDir = canonicalize_file_name(SOURCE_DIR);
>+    if (sourceDir) {
>+        addDirectoryPermission(String::fromUTF8(sourceDir), SyscallPolicy::ReadAndWrite);
>+        free(sourceDir);
>+    }
>+#endif
> }
> 
> } // namespace WebKit
>diff --git a/Source/WebKit2/WebProcess/efl/SeccompFiltersWebProcessEfl.cpp b/Source/WebKit2/WebProcess/efl/SeccompFiltersWebProcessEfl.cpp
>index d49e0be26a16103c0f302e238a4dec64096abb45..d93c0b16f6a8047e3fe13a2f6ac7dba3da7b0d33 100644
>--- a/Source/WebKit2/WebProcess/efl/SeccompFiltersWebProcessEfl.cpp
>+++ b/Source/WebKit2/WebProcess/efl/SeccompFiltersWebProcessEfl.cpp
>@@ -55,18 +55,6 @@ void SeccompFiltersWebProcessEfl::platformInitialize()
>     m_policy.addDirectoryPermission(ASCIILiteral("/sys/devices"), SyscallPolicy::Read);
>     m_policy.addFilePermission(ASCIILiteral("/etc/udev/udev.conf"), SyscallPolicy::Read);
> 
>-#ifdef SOURCE_DIR
>-    // Developers using build-webkit --efl expect some libraries to be loaded
>-    // from the build root directory and they also need access to layout test
>-    // files. The constant is defined only when jhbuild is detected, which is
>-    // an indication of a development build.
>-    char* sourceDir = canonicalize_file_name(SOURCE_DIR);
>-    if (sourceDir) {
>-        m_policy.addDirectoryPermission(String::fromUTF8(sourceDir), SyscallPolicy::ReadAndWrite);
>-        free(sourceDir);
>-    }
>-#endif
>-
>     // Place where the theme and icons are installed.
>     char* dataDir = canonicalize_file_name(DATA_DIR);
>     if (dataDir) {

Actions: View | Formatted Diff | Diff

Attachments on bug 140066: 243953 | 249296 | 256701 | 256769