187831 2018-07-19 17:11:48 -0700 [macOS] Relax WebKit sandbox to permit proper App Store behavior 2018-07-20 10:45:47 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 bfulgham bfulgham achristensen ap bfulgham commit-queue eric.carlson youennf oldest_to_newest 1443606 0 bfulgham 2018-07-19 17:11:48 -0700 The Mac App Store is unable to perform some gift card redemption tasks on Mojave due to missing sandbox permissions: 1. We need to allow TCC checking in the plugin process so that the user can permit the camera to be activated. 2. We need to allow connections to com.apple.assertiond.processassertionconnection. 3. We need to allow commerce kit preferences to be read in the WebContent process. This patch adds those permissions. 1443608 1 bfulgham 2018-07-19 17:12:44 -0700 <rdar://problem/42047455> 1443612 2 345406 bfulgham 2018-07-19 17:14:39 -0700 Created attachment 345406 Patch 1443624 3 345406 ap 2018-07-19 17:52:11 -0700 Comment on attachment 345406 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=345406&action=review > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:370 > + (global-name "com.apple.assertiond.processassertionconnection") Is this part of this particular fix? > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:395 > + (global-name "com.apple.tccd") Do we want this here, or specifically in com.apple.appstore.CodeRedeemerNetscapePlugin.sb? 1443762 4 bfulgham 2018-07-20 08:50:23 -0700 (In reply to Alexey Proskuryakov from comment #3) > Comment on attachment 345406 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=345406&action=review > > > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:370 > > + (global-name "com.apple.assertiond.processassertionconnection") > > Is this part of this particular fix? Yes -- this was on the advice of the sandboxing team (this is apparently needed for many services). > > Source/WebKit/PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in:395 > > + (global-name "com.apple.tccd") > > Do we want this here, or specifically in > com.apple.appstore.CodeRedeemerNetscapePlugin.sb? I think making it possible for any plugin to talk to the TCC service is good, since anything that wants to request camera/microphone access needs TCC to give it permission. 1443785 5 345406 ap 2018-07-20 09:48:00 -0700 Comment on attachment 345406 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=345406&action=review > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:476 > + "com.apple.commerce" ;; <rdar://problem/42047455> Please explain in that radar why this is needed. 1443786 6 ap 2018-07-20 09:49:00 -0700 > I think making it possible for any plugin to talk to the TCC service is good, since anything that wants to request camera/microphone access needs TCC to give it permission. Is camera/microphone broken in Flash right now? If so, then the fix is much bigger than what its title implies. And if not, then something strange is going on. 1443804 7 bfulgham 2018-07-20 10:20:25 -0700 (In reply to Alexey Proskuryakov from comment #5) > Comment on attachment 345406 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=345406&action=review > > > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:476 > > + "com.apple.commerce" ;; <rdar://problem/42047455> > > Please explain in that radar why this is needed. I just spoke with the store folks and they don't think this is needed. I'll remove it from the patch. 1443806 8 345456 bfulgham 2018-07-20 10:25:22 -0700 Created attachment 345456 Patch for landing 1443824 9 345456 commit-queue 2018-07-20 10:45:45 -0700 Comment on attachment 345456 Patch for landing Clearing flags on attachment: 345456 Committed r234054: <https://trac.webkit.org/changeset/234054> 1443825 10 commit-queue 2018-07-20 10:45:47 -0700 All reviewed patches have been landed. Closing bug. 345406 2018-07-19 17:14:39 -0700 2018-07-20 10:25:20 -0700 Patch bug-187831-20180719171438.patch text/plain 2765 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjMzNDg0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGMyNzhjNGViNTkwZjgwZjg0 ZDA2MGRlNmJiZDM5YTM5NTcyNmVkMWEuLmViNDc2NzM3M2ZlNzY2MGZlM2M5ZTE2YjNjZTFiMjY1 MGQzMWJmZmYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTgtMDctMTkgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgW21hY09TXSBSZWxheCBXZWJL aXQgc2FuZGJveCB0byBwZXJtaXQgcHJvcGVyIEFwcCBTdG9yZSBiZWhhdmlvcgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTg3ODMxCisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS80MjA0NzQ1NT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBUaGUgTWFjIEFwcCBTdG9yZSBpcyB1bmFibGUgdG8gcGVyZm9ybSBz b21lIGdpZnQgY2FyZCByZWRlbXB0aW9uIHRhc2tzIG9uIG1hY09TIGR1ZSB0byBtaXNzaW5nIHNh bmRib3ggcGVybWlzc2lvbnMuCisgICAgICAgIFRoaXMgcGF0Y2ggYWRkcyB0aG9zZSBwZXJtaXNz aW9ucy4KKworICAgICAgICAqIFBsdWdpblByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQucGx1 Z2luLWNvbW1vbi5zYi5pbjoKKyAgICAgICAgKiBXZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9j ZXNzLnNiLmluOgorCiAyMDE4LTA3LTAzICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUu Y29tPgogCiAgICAgICAgIFtpT1NdIENsZWFuIHVwIHNhbmRib3ggd2FybmluZ3MgZm91bmQgZHVy aW5nIFB1YmxpYyBCZXRhCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1BsdWdpblByb2Nlc3Mv bWFjL2NvbS5hcHBsZS5XZWJLaXQucGx1Z2luLWNvbW1vbi5zYi5pbiBiL1NvdXJjZS9XZWJLaXQv UGx1Z2luUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktpdC5wbHVnaW4tY29tbW9uLnNiLmluCmlu ZGV4IGU4OTNmZWY5ZjRmODNhZWZiNWQ2ZmY3M2JjNWMxZWYxNjlmN2ZmM2IuLjhjYjk4Y2UyMWJi YzgyNmEzYzhlOTc5MzAyZjZmNjAyNzY4YThiYjUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQv UGx1Z2luUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktpdC5wbHVnaW4tY29tbW9uLnNiLmluCisr KyBiL1NvdXJjZS9XZWJLaXQvUGx1Z2luUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktpdC5wbHVn aW4tY29tbW9uLnNiLmluCkBAIC0zNjcsNiArMzY3LDcgQEAKIDs7IFZhcmlvdXMgc2VydmljZXMg cmVxdWlyZWQgYnkgQXBwS2l0IGFuZCBvdGhlciBmcmFtZXdvcmtzCiAoYWxsb3cgbWFjaC1sb29r dXAKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5hdWRpby5BdWRpb0NvbXBvbmVudFJlZ2lz dHJhciIpCisgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuYXNzZXJ0aW9uZC5wcm9jZXNzYXNz ZXJ0aW9uY29ubmVjdGlvbiIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuQ29yZVNlcnZp Y2VzLmNvcmVzZXJ2aWNlc2QiKQogICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLkRpc2tBcmJp dHJhdGlvbi5kaXNrYXJiaXRyYXRpb25kIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5G aWxlQ29vcmRpbmF0aW9uIikKQEAgLTM5MSw2ICszOTIsNyBAQAogICAgIChnbG9iYWwtbmFtZSAi Y29tLmFwcGxlLm9jc3BkIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5wYXN0ZWJvYXJk LjEiKQogICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLnBicy5mZXRjaF9zZXJ2aWNlcyIpCisg ICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUudGNjZCIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20u YXBwbGUudGNjZC5zeXN0ZW0iKQogICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLnRzbS51aXNl cnZlciIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUud2luZG93X3Byb3hpZXMiKQpkaWZm IC0tZ2l0IGEvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNi LmluIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmlu CmluZGV4IGJkMmI3NDA3Y2QzZDdlYzQzMmJmYzg1NzU0NzFlZWRmZTQ5MDY4OGEuLjVkNjBkZjFi MmVhNzljNjEwNmI5NTE5ZDRjNzkzNDMzNGZlYTMxOWUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJL aXQvV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgorKysgYi9Tb3VyY2UvV2Vi S2l0L1dlYlByb2Nlc3MvY29tLmFwcGxlLldlYlByb2Nlc3Muc2IuaW4KQEAgLTQ3Myw2ICs0NzMs NyBAQAogICAgICAgICAiY29tLmFwcGxlLmF2Zm91bmRhdGlvbiIKICAgICAgICAgImNvbS5hcHBs ZS5hdmZvdW5kYXRpb24uZnJlY2VudHMiIDs7IDxyZGFyOi8vcHJvYmxlbS8zMzEzNzAyOT4KICAg ICAgICAgImNvbS5hcHBsZS5hdmZvdW5kYXRpb24udmlkZW9wZXJmb3JtYW5jZWh1ZCIgOzsgPHJk YXI6Ly9wcm9ibGVtLzMxNTk0NTY4PgorICAgICAgICAiY29tLmFwcGxlLmNvbW1lcmNlIiA7OyA8 cmRhcjovL3Byb2JsZW0vNDIwNDc0NTU+CiAgICAgICAgICJjb20uYXBwbGUuY29yZW1lZGlhIgog ICAgICAgICAiY29tLmFwcGxlLmNyeXB0byIKICAgICAgICAgImNvbS5hcHBsZS5kcml2ZXIuQXBw bGVCbHVldG9vdGhNdWx0aXRvdWNoLm1vdXNlIgo= 345456 2018-07-20 10:25:22 -0700 2018-07-20 10:45:45 -0700 Patch for landing bug-187831-20180720102521.patch text/plain 1998 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjM0MDQ5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDRiYzgxMzcyMjdmNmZmZWRm MTAwNWY0ZjcyZWU1ODNkMmEwYmU1MDAuLjNiNTQzZTg5YmRiMGI1OGQzZDcwNzkxZmZmNDUyZjA1 Yjc1ZjhhMGIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTgtMDctMjAgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgW21hY09TXSBSZWxheCBXZWJL aXQgc2FuZGJveCB0byBwZXJtaXQgcHJvcGVyIEFwcCBTdG9yZSBiZWhhdmlvcgorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTg3ODMxCisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS80MjA0NzQ1NT4KKworICAgICAgICBSZXZpZXdlZCBieSBBbGV4ZXkgUHJv c2t1cnlha292LgorCisgICAgICAgIFRoZSBNYWMgQXBwIFN0b3JlIGlzIHVuYWJsZSB0byBwZXJm b3JtIHNvbWUgZ2lmdCBjYXJkIHJlZGVtcHRpb24gdGFza3Mgb24gbWFjT1MgZHVlIHRvIG1pc3Np bmcgc2FuZGJveCBwZXJtaXNzaW9ucy4KKyAgICAgICAgVGhpcyBwYXRjaCBhZGRzIHRob3NlIHBl cm1pc3Npb25zLgorCisgICAgICAgICogUGx1Z2luUHJvY2Vzcy9tYWMvY29tLmFwcGxlLldlYktp dC5wbHVnaW4tY29tbW9uLnNiLmluOgorCiAyMDE4LTA3LTIwICBQaGlsaXBwZSBOb3JtYW5kICA8 cG5vcm1hbmRAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR1RLXVtXUEVdIGVuYWJsZS1tZWRpYS1j YXBhYmlsaXRpZXMgd2Vic2V0dGluZwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9QbHVnaW5Q cm9jZXNzL21hYy9jb20uYXBwbGUuV2ViS2l0LnBsdWdpbi1jb21tb24uc2IuaW4gYi9Tb3VyY2Uv V2ViS2l0L1BsdWdpblByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQucGx1Z2luLWNvbW1vbi5z Yi5pbgppbmRleCBlODkzZmVmOWY0ZjgzYWVmYjVkNmZmNzNiYzVjMWVmMTY5ZjdmZjNiLi44Y2I5 OGNlMjFiYmM4MjZhM2M4ZTk3OTMwMmY2ZjYwMjc2OGE4YmI1IDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViS2l0L1BsdWdpblByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJLaXQucGx1Z2luLWNvbW1vbi5z Yi5pbgorKysgYi9Tb3VyY2UvV2ViS2l0L1BsdWdpblByb2Nlc3MvbWFjL2NvbS5hcHBsZS5XZWJL aXQucGx1Z2luLWNvbW1vbi5zYi5pbgpAQCAtMzY3LDYgKzM2Nyw3IEBACiA7OyBWYXJpb3VzIHNl cnZpY2VzIHJlcXVpcmVkIGJ5IEFwcEtpdCBhbmQgb3RoZXIgZnJhbWV3b3JrcwogKGFsbG93IG1h Y2gtbG9va3VwCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUuYXVkaW8uQXVkaW9Db21wb25l bnRSZWdpc3RyYXIiKQorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLmFzc2VydGlvbmQucHJv Y2Vzc2Fzc2VydGlvbmNvbm5lY3Rpb24iKQogICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLkNv cmVTZXJ2aWNlcy5jb3Jlc2VydmljZXNkIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5E aXNrQXJiaXRyYXRpb24uZGlza2FyYml0cmF0aW9uZCIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20u YXBwbGUuRmlsZUNvb3JkaW5hdGlvbiIpCkBAIC0zOTEsNiArMzkyLDcgQEAKICAgICAoZ2xvYmFs LW5hbWUgImNvbS5hcHBsZS5vY3NwZCIpCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUucGFz dGVib2FyZC4xIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5wYnMuZmV0Y2hfc2Vydmlj ZXMiKQorICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLnRjY2QiKQogICAgIChnbG9iYWwtbmFt ZSAiY29tLmFwcGxlLnRjY2Quc3lzdGVtIikKICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS50 c20udWlzZXJ2ZXIiKQogICAgIChnbG9iYWwtbmFtZSAiY29tLmFwcGxlLndpbmRvd19wcm94aWVz IikK