diff options
| author | Alexandru Croitor <alexandru.croitor@qt.io> | 2019-01-17 17:37:52 +0100 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-01-28 19:03:36 +0000 |
| commit | d3a6b236949a0197f998eeb58145c208552de4fe (patch) | |
| tree | d0212104571a4c72bcf731f9604669945acc4748 /src/core | |
| parent | e63b35763907304089d961bc3e284178d36c69a3 (diff) | |
Fix Sandbox V2 to work on macOS
The renderer process crashed on macOS because sandboxing
was not enabled.
The patch does two things to fix that:
1) Initializes the Seatbelt Sandbox in processMain().
2) Exposes a content::getQtPrefix() function that will be used by
SetupCommonSandboxParameters in sandbox_parameters_mac.mm to pass the
Qt Prefix path to the sandbox rules in
chromium/services/service_manager/sandbox/mac/common_v2.sb
The path will be used to allow file read access (required to read ICU
data files and other resource files).
To check which resources are denied access, start any QtWebEngine app
with the "--enable-sandbox-logging" flag, and use Console.app to
see the denied requests.
Change-Id: I61c0a2d20d5e96c7cc9562fd203fd606dd25d36c
Fixes: QTBUG-73089
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/chromium_overrides.cpp | 9 | ||||
| -rw-r--r-- | src/core/process_main.cpp | 12 | ||||
| -rw-r--r-- | src/core/web_engine_context.cpp | 2 |
3 files changed, 20 insertions, 3 deletions
diff --git a/src/core/chromium_overrides.cpp b/src/core/chromium_overrides.cpp index 841dcf4c9..c25d6dda9 100644 --- a/src/core/chromium_overrides.cpp +++ b/src/core/chromium_overrides.cpp @@ -59,6 +59,7 @@ #include <QWindow> #include <QFontDatabase> #include <QStringList> +#include <QLibraryInfo> #if defined(USE_AURA) && !defined(USE_OZONE) #include "ui/base/dragdrop/os_exchange_data.h" @@ -119,6 +120,14 @@ void WebContentsView::GetDefaultScreenInfo(content::ScreenInfo* results) QtWebEngineCore::GetScreenInfoFromNativeWindow(&dummy, results); } +#if defined(Q_OS_MACOS) +std::string getQtPrefix() +{ + const QString prefix = QLibraryInfo::location(QLibraryInfo::PrefixPath); + return prefix.toStdString(); +} +#endif + } // namespace content #if defined(USE_AURA) || defined(USE_OZONE) diff --git a/src/core/process_main.cpp b/src/core/process_main.cpp index 677f0b10a..d661d3b90 100644 --- a/src/core/process_main.cpp +++ b/src/core/process_main.cpp @@ -44,7 +44,10 @@ #if defined(OS_WIN) #include "sandbox/win/src/sandbox_types.h" #include "content/public/app/sandbox_helper_win.h" -#endif // OS_WIN +#elif defined(OS_MACOSX) +#include "base/logging.h" +#include "sandbox/mac/seatbelt_exec.h" +#endif namespace QtWebEngine { @@ -64,6 +67,13 @@ int processMain(int argc, const char **argv) params.argc = argc; params.argv = argv; #endif // OS_WIN +#if defined(OS_MACOSX) + sandbox::SeatbeltExecServer::CreateFromArgumentsResult seatbelt = + sandbox::SeatbeltExecServer::CreateFromArguments(argv[0], argc, const_cast<char**>(argv)); + if (seatbelt.sandbox_required) { + CHECK(seatbelt.server->InitializeSandbox()); + } +#endif // defined(OS_MACOSX) return content::ContentMain(params); } diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp index f0aef72ee..056f4bcda 100644 --- a/src/core/web_engine_context.cpp +++ b/src/core/web_engine_context.cpp @@ -435,8 +435,6 @@ void WebEngineContext::initialize() parsedCommandLine->AppendSwitch(switches::kDisablePepper3DImageChromium); // Same problem with select popups. parsedCommandLine->AppendSwitch(switches::kDisableNativeGpuMemoryBuffers); - // SandboxV2 doesn't currently work for us - appendToFeatureSwitch(parsedCommandLine, switches::kDisableFeatures, features::kMacV2Sandbox.name); #endif #if defined(Q_OS_WIN) |