nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/Tools/TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitle...

16 lines
610 B
Plaintext
Raw Permalink Normal View History

Update WebKit Tools to issue mach extensions as needed https://bugs.webkit.org/show_bug.cgi?id=207850 <rdar://problem/59521019> Reviewed by Per Arne Vollan. Revise the codesign settings for our testing tools to allow the process to vend mach extensions to its child processes (WebContent, GPU, Network, etc.) as needed. * MiniBrowser/MiniBrowser.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitlements: Added. * TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig: * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * WebKitTestRunner/Configurations/WebKitTestRunner.entitlements: Canonical link: https://commits.webkit.org/220833@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256777 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-17 22:54:22 +00:00
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
[WebAuthn] Implement SPI for the platform authenticator https://bugs.webkit.org/show_bug.cgi?id=208087 <rdar://problem/59369305> Reviewed by Brent Fulgham. Source/WebCore: Enhances AuthenticatorAssertionResponse to accommondate responses returned from the platform authenticator. Covered by API tests. * Modules/webauthn/AuthenticatorAssertionResponse.cpp: (WebCore::AuthenticatorAssertionResponse::create): (WebCore::AuthenticatorAssertionResponse::setAuthenticatorData): (WebCore::AuthenticatorAssertionResponse::AuthenticatorAssertionResponse): * Modules/webauthn/AuthenticatorAssertionResponse.h: (WebCore::AuthenticatorAssertionResponse::authenticatorData const): (WebCore::AuthenticatorAssertionResponse::signature const): (WebCore::AuthenticatorAssertionResponse::name const): (WebCore::AuthenticatorAssertionResponse::displayName const): (WebCore::AuthenticatorAssertionResponse::numberOfCredentials const): (WebCore::AuthenticatorAssertionResponse::accessControl const): (WebCore::AuthenticatorAssertionResponse::setSignature): (WebCore::AuthenticatorAssertionResponse::setName): (WebCore::AuthenticatorAssertionResponse::setDisplayName): (WebCore::AuthenticatorAssertionResponse::setNumberOfCredentials): Source/WebKit: Here is the newly added SPI: typedef NS_ENUM(NSInteger, _WKWebAuthenticationPanelUpdate) { ... _WKWebAuthenticationPanelUpdateLAError, _WKWebAuthenticationPanelUpdateLADuplicateCredential, _WKWebAuthenticationPanelUpdateLANoCredential, }; typedef NS_ENUM(NSInteger, _WKWebAuthenticationTransport) { ... _WKWebAuthenticationTransportInternal, }; @protocol _WKWebAuthenticationPanelDelegate <NSObject> @optional ... - (void)panel:(_WKWebAuthenticationPanel *)panel verifyUserWithAccessControl:(SecAccessControlRef)accessControl completionHandler:(void (^)(LAContext *))completionHandler; @end Illustrations: 1) _WKWebAuthenticationPanelUpdate: Three errors are added to help clients present meaningful error messages to users. a) WKWebAuthenticationPanelUpdateLAError: An internal error, clients should inform users and terminate the platform authentication process. This error can be returned at any time. b) _WKWebAuthenticationPanelUpdateLADuplicateCredential: It means a credential is found to match an entry in the excludeList. Clients should inform users and terminate the platform authentication process. This error will only be returned during makeCredential and before verifyUserWithAccessControl delegate. c) _WKWebAuthenticationPanelUpdateLANoCredential: It means no credentials are found. Clients should inform users and terminate the platform authentication process. This error will only be returned during getAssertion and before verifyUserWithAccessControl delegate. 2) _WKWebAuthenticationTransport: _WKWebAuthenticationTransportInternal is added such that clients can learn platform authenticator will be used from _WKWebAuthenticationPanel.transports. 3) verifyUserWithAccessControl: A delegate that will be called during makeCredential or getAssertion when the platform authenticator is involved. This delegate is used to obtain user verification from a LAContext. In addition, the LAContext should evaluate the passed accessControl, such that the SEP protected credential private key can be used. A typical example will be [LAContext evaluateAccessControl:accessControl operation:LAAccessControlOperationUseKeySign localizedReason:reply:]. Noted, for getAssertion, selectAssertionResponse will be called before verifyUserWithAccessControl. So users need to be prompted to select a credential before the user verification. In the scenario when both the platform authenticator and external authenticators are requested. Clients are advised to wait until verifyUserWithAccessControl to show the combined UI. If any of the LAError states are received before verifyUserWithAccessControl, clients should then only show the external authenticator UI. Also, platform authenticator and external authenticators are being discovered at the same time, which means a user can plug in a security key at anytime. If a valid response is received from the security key, the whole ceremony will be terminated. Besides introducing the SPI, and all the necessary plumbing to make it happen. This patch also: 1) adds LocalAuthenticationSPI, which is used to check whether a given LAContext is unlocked or not; 2) improves MockLocalConnection such that mock testing can still be ran. * Platform/spi/Cocoa/LocalAuthenticationSPI.h: Copied from Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticationSoftLink.h. * UIProcess/API/APIWebAuthenticationPanel.cpp: (API::WebAuthenticationPanel::WebAuthenticationPanel): * UIProcess/API/APIWebAuthenticationPanelClient.h: (API::WebAuthenticationPanelClient::verifyUser const): * UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h: * UIProcess/API/Cocoa/_WKWebAuthenticationPanel.mm: (wkWebAuthenticationTransport): * UIProcess/WebAuthentication/Authenticator.h: * UIProcess/WebAuthentication/AuthenticatorManager.cpp: (WebKit::AuthenticatorManager::verifyUser): * UIProcess/WebAuthentication/AuthenticatorManager.h: * UIProcess/WebAuthentication/Cocoa/LocalAuthenticationSoftLink.h: * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.h: * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm: (WebKit::LocalAuthenticatorInternal::toNSData): (WebKit::LocalAuthenticatorInternal::toArrayBuffer): (WebKit::LocalAuthenticator::makeCredential): (WebKit::LocalAuthenticator::continueMakeCredentialAfterUserConsented): (WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested): (WebKit::LocalAuthenticator::getAssertion): (WebKit::LocalAuthenticator::continueGetAssertionAfterResponseSelected): (WebKit::LocalAuthenticator::continueGetAssertionAfterUserConsented): (WebKit::LocalAuthenticator::receiveException const): * UIProcess/WebAuthentication/Cocoa/LocalConnection.h: (WebKit::LocalConnection::filterResponses const): * UIProcess/WebAuthentication/Cocoa/LocalConnection.mm: (WebKit::LocalConnection::isUnlocked const): (WebKit::LocalConnection::getUserConsent const): Deleted. (WebKit::LocalConnection::selectCredential const): Deleted. * UIProcess/WebAuthentication/Cocoa/WebAuthenticationPanelClient.h: * UIProcess/WebAuthentication/Cocoa/WebAuthenticationPanelClient.mm: (WebKit::WebAuthenticationPanelClient::WebAuthenticationPanelClient): (WebKit::wkWebAuthenticationPanelUpdate): (WebKit::WebAuthenticationPanelClient::selectAssertionResponse const): (WebKit::WebAuthenticationPanelClient::verifyUser const): * UIProcess/WebAuthentication/Mock/MockLocalConnection.h: * UIProcess/WebAuthentication/Mock/MockLocalConnection.mm: (WebKit::MockLocalConnection::isUnlocked const): (WebKit::MockLocalConnection::filterResponses const): (WebKit::MockLocalConnection::getUserConsent const): Deleted. (WebKit::MockLocalConnection::selectCredential const): Deleted. * UIProcess/WebAuthentication/WebAuthenticationFlags.h: * WebKit.xcodeproj/project.pbxproj: Tools: Besides adding API tests, this patch also teaches TestWebKitAPI to use restricted entitlements. * TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig: * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm: (-[TestWebAuthenticationPanelDelegate panel:updateWebAuthenticationPanel:]): (-[TestWebAuthenticationPanelDelegate panel:selectAssertionResponse:completionHandler:]): (-[TestWebAuthenticationPanelDelegate panel:verifyUserWithAccessControl:completionHandler:]): (TestWebKitAPI::TEST): * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-get-assertion-la.html: Copied from Tools/TestWebKitAPI/Tests/WebKitCocoa/web-authentication-get-assertion.html. * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-la-duplicate-credential.html: Added. * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-la-error.html: Added. * TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-la.html: Added. Canonical link: https://commits.webkit.org/221101@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@257269 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-24 23:51:17 +00:00
<key>keychain-access-groups</key>
<array>
<string>com.apple.TestWebKitAPI</string>
</array>
Update WebKit Tools to issue mach extensions as needed https://bugs.webkit.org/show_bug.cgi?id=207850 <rdar://problem/59521019> Reviewed by Per Arne Vollan. Revise the codesign settings for our testing tools to allow the process to vend mach extensions to its child processes (WebContent, GPU, Network, etc.) as needed. * MiniBrowser/MiniBrowser.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitlements: Added. * TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig: * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * WebKitTestRunner/Configurations/WebKitTestRunner.entitlements: Canonical link: https://commits.webkit.org/220833@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256777 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-17 22:54:22 +00:00
<key>com.apple.security.temporary-exception.sbpl</key>
<array>
<string>(allow mach-issue-extension (require-all (extension-class &quot;com.apple.webkit.extension.mach&quot;)))</string>
[macOS] WebContent sandbox; remove AppleIntelMEUserClient https://bugs.webkit.org/show_bug.cgi?id=219012 <rdar://problem/70462796> Reviewed by Eric Carlson. Source/WebKit: Instead of globally extending access to the AppleIntelMEUserClient IOKit class, only extend it when the GPU process is not in use. * UIProcess/WebPageProxy.cpp: (WebKit::gpuIOKitClasses): Add 'AppleIntelMEUserClient' as a dynamically-extended IOKit class. * WebProcess/com.apple.WebProcess.sb.in: Only allow 'AppleIntelMEUserClient' if it was dynamically extended. Tools: Update the various sandboxes to allow the UIProcess to extend IOKit classes to child processes on macOS. We already do this on iOS. * MiniBrowser/MiniBrowser.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI-macOS-internal.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitlements: * WebKitTestRunner/Configurations/WebKitTestRunner.entitlements: Canonical link: https://commits.webkit.org/232068@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@270381 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-12-03 01:40:53 +00:00
<string>(allow iokit-issue-extension (require-all (extension-class &quot;com.apple.webkit.extension.iokit&quot;)))</string>
Update WebKit Tools to issue mach extensions as needed https://bugs.webkit.org/show_bug.cgi?id=207850 <rdar://problem/59521019> Reviewed by Per Arne Vollan. Revise the codesign settings for our testing tools to allow the process to vend mach extensions to its child processes (WebContent, GPU, Network, etc.) as needed. * MiniBrowser/MiniBrowser.entitlements: * TestWebKitAPI/Configurations/TestWebKitAPI-macOS.entitlements: Added. * TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig: * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * WebKitTestRunner/Configurations/WebKitTestRunner.entitlements: Canonical link: https://commits.webkit.org/220833@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@256777 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-02-17 22:54:22 +00:00
</array>
</dict>
</plist>