[webkit-changes] [WebKit/WebKit] ba07b6: Cleanup hardened mach exceptions and formalize fal...

[Keith Miller]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ba07b609dde3d292264be5576a7daa415475eaf2
      https://github.com/WebKit/WebKit/commit/ba07b609dde3d292264be5576a7daa415475eaf2
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2024-04-17 (Wed, 17 Apr 2024)

  Changed paths:
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/runtime/InitializeThreading.cpp
    M Source/JavaScriptCore/runtime/JSCConfig.cpp
    M Source/JavaScriptCore/runtime/JSCConfig.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VMEntryScope.cpp
    M Source/JavaScriptCore/runtime/VMTraps.cpp
    M Source/JavaScriptCore/tools/JSDollarVM.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
    M Source/WTF/wtf/PlatformRegisters.cpp
    M Source/WTF/wtf/Threading.cpp
    M Source/WTF/wtf/WTFConfig.cpp
    M Source/WTF/wtf/WTFConfig.h
    M Source/WTF/wtf/threads/Signals.cpp
    M Source/WTF/wtf/threads/Signals.h
    M Source/WTF/wtf/win/SignalsWin.cpp
    M Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm
    M Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
    M Tools/DumpRenderTree/mac/DumpRenderTree.mm
    M Tools/TestWebKitAPI/Tests/WTF/Signals.cpp

  Log Message:
  -----------
  Cleanup hardened mach exceptions and formalize fallback
https://bugs.webkit.org/show_bug.cgi?id=272839
rdar://126634499

Reviewed by Yusuke Suzuki.

This change does a couple of things:

1) Refactor the signal handler API after https://commits.webkit.org/276579@main which had mach exception users
   pass the mask of exceptions they would ever want to handle at initialization time (before they register their handler).
   Instead the new signal handler API registers our handlers with the kernel at finalization time. At which point we
   have a list of every exception handler added.

2) Remove the finalizeSignalHandlers function and finalize signal handlers when WTF::Config finalizes.

3) Remove disableSignalHandling function as it never really worked (signals could still get registered before we called disable)
   and we mostly rely on the sandbox to block signals in lockdown mode.

3) Rename SignalHandlers::InitState entries to better reflect the new design and use it for all configurations not just mach ports.

4) Formalized the fallback added in https://commits.webkit.org/276579@main we need it for JSC API users that don't have the hardened API
   in their sandbox.

5) Remove `isX86BinaryRunningOnARM()` check since that didn't seem to work anyway. We'll probably have to remove signal handling under
   Rosetta as I couldn't get it to work.

6) Save the secret key for our hardened handler in Signals.cpp before finalization and only let API users see it via presignReturnPCForHandler
   so they can't accidentally save it somewhere an attacker could see later. We also carefully zero it at finalization time after passing
   it to the kernel via `task_register_hardened_exception_handler`.

7) Move disabledFreezingForTesting to WTF::Config since that's the config that actually does the freezing not JSC::Config.
   This allows WTF::Config to control finalizing signal handlers.

8) Remove some cases from com.apple.WebKit.WebContent.sb.in to simplify the profile slightly. We don't need to guard the
   `(require-not (webcontent-process-launched))` check on `ENABLE(BLOCK_SET_EXCEPTION_PORTS)` because we have
   `webcontent-process-launched` anywhere we `HAVE(HARDENED_MACH_EXCEPTIONS)` anyway.

* Source/JavaScriptCore/jsc.cpp:
(main):
(CommandLine::parseArguments):
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/runtime/JSCConfig.cpp:
(JSC::Config::disableFreezingForTesting): Deleted.
* Source/JavaScriptCore/runtime/JSCConfig.h:
(JSC::Config::disableFreezingForTesting):
(JSC::Config::finalize):
(JSC::Config::permanentlyFreeze): Deleted.
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::VM):
* Source/JavaScriptCore/runtime/VMEntryScope.cpp:
(JSC::VMEntryScope::setUpSlow):
* Source/JavaScriptCore/runtime/VMTraps.cpp:
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION_WITH_ATTRIBUTES):
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
(JSC::Wasm::trapHandler):
(JSC::Wasm::activateSignalingMemory):
(JSC::Wasm::prepareSignalingMemory):
(JSC::Wasm::MachExceptionSigningKey::MachExceptionSigningKey): Deleted.
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
* Source/WTF/wtf/PlatformRegisters.cpp:
(WTF::threadStatePCInternal):
* Source/WTF/wtf/Threading.cpp:
(WTF::initialize):
* Source/WTF/wtf/WTFConfig.cpp:
(WTF::Config::initialize):
(WTF::Config::finalize):
(WTF::Config::permanentlyFreeze):
(WTF::Config::disableFreezingForTesting):
* Source/WTF/wtf/WTFConfig.h:
* Source/WTF/wtf/threads/Signals.cpp:
(WTF::SignalHandlers::add):
(WTF::SignalHandlers::presignReturnPCForHandler):
(WTF::initMachExceptionHandlerThread):
(WTF::toMachMask):
(WTF::setExceptionPorts):
(WTF::activeThreads):
(WTF::registerThreadForMachExceptionHandling):
(WTF::activateSignalHandlersFor):
(WTF::addSignalHandler):
(WTF::jscSignalHandler):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WTF/wtf/threads/Signals.h:
(WTF::toMachMask): Deleted.
(WTF::initializeSignalHandling): Deleted.
(WTF::disableSignalHandling): Deleted.
* Source/WTF/wtf/win/SignalsWin.cpp:
(WTF::SignalHandlers::add):
(WTF::addSignalHandler):
(WTF::activateSignalHandlersFor):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm:
(GPU_SERVICE_INITIALIZER):
* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
* Tools/TestWebKitAPI/Tests/WTF/Signals.cpp:
(TEST(Signals, SignalsWorkOnExit)):
(TEST(Signals, SignalsAccessFault)):

Canonical link: https://commits.webkit.org/277648@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications