ddbc3e2006
Add Seatbelt-based macOS sandboxing for the browser service processes. The shared profile builder grants only the filesystem, network, Mach, and process execution permissions each service needs, with fatal sandbox violation reporting enabled so denials are visible during development. Wire sandbox profiles into WebContent, WebWorker, RequestServer, ImageDecoder, and Compositor. Keep Landlock and Seatbelt APIs visible only on the platforms that use them. Allow RequestServer resource substitution files explicitly, preserve read access for read-write cache paths, and only grant renderer process execution for an existing Cranelift helper.
60 lines
1.9 KiB
CMake
60 lines
1.9 KiB
CMake
set(SOURCES
|
|
ConnectionFromClient.cpp
|
|
CURL.cpp
|
|
Request.cpp
|
|
RequestPipe.cpp
|
|
Resolver.cpp
|
|
ResourceSubstitutionMap.cpp
|
|
WebSocketImplCurl.cpp
|
|
)
|
|
|
|
if (LINUX)
|
|
list(APPEND SOURCES SandboxLinux.cpp)
|
|
elseif (APPLE)
|
|
list(APPEND SOURCES SandboxMacOS.cpp)
|
|
else()
|
|
list(APPEND SOURCES SandboxUnimplemented.cpp)
|
|
endif()
|
|
|
|
set(GENERATED_SOURCES
|
|
RequestClientEndpoint.h
|
|
RequestServerEndpoint.h
|
|
)
|
|
|
|
set(RS_LIB_TYPE STATIC)
|
|
if (ANDROID)
|
|
list(APPEND SOURCES
|
|
${LADYBIRD_SOURCE_DIR}/UI/Android/src/main/cpp/RequestServerService.cpp
|
|
${LADYBIRD_SOURCE_DIR}/UI/Android/src/main/cpp/LadybirdServiceBaseJNI.cpp
|
|
)
|
|
set(RS_LIB_TYPE SHARED)
|
|
endif()
|
|
|
|
add_library(requestserverservice ${RS_LIB_TYPE} ${SOURCES} ${GENERATED_SOURCES})
|
|
ladybird_generated_sources(requestserverservice)
|
|
|
|
add_executable(RequestServer main.cpp)
|
|
|
|
target_include_directories(requestserverservice PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/../..)
|
|
target_include_directories(requestserverservice PRIVATE ${LADYBIRD_SOURCE_DIR}/Services/)
|
|
|
|
target_link_libraries(RequestServer PRIVATE requestserverservice)
|
|
target_link_libraries(requestserverservice PUBLIC LibCore LibDNS LibHTTP LibIPC LibMain LibRequests LibSandbox LibTLS LibWebSocket LibURL LibTextCodec CURL::libcurl)
|
|
target_link_libraries(requestserverservice PRIVATE OpenSSL::Crypto OpenSSL::SSL)
|
|
|
|
if (WIN32)
|
|
ladybird_windows_bin(RequestServer CONSOLE)
|
|
endif()
|
|
|
|
if (${CMAKE_SYSTEM_NAME} MATCHES "SunOS")
|
|
# Solaris has socket and networking related functions in two extra libraries
|
|
target_link_libraries(requestserverservice PUBLIC nsl socket)
|
|
endif()
|
|
if (HAIKU)
|
|
# Haiku has networking related functions in the network library
|
|
target_link_libraries(RequestServer PRIVATE network)
|
|
endif()
|
|
if (ANDROID)
|
|
# We need s_ladybird_resource_root from LibWebView
|
|
target_link_libraries(requestserverservice PUBLIC LibWebView)
|
|
endif()
|