ddbc3e2006
Add Seatbelt-based macOS sandboxing for the browser service processes. The shared profile builder grants only the filesystem, network, Mach, and process execution permissions each service needs, with fatal sandbox violation reporting enabled so denials are visible during development. Wire sandbox profiles into WebContent, WebWorker, RequestServer, ImageDecoder, and Compositor. Keep Landlock and Seatbelt APIs visible only on the platforms that use them. Allow RequestServer resource substitution files explicitly, preserve read access for read-write cache paths, and only grant renderer process execution for an existing Cranelift helper.
41 lines
1.3 KiB
CMake
41 lines
1.3 KiB
CMake
set(CMAKE_AUTOMOC OFF)
|
|
set(CMAKE_AUTORCC OFF)
|
|
set(CMAKE_AUTOUIC OFF)
|
|
|
|
set(SOURCES
|
|
ConnectionFromClient.cpp
|
|
)
|
|
|
|
if (ANDROID)
|
|
add_library(imagedecoderservice SHARED
|
|
${LADYBIRD_SOURCE_DIR}/UI/Android/src/main/cpp/ImageDecoderService.cpp
|
|
${LADYBIRD_SOURCE_DIR}/UI/Android/src/main/cpp/LadybirdServiceBaseJNI.cpp
|
|
${SOURCES}
|
|
)
|
|
target_link_libraries(imagedecoderservice PRIVATE LibWebView)
|
|
else()
|
|
add_library(imagedecoderservice STATIC ${SOURCES})
|
|
endif()
|
|
|
|
add_executable(ImageDecoder main.cpp)
|
|
|
|
if (LINUX)
|
|
target_sources(ImageDecoder PRIVATE SandboxLinux.cpp)
|
|
if (ENABLE_ADDRESS_SANITIZER)
|
|
target_sources(ImageDecoder PRIVATE LeakSanitizer.cpp)
|
|
endif()
|
|
elseif (APPLE)
|
|
target_sources(ImageDecoder PRIVATE SandboxMacOS.cpp)
|
|
else()
|
|
target_sources(ImageDecoder PRIVATE SandboxUnimplemented.cpp)
|
|
endif()
|
|
|
|
target_include_directories(imagedecoderservice PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/../..)
|
|
target_include_directories(imagedecoderservice PRIVATE ${LADYBIRD_SOURCE_DIR}/Services/)
|
|
|
|
target_link_libraries(ImageDecoder PRIVATE imagedecoderservice LibCore LibMain LibSandbox LibThreading)
|
|
target_link_libraries(imagedecoderservice PRIVATE LibCore LibGfx LibImageDecoders LibIPC LibImageDecoderClient LibMain LibSync LibThreading)
|
|
|
|
if (WIN32)
|
|
ladybird_windows_bin(ImageDecoder CONSOLE)
|
|
endif()
|