electron/patches/chromium/support_mixed_sandbox_with_zygote.patch
electron-roller[bot] 8c89137ecd
chore: bump chromium to 122.0.6194.0 (main) (#40750)
* chore: bump chromium in DEPS to 122.0.6180.0

* chore: update render_widget_host_view_base.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5079532

minor manual changes to match upstream changes

* chore: update printing.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5094777

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5054299

Update patch to upstream changes in print_view_manager_base.cc.
CC @codebytere for 👀

* chore: update feat_add_onclose_to_messageport.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5083156

no manual changes; patch applied with fuzz 1

* chore: update build_do_not_depend_on_packed_resource_integrity.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5087072

minor manual changes to match upstream changes

* chore: update port_autofill_colors_to_the_color_pipeline.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/4960481

no manual changes; patch applied with fuzz 2

* chore: update revert_api_dcheck-fail_when_we_reenter_v8_while_terminating.patch

Xref: https://chromium-review.googlesource.com/c/v8/v8/+/5076902
Xref: https://chromium-review.googlesource.com/c/v8/v8/+/5096253

The `bailout_value` variable, which allowed us to fail gracefully in
these macros, has been removed upstream. This raises the temperature
on https://github.com/electron/electron/issues/40741 ...

Since we don't have a bailout value, return a default-constructed
instance of whatever the return type is of the function that invokes
the macro.

* Remove performActionOnRemotePage

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5068017

It appears it is not used by anything within Chromium or outside.

* perf: in SubmenuButton ctor, move() the PressedCallback

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5066872

The copy construtor is more expensive and has been removed upstream

* chore: update constructor call for ElectronExtensionsRendererClient::dispatcher_

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5055146

* chore: handle CAPTURED_SURFACE_CONTROL in Converter<blink::PermissionType>::ToV8()

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5096614

* chore: e patches all

* chore: bump chromium to 122.0.6181.0

* chore: e patches all

* refactor: Add lookup for per-RenderFrame SpellCheckProvider

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5075094

Previously we could pass a routing ID into the spellcheck methods.
This ID arg has been replaced with a SpellCheckHost& arg.

We can get the SpellCheckHost from an accessor in SpellCheckProvider,
which was already being created on a per-render-frame basis in
RenderClientBase.

This commit adds a RenderFrame-to-SpellCheckProvider accessor
in RenderClientBase so that it can be used to get that needed
SpellCheckHost.

* chore: make lint happy

* chore: restore the will_cause_resize arg to WebContents::ExitFullscreen

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5074445

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5031312

upstream reverted this change

* chore: bump chromium in DEPS to 122.0.6182.0

* chore: update patches

* chore: fix virtual function names that were renamed upstream

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5115241

* chore: handle new blink::PermissionType::SMART_CARD in PermissionType converter

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5049989

* chore: node script/gen-libc++-filenames.js

* fixup! chore: update build_do_not_depend_on_packed_resource_integrity.patch

* chore: remove revert_api_dcheck-fail_when_we_reenter_v8_while_terminating.patch

The previous experiment of removing the DCHECK in 35093783 was a huge
failure. We either need to either:

A) use upstream as-is and fix the DCHECK failure, or
B) revert https://chromium-review.googlesource.com/c/v8/v8/+/5076902 too
C) find some other workaround

This commit is the first half of option A, removing the patch to use
upstream as-is.

* chore: bump chromium in DEPS to 122.0.6184.0

* chore: bump chromium in DEPS to 122.0.6186.0

* chore; update mas_avoid_private_macos_api_usage.patch.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5085619

minor manual changes to match upstream changes

* chore: update build_do_not_depend_on_packed_resource_integrity.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5120922

minor manual changes to match upstream changes

* chore: update fix_move_autopipsettingshelper_behind_branding_buildflag.patch

Xref: https://chromium-review.googlesource.com/c/chromium/src/+/5041595

no manual changes; patch applied with fuzz 1

* chore: e patches all

* chore: add refactor_update_node-platform_to_match_v8-platform_api_changes.patch

* chore: bump chromium in DEPS to 122.0.6188.0

* chore: bump chromium in DEPS to 122.0.6190.0

* chore: bump chromium in DEPS to 122.0.6192.0

* chore: bump chromium in DEPS to 122.0.6194.0

* Remove an unnecessary DCHECK which causes Lacros to crash.

https://chromium-review.googlesource.com/c/chromium/src/+/5124880

* [FixIt Week] Add shared regular profile function that includes ash

https://chromium-review.googlesource.com/c/chromium/src/+/5100709

* Simplify the PrintManagerHost::ScriptedPrint() call

https://chromium-review.googlesource.com/c/chromium/src/+/5019703

* [local compile hints] Add tests

https://chromium-review.googlesource.com/c/chromium/src/+/5024173

* chore: update patches

* fixup! chore: add refactor_update_node-platform_to_match_v8-platform_api_changes.patch

* chore: node script/gen-libc++-filenames.js

* Remove //ui/ozone/buildflags.h

https://chromium-review.googlesource.com/c/chromium/src/+/5119048

* fixup! Remove //ui/ozone/buildflags.h

* fixup! Remove //ui/ozone/buildflags.h

* chore: update patches

* fixup! refactor: Add lookup for per-RenderFrame SpellCheckProvider

* fixup! Remove //ui/ozone/buildflags.h

* Add permission policy verification in PermissionControllerImpl

https://chromium-review.googlesource.com/c/chromium/src/+/5059112

* fix: ensure spellcheck interface is registered for frame

* [exceptions] Unify pending and scheduled exceptions

https://chromium-review.googlesource.com/c/v8/v8/+/5050065

* fix: dchecks in node.js tests

* fix: try adding termination check

* chore: document breaking iframe change

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Charles Kerr <charles@charleskerr.com>
Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: deepak1556 <hop2deep@gmail.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
2024-01-03 09:52:49 +01:00

95 lines
4.4 KiB
Diff

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jeremy Apthorp <nornagon@nornagon.net>
Date: Wed, 28 Nov 2018 13:20:27 -0800
Subject: support_mixed_sandbox_with_zygote.patch
On Linux, Chromium launches all new renderer processes via a "zygote"
process which has the sandbox pre-initialized (see
//docs/linux_zygote.md). In order to support mixed-sandbox mode, in
which some renderers are launched with the sandbox engaged and others
without it, we need the option to launch non-sandboxed renderers without
going through the zygote.
Chromium already supports a `--no-zygote` flag, but it turns off the
zygote completely, and thus also disables sandboxing. This patch allows
the `--no-zygote` flag to affect renderer processes on a case-by-case
basis, checking immediately prior to launch whether to go through the
zygote or not based on the command-line of the to-be-launched renderer.
This patch could conceivably be upstreamed, as it does not affect
production Chromium (which does not use the `--no-zygote` flag).
However, the patch would need to be reviewed by the security team, as it
does touch a security-sensitive class.
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 412887e0002a5bc65be1f5ecbed9e991972d373a..82b4a00f9c66627ef897c717a0f2e93ac0f13e08 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -1712,9 +1712,15 @@ bool RenderProcessHostImpl::Init() {
std::unique_ptr<SandboxedProcessLauncherDelegate> sandbox_delegate =
std::make_unique<RendererSandboxedProcessLauncherDelegateWin>(
*cmd_line, IsPdf(), IsJitDisabled());
+#else
+#if BUILDFLAG(USE_ZYGOTE)
+ bool use_zygote = !cmd_line->HasSwitch(switches::kNoZygote);
+ std::unique_ptr<SandboxedProcessLauncherDelegate> sandbox_delegate =
+ std::make_unique<RendererSandboxedProcessLauncherDelegate>(use_zygote);
#else
std::unique_ptr<SandboxedProcessLauncherDelegate> sandbox_delegate =
std::make_unique<RendererSandboxedProcessLauncherDelegate>();
+#endif
#endif
auto file_data = std::make_unique<ChildProcessLauncherFileData>();
diff --git a/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.cc b/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.cc
index e5a087e3e26253901a84d509d8a4f1268a2569fe..7dab0443f8897553830f1f4cc98457839b354264 100644
--- a/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.cc
+++ b/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.cc
@@ -33,6 +33,9 @@ namespace content {
#if BUILDFLAG(USE_ZYGOTE)
ZygoteCommunication* RendererSandboxedProcessLauncherDelegate::GetZygote() {
+ if (!use_zygote_) {
+ return nullptr;
+ }
const base::CommandLine& browser_command_line =
*base::CommandLine::ForCurrentProcess();
base::CommandLine::StringType renderer_prefix =
@@ -67,6 +70,9 @@ RendererSandboxedProcessLauncherDelegateWin::
is_pdf_renderer_(is_pdf_renderer) {
// PDF renderers must be jitless.
CHECK(!is_pdf_renderer || is_jit_disabled);
+#if BUILDFLAG(USE_ZYGOTE)
+ use_zygote_ = !cmd_line->HasSwitch(switches::kNoZygote);
+#endif
if (is_jit_disabled) {
dynamic_code_can_be_disabled_ = true;
return;
diff --git a/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.h b/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.h
index 00038da2c15696b361aea1469ccf73307e44963e..7ccfbf11ecfd56fd165915baa85919eaf2e923b9 100644
--- a/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.h
+++ b/content/browser/renderer_host/renderer_sandboxed_process_launcher_delegate.h
@@ -18,6 +18,11 @@ class CONTENT_EXPORT RendererSandboxedProcessLauncherDelegate
public:
RendererSandboxedProcessLauncherDelegate() = default;
+#if BUILDFLAG(USE_ZYGOTE)
+ RendererSandboxedProcessLauncherDelegate(bool use_zygote):
+ use_zygote_(use_zygote) {}
+#endif
+
~RendererSandboxedProcessLauncherDelegate() override = default;
#if BUILDFLAG(USE_ZYGOTE)
@@ -30,6 +35,11 @@ class CONTENT_EXPORT RendererSandboxedProcessLauncherDelegate
// sandbox::policy::SandboxDelegate:
sandbox::mojom::Sandbox GetSandboxType() override;
+
+ private:
+#if BUILDFLAG(USE_ZYGOTE)
+ bool use_zygote_ = true;
+#endif
};
#if BUILDFLAG(IS_WIN)