commit c3250a6eaba24bc29f880c8d8a153921fb354a10
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 16 17:52:24 2018 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 16 17:52:24 2018 +0000
tree 9f18a36fd63912d35a2b49014f57e100242c5e20
parent 58f865770ade355121658396990599ee9c1e8b1d

[GTK][WPE] Fix sandbox on distros with suid bubblewrap
https://bugs.webkit.org/show_bug.cgi?id=190616

Patch by Patrick Griffis <pgriffis@igalia.com> on 2018-10-16
Reviewed by Michael Catanzaro.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::bubblewrapSpawn):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@237190 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit/ChangeLog

diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index ad7e192..706b879 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,13 @@
+2018-10-16  Patrick Griffis  <pgriffis@igalia.com>
+
+        [GTK][WPE] Fix sandbox on distros with suid bubblewrap
+        https://bugs.webkit.org/show_bug.cgi?id=190616
+
+        Reviewed by Michael Catanzaro.
+
+        * UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
+        (WebKit::bubblewrapSpawn):
+
 2018-10-16  Alex Christensen  <achristensen@webkit.org>
 
         Replace HistoryItem* with HistoryItem& where possible

Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

diff --git a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
index 6084d69..4ce73ef 100644
--- a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
+++ b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
@@ -666,6 +666,15 @@
     // We would have to parse ld config files for more info.
     bindPathVar(sandboxArgs, "LD_LIBRARY_PATH");
 
+    const char* libraryPath = g_getenv("LD_LIBRARY_PATH");
+    if (libraryPath && libraryPath[0]) {
+        // On distros using a suid bwrap it drops this env var
+        // so we have to pass it through to the children.
+        sandboxArgs.appendVector(Vector<CString>({
+            "--setenv", "LD_LIBRARY_PATH", libraryPath,
+        }));
+    }
+
     bindSymlinksRealPath(sandboxArgs, "/etc/resolv.conf");
     bindSymlinksRealPath(sandboxArgs, "/etc/localtime");