crosswalk-project/crosswalk — pull request #1332 by jeez (2013-12-13 20:46:59+00:00)
Title: [Tizen] Add proper SMACK labels to Crosswalk

This PR address the issues described at https://crosswalk-project.org/jira/browse/XWALK-88 and https://crosswalk-project.org/jira/browse/XWALK-113.

Our goal here is to enable Crosswalk to work with proper SMACK labels under Tizen 2.x. My initial goal was to work on that only for the ExtensionProcess, but that turned out to be impossible; there was no way to fix one process without changing the others and adding proper rules.

I have basically followed https://docs.google.com/a/intel.com/document/d/1Exj9ewu74mxl96YodnHAbxGikR3m8v4UgwE3w7FyIMg/edit#heading=h.vsydfcg2d4wb so, in summary:

1- BrowserProcess is under "xwalk" label;
2- ExtensionProcess is under "xwalk_ep" label, since we still don't parse web apps id;
3- RenderProcess is under "xwalk_renderer";
4- SMACK rules were added to get Crosswalk working properly again.

I would like that everyone who have worked on that document to please help reviewing these commits. ( @mbbill and @xuzhang ).

I also would like that our contact from the security team to have a look at this carefully ( @terriko ).

This PR is meant to be merged AFTER the branching of crosswalk-3.
Please, READ THE COMMIT MESSAGES. They shall provide way more information than this PR description.

What will be missing after this initial work is:

- Pass a real AppID to ExtensionProcess. Currently we pass "0" since we still don't parse the app id from the manifest file, so "xwalk_ep" is always used as a label;

- Drop CAP_MAC_ADMIN from all the other XWalk processes (GPU, Plugin, etc, and perhaps not even BP needs it), but not from the zygote process;

- Improving our security by having BP on a different label than other child processes (GPU, Plugin, etc). One idea would be to have BP under "xwalk_runtime"
and all others under "xwalk". More rules would be needed, though;

- Fix T-E-C (refer to https://crosswalk-project.org/jira/browse/XWALK-687);

- Test every single other extensions on Tizen 2.x and fix them accordingly.