[epiphany/wip/sandbox: 1/2] Add important paths to the sandbox

[Michael Catanzaro <mcatanzaro src gnome org>]

commit 568c04c621acecd3755b019b91494ee8046d3f4f
Author: Michael Catanzaro <mcatanzaro igalia com>
Date:   Tue Jun 11 20:33:21 2019 -0500

    Add important paths to the sandbox
    
    The web process needs to be able to load internal Epiphany libraries,
    which are stored in pkglibdir. These will normally be under /lib or
    /lib64 and therefore already whitelisted by WebKit, but not if we're
    using a custom build prefix, e.g. if Epiphany is built in JHBuild and
    WebKit is not.
    
    Similarly, in DEVELOPER_MODE where we load from the builddir, we want to
    be able to access the builddir.

 embed/ephy-embed-shell.c | 10 ++++++++++
 meson.build              |  1 +
 2 files changed, 11 insertions(+)
---
diff --git a/embed/ephy-embed-shell.c b/embed/ephy-embed-shell.c
index 81016244c..53dbe8bfc 100644
--- a/embed/ephy-embed-shell.c
+++ b/embed/ephy-embed-shell.c
@@ -1202,7 +1202,17 @@ ephy_embed_shell_startup (GApplication *application)
                     shell);
 
   webkit_web_context_set_process_model (priv->web_context, 
WEBKIT_PROCESS_MODEL_MULTIPLE_SECONDARY_PROCESSES);
+
   webkit_web_context_set_sandbox_enabled (priv->web_context, TRUE);
+  webkit_web_context_add_path_to_sandbox (priv->web_context, PKGLIBDIR, TRUE);
+  webkit_web_context_add_path_to_sandbox (priv->web_context, ephy_file_tmp_dir (), TRUE);
+  webkit_web_context_add_path_to_sandbox (priv->web_context, ephy_profile_dir (), TRUE);
+  webkit_web_context_add_path_to_sandbox (priv->web_context, ephy_cache_dir (), TRUE);
+  webkit_web_context_add_path_to_sandbox (priv->web_context, ephy_config_dir (), TRUE);
+
+#if DEVELOPER_MODE
+  webkit_web_context_add_path_to_sandbox (priv->web_context, BUILD_ROOT, TRUE);
+#endif
 
   g_signal_connect_object (priv->web_context, "initialize-web-extensions",
                            G_CALLBACK (initialize_web_process_extensions),
diff --git a/meson.build b/meson.build
index 7ca728cd9..96df51051 100644
--- a/meson.build
+++ b/meson.build
@@ -50,6 +50,7 @@ conf.set_quoted('GETTEXT_PACKAGE', meson.project_name())
 conf.set_quoted('ISO_CODES_PREFIX', iso_codes_prefix)
 conf.set_quoted('LIBLOCALEDIR', liblocaledir)
 conf.set_quoted('LOCALEDIR', localedir)
+conf.set_quoted('PKGLIBDIR', pkglibdir)
 conf.set_quoted('PKGLIBEXECDIR', pkglibexecdir)
 conf.set_quoted('PROFILE', profile)
 conf.set_quoted('SOURCE_ROOT', meson.source_root())