Skip to content

Commit

Permalink
Enable sandboxing
Browse files Browse the repository at this point in the history
Note: The system automatically migrates Vienna's library files to a sandbox container on launching Vienna with sandboxing enabled. This can be reversed by using the provided shell script, e.g. for development purposes or for downgrading to an earlier version of Vienna.

The container-migration.plist file specifies the old and new locations for the migration. It should cover all of Vienna's directories and files, so that the user ideally ends up with a complete sandbox container.

Some system-defined locations have to be changed to avoid duplication. For example, Apple moved the cookies storage from ~/Library/Cookies to ~/Library/HTTPStorages starting with macOS 11/Safari 14. Within sandbox containers however, ~/Library/Cookies is used. The automatic migration does not overwrite files. Therefore, a migration of ~/Library/HTTPStorages is attempted first. If that attempt is successful then the migration of ~/Library/Cookies should (silently) fail; otherwise ~/Library/Cookies is migrated instead.

User preferences in ~/Library/Preferences are migrated automatically. User scripts are migrated from ~/Library/Scripts/Applications/Vienna to ~/Library/Application Scripts/<bundle ID> and a symlink is left at the former location; this also happens automatically.

The shell script uses ditto to copy the directories. Ditto will merge directories rather than overwrite them, if the destination directory exists. It will, however, overwrite individual files.
  • Loading branch information
Eitot committed Jul 9, 2023
1 parent e6aff5f commit 929b494
Show file tree
Hide file tree
Showing 12 changed files with 263 additions and 55 deletions.
14 changes: 7 additions & 7 deletions Vienna Tests/DirectoryMonitorTests.swift
Original file line number Diff line number Diff line change
Expand Up @@ -44,31 +44,31 @@ class DirectoryMonitorTests: XCTestCase {

var testExpectation: XCTestExpectation?

override func setUp() {
super.setUp()
override func setUpWithError() throws {
try super.setUpWithError()

// Set the test expectation.
testExpectation = expectation(description: "The monitor's event handler is called")

// Create the temp directory.
XCTAssertNoThrow(try fileManager.createDirectory(at: tempDirectory, withIntermediateDirectories: false))
tempDirectory = try fileManager.url(for: .itemReplacementDirectory, in: .userDomainMask, appropriateFor: fileManager.applicationScriptsDirectory, create: true)

// Create the monitor.
monitor = DirectoryMonitor(directories: [tempDirectory])
}

override func tearDown() {
override func tearDownWithError() throws {
// Deinitialize the monitor and reset the failsafe.
monitor = nil
hasHandlerBeenCalled = false

// Delete the temp directory.
XCTAssertNoThrow(try fileManager.removeItem(at: tempDirectory))
try fileManager.removeItem(at: tempDirectory)

// Unset the test expectation.
testExpectation = nil

super.tearDown()
try super.tearDownWithError()
}

// MARK: Test methods
Expand Down Expand Up @@ -167,7 +167,7 @@ class DirectoryMonitorTests: XCTestCase {

let fileManager = FileManager.default

let tempDirectory = URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent(ProcessInfo.processInfo.globallyUniqueString, isDirectory: true)
var tempDirectory: URL!

var tempDirectoryItemCount: Int {
return (try? fileManager.contentsOfDirectory(at: tempDirectory, includingPropertiesForKeys: nil))?.count ?? -1
Expand Down
25 changes: 11 additions & 14 deletions Vienna Tests/ExportTests.swift
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,18 @@ import XCTest

class ExportTests: XCTestCase {

var tempURL: URL!

override func setUpWithError() throws {
try super.setUpWithError()
// Put setup code here. This method is called before the invocation of each test method in the class.

let downloadsDirectory = FileManager.default.downloadsDirectory
tempURL = try FileManager.default.url(for: .itemReplacementDirectory, in: .userDomainMask, appropriateFor: downloadsDirectory, create: true)
}

override func tearDownWithError() throws {
// Put teardown code here. This method is called after the invocation of each test method in the class.
try FileManager.default.removeItem(at: tempURL)

try super.tearDownWithError()
}

Expand All @@ -45,24 +50,16 @@ class ExportTests: XCTestCase {
func testExportWithoutGroups() {
// Test exporting feeds to opml file without groups
let folders = self.foldersArray()
guard let tmpUrl = URL(string: "/tmp/vienna-test-nogroups.opml") else {
XCTAssertTrue(false)
fatalError("cannot happen")
}

let countExported = Export.export(toFile: tmpUrl.absoluteString, from: folders, in: nil, withGroups: false)
let tmpUrl = tempURL.appendingPathComponent("vienna-test-nogroups.opml", isDirectory: false)
let countExported = Export.export(toFile: tmpUrl.path, from: folders, in: nil, withGroups: false)
XCTAssertGreaterThan(countExported, 0, "Pass")
}

func testExportWithGroups() {
// Test exporting feeds to opml file without groups
let folders = self.foldersArray()
guard let tmpUrl = URL(string: "/tmp/vienna-test-groups.opml") else {
XCTAssertTrue(false)
fatalError("cannot happen")
}

let countExported = Export.export(toFile: tmpUrl.absoluteString, from: folders, in: nil, withGroups: true)
let tmpUrl = tempURL.appendingPathComponent("vienna-test-groups.opml", isDirectory: false)
let countExported = Export.export(toFile: tmpUrl.path, from: folders, in: nil, withGroups: true)
XCTAssertGreaterThan(countExported, 0, "Pass")
}

Expand Down
9 changes: 6 additions & 3 deletions Vienna Tests/NSFileManagerExtensionTests.swift
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,14 @@ class NSFileManagerExtensionTests: XCTestCase {

func testApplicationScriptsPath() throws {
let result = FileManager.default.applicationScriptsDirectory
let fullPath = "\(homePath)/Library/Scripts/Applications/Vienna"
let userDirectory = try FileManager.default.url(for: .userDirectory, in: .localDomainMask, appropriateFor: nil, create: false)
.appendingPathComponent(NSUserName(), isDirectory: true)
let bundleID = try XCTUnwrap(bundleID)
let fullPath = "\(userDirectory.path)/Library/Application Scripts/\(bundleID)"
XCTAssertEqual(result.path, fullPath)
}

func testApplicationSupportPath() throws {
func testApplicationSupportPath() {
let result = FileManager.default.applicationSupportDirectory
let fullPath = "\(homePath)/Library/Application Support/Vienna"
XCTAssertEqual(result.path, fullPath)
Expand All @@ -43,7 +46,7 @@ class NSFileManagerExtensionTests: XCTestCase {
XCTAssertEqual(result.path, fullPath)
}

func testDownloadsPath() throws {
func testDownloadsPath() {
let result = FileManager.default.downloadsDirectory
let fullPath = "\(homePath)/Downloads"
XCTAssertEqual(result.path, fullPath)
Expand Down
20 changes: 14 additions & 6 deletions Vienna.xcodeproj/project.pbxproj
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@
F6164C591E32A6660086261C /* DisclosureView.m in Sources */ = {isa = PBXBuildFile; fileRef = F6164C581E32A6660086261C /* DisclosureView.m */; };
F61CEA661F039E57009C878E /* ButtonToolbarItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F61CEA651F039E56009C878E /* ButtonToolbarItem.swift */; };
F61CEA681F03F277009C878E /* PlugInToolbarItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F61CEA671F03F277009C878E /* PlugInToolbarItem.swift */; };
F6209C4423D3B87C00D5537D /* container-migration.plist in Resources */ = {isa = PBXBuildFile; fileRef = F6209C4323D3B87C00D5537D /* container-migration.plist */; };
F6209C5A23D3FFA700D5537D /* Vienna.sdef in Resources */ = {isa = PBXBuildFile; fileRef = F6209C5923D3FFA700D5537D /* Vienna.sdef */; };
F6257FF51E28485F0035E43C /* Downloads.xib in Resources */ = {isa = PBXBuildFile; fileRef = F6257FF71E28485F0035E43C /* Downloads.xib */; };
F625801C1E2853B90035E43C /* ActivityViewer.xib in Resources */ = {isa = PBXBuildFile; fileRef = F625801E1E2853B90035E43C /* ActivityViewer.xib */; };
Expand Down Expand Up @@ -212,6 +213,7 @@
F6B355DB256025D3008CA1ED /* PreferenceTabViewItem.swift in Sources */ = {isa = PBXBuildFile; fileRef = F6B355DA256025D3008CA1ED /* PreferenceTabViewItem.swift */; };
F6B3561525616313008CA1ED /* DownloadItem.m in Sources */ = {isa = PBXBuildFile; fileRef = F6B3561425616313008CA1ED /* DownloadItem.m */; };
F6B7BC3624A2A9A40051D76F /* FMDB in Frameworks */ = {isa = PBXBuildFile; productRef = F6B7BC3524A2A9A40051D76F /* FMDB */; };
F6C9B03A26E6F3E0003C1058 /* undo-container-migration.sh in Copy Shared Support Files */ = {isa = PBXBuildFile; fileRef = F668C10E26886CB6009AD505 /* undo-container-migration.sh */; };
F6C9DA70271BB3BB00FC3027 /* RSSFeed.m in Sources */ = {isa = PBXBuildFile; fileRef = F6C9DA6F271BB3BB00FC3027 /* RSSFeed.m */; };
F6C9DA73271BB55000FC3027 /* AtomFeed.m in Sources */ = {isa = PBXBuildFile; fileRef = F6C9DA72271BB55000FC3027 /* AtomFeed.m */; };
F6CE47131E7E3DCB0045EAD7 /* ActivityItem.m in Sources */ = {isa = PBXBuildFile; fileRef = F6CE47121E7E3DCB0045EAD7 /* ActivityItem.m */; };
Expand Down Expand Up @@ -261,6 +263,7 @@
files = (
B27CD00C1100E728001F3C83 /* Plugins in Copy Shared Support Files */,
AA67F353089728AD008BBC37 /* Styles in Copy Shared Support Files */,
F6C9B03A26E6F3E0003C1058 /* undo-container-migration.sh in Copy Shared Support Files */,
);
name = "Copy Shared Support Files";
runOnlyForDeploymentPostprocessing = 0;
Expand Down Expand Up @@ -350,8 +353,8 @@
3A7BD0DB1989AC7700E9444B /* VNAVerticallyCenteredTextFieldCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VNAVerticallyCenteredTextFieldCell.h; sourceTree = "<group>"; };
3A7BD0DC1989AC7700E9444B /* VNAVerticallyCenteredTextFieldCell.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = VNAVerticallyCenteredTextFieldCell.m; sourceTree = "<group>"; };
3A8D9AE225A9DA4B0016F30F /* ArticleTests.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = ArticleTests.swift; sourceTree = "<group>"; };
3A932D8823BB999A009B8061 /* Vienna.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Vienna.entitlements; sourceTree = "<group>"; };
3A932D8923BB999A009B8061 /* ViennaDeployment.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = ViennaDeployment.entitlements; sourceTree = "<group>"; };
3A932D8823BB999A009B8061 /* Development.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Development.entitlements; sourceTree = "<group>"; };
3A932D8923BB999A009B8061 /* Deployment.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.entitlements; path = Deployment.entitlements; sourceTree = "<group>"; };
3AC411A426BBFDFD004A8700 /* WebKitArticleView.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = WebKitArticleView.swift; sourceTree = "<group>"; };
3ADBA70C23DDAFCA00156722 /* Notarize.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = Notarize.sh; sourceTree = "<group>"; };
430C4ADB1661753F0079C9FC /* autorevision.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = autorevision.h; sourceTree = "<group>"; };
Expand Down Expand Up @@ -511,6 +514,7 @@
F6167E6B209EFE370006E2C4 /* pt */ = {isa = PBXFileReference; lastKnownFileType = text.plist.stringsdict; name = pt; path = pt.lproj/Localizable.stringsdict; sourceTree = "<group>"; };
F61CEA651F039E56009C878E /* ButtonToolbarItem.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; lineEnding = 0; path = ButtonToolbarItem.swift; sourceTree = "<group>"; };
F61CEA671F03F277009C878E /* PlugInToolbarItem.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; lineEnding = 0; path = PlugInToolbarItem.swift; sourceTree = "<group>"; };
F6209C4323D3B87C00D5537D /* container-migration.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "container-migration.plist"; sourceTree = "<group>"; };
F6209C5923D3FFA700D5537D /* Vienna.sdef */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; lineEnding = 0; path = Vienna.sdef; sourceTree = "<group>"; usesTabs = 1; };
F62116A9209EFE9F00FAC2C2 /* uk */ = {isa = PBXFileReference; lastKnownFileType = text.plist.stringsdict; name = uk; path = uk.lproj/Localizable.stringsdict; sourceTree = "<group>"; };
F6257FF61E28485F0035E43C /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/Downloads.xib; sourceTree = "<group>"; };
Expand Down Expand Up @@ -685,6 +689,7 @@
F658FD8D209EFE5100896413 /* ru */ = {isa = PBXFileReference; lastKnownFileType = text.plist.stringsdict; name = ru; path = ru.lproj/Localizable.stringsdict; sourceTree = "<group>"; };
F65F2313294E4B5200605F06 /* SeparatorPredicateEditorRowTemplate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SeparatorPredicateEditorRowTemplate.swift; sourceTree = "<group>"; };
F664A9A2209EFEBF003B0F7D /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.stringsdict; name = "zh-Hans"; path = "zh-Hans.lproj/Localizable.stringsdict"; sourceTree = "<group>"; };
F668C10E26886CB6009AD505 /* undo-container-migration.sh */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; lineEnding = 0; path = "undo-container-migration.sh"; sourceTree = "<group>"; };
F66A7E542A019006002F5D5E /* fr */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = fr; path = fr.lproj/Predicates.strings; sourceTree = "<group>"; };
F672876624A2D20A0043432F /* UpdatePreferencesViewController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UpdatePreferencesViewController.h; sourceTree = "<group>"; };
F672876724A2D2170043432F /* UpdatePreferencesViewController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = UpdatePreferencesViewController.m; sourceTree = "<group>"; };
Expand Down Expand Up @@ -1247,6 +1252,7 @@
F63DA1741F1CF04F007CBED4 /* Lists */,
F63DA1721F1CEFC3007CBED4 /* Strings */,
03F33D951DF2A2F900B04FAF /* Assets.xcassets */,
F6209C4323D3B87C00D5537D /* container-migration.plist */,
F6209C5923D3FFA700D5537D /* Vienna.sdef */,
);
path = Resources;
Expand Down Expand Up @@ -1278,6 +1284,7 @@
children = (
B27CCFFD1100E728001F3C83 /* Plugins */,
AA67F32E089727FB008BBC37 /* Styles */,
F668C10E26886CB6009AD505 /* undo-container-migration.sh */,
);
path = SharedSupport;
sourceTree = "<group>";
Expand Down Expand Up @@ -1408,8 +1415,8 @@
F63DA16E1F1CEC69007CBED4 /* Resources */,
F63DA1751F1CF182007CBED4 /* SharedSupport */,
430C4AE0166175C20079C9FC /* Info.plist */,
3A932D8823BB999A009B8061 /* Vienna.entitlements */,
3A932D8923BB999A009B8061 /* ViennaDeployment.entitlements */,
3A932D8823BB999A009B8061 /* Development.entitlements */,
3A932D8923BB999A009B8061 /* Deployment.entitlements */,
3A6CC18623BBA49D0084ABEE /* Codesigning.xcconfig */,
);
path = Vienna;
Expand Down Expand Up @@ -1827,6 +1834,7 @@
F62580AA1E286A8C0035E43C /* Localizable.strings in Resources */,
F6832F631F10C4C9007920D4 /* ExportAccessoryViewController.xib in Resources */,
AACAEA3E0954E71100ACD502 /* DemoFeeds.plist in Resources */,
F6209C4423D3B87C00D5537D /* container-migration.plist in Resources */,
F65D6D711E74619E00A30974 /* Credits.rtf in Resources */,
F685D24C292460210097C0D3 /* Predicates.strings in Resources */,
F69AE79A1F2215D600342640 /* InfoPlist.strings in Resources */,
Expand Down Expand Up @@ -2941,7 +2949,7 @@
buildSettings = {
APPLY_RULES_IN_COPY_FILES = YES;
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CODE_SIGN_ENTITLEMENTS = Vienna/Vienna.entitlements;
CODE_SIGN_ENTITLEMENTS = Vienna/Development.entitlements;
CODE_SIGN_IDENTITY = "-";
COMBINE_HIDPI_IMAGES = YES;
ENABLE_HARDENED_RUNTIME = YES;
Expand Down Expand Up @@ -2987,7 +2995,7 @@
buildSettings = {
APPLY_RULES_IN_COPY_FILES = YES;
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
CODE_SIGN_ENTITLEMENTS = Vienna/ViennaDeployment.entitlements;
CODE_SIGN_ENTITLEMENTS = Vienna/Deployment.entitlements;
COMBINE_HIDPI_IMAGES = YES;
DEPLOYMENT_POSTPROCESSING = YES;
ENABLE_HARDENED_RUNTIME = YES;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,18 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.automation.apple-events</key>
<true/>
<key>com.apple.security.files.bookmarks.app-scope</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
<array>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,20 @@
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.automation.apple-events</key>
<true/>
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<key>com.apple.security.files.bookmarks.app-scope</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
<array>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>
Expand Down
2 changes: 1 addition & 1 deletion Vienna/Info.plist
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@
<key>SUEnableAutomaticChecks</key>
<true/>
<key>SUEnableInstallerLauncherService</key>
<false/>
<true/>
<key>SUPublicEDKey</key>
<string>nPwwT+poO5Kmi1NZkE5OveKB8lvQVY20N22E8jgxLCg=</string>
<key>UTExportedTypeDeclarations</key>
Expand Down
39 changes: 39 additions & 0 deletions Vienna/Resources/container-migration.plist
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>MigrateScriptsForApplication</key>
<string>Vienna</string>
<key>Move</key>
<array>
<array>
<string>${Caches}/${BundleId}/WebKit</string>
<string>${Caches}/WebKit</string>
</array>
<string>${Caches}/${BundleId}</string>
<array>
<string>${ApplicationSupport}/Vienna/Sources</string>
<string>${Caches}/${BundleId}/Sources</string>
</array>
<string>${ApplicationSupport}/Vienna</string>
<string>${Library}/HTTPStorages/${BundleId}</string>
<array>
<string>${Library}/HTTPStorages/${BundleId}.binarycookies</string>
<string>${Library}/Cookies/Cookies.binarycookies</string>
</array>
<array>
<string>${Library}/Cookies/${BundleId}.binarycookies</string>
<string>${Library}/Cookies/Cookies.binarycookies</string>
</array>
<string>${Library}/Saved Application State/${BundleId}.savedState</string>
<array>
<string>${Library}/WebKit/${BundleId}</string>
<string>${Library}/WebKit</string>
</array>
<array>
<string>${Library}/WebKit/Databases/___IndexedDB/${BundleId}</string>
<string>${Library}/WebKit/Databases/___IndexedDB</string>
</array>
</array>
</dict>
</plist>
Loading

0 comments on commit 929b494

Please sign in to comment.