From 68319a1bd13ad908282bc826f7ddd8e3b3f4d716 Mon Sep 17 00:00:00 2001
From: Dan Murphy <[email protected]>
Date: Tue, 19 May 2026 14:30:43 -0700
Subject: [PATCH] [App Shims] Fix PartitionAlloc hardening

The macOS app-shim process is unsandboxed but handles potentially
untrusted data from renderer IPCs. It currently defers PartitionAlloc
reconfiguration during startup but fails to trigger it once the feature
list is synchronized from the browser process.

This CL reconfigures PartitionAlloc with the finalized feature list and
after task runner initialization in the app-shim process, enabling
critical security mitigations like MiraclePtr.

TAG=agy
CONV=8977e4bf-b9d9-420d-9949-74c078d57ae2

Bug: 513333529, b:514441158
Include-Ci-Only-Tests: true
Change-Id: I39bb44a20fc70886747b227ef1220216668a7fed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858091
Reviewed-by: Marijn Kruisselbrink <[email protected]>
Commit-Queue: Daniel Murphy <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633117}
---

diff --git a/chrome/app_shim/app_shim_controller.mm b/chrome/app_shim/app_shim_controller.mm
index 2414e3b..882808b9 100644
--- a/chrome/app_shim/app_shim_controller.mm
+++ b/chrome/app_shim/app_shim_controller.mm
@@ -9,6 +9,7 @@
 
 #include <utility>
 
+#include "base/allocator/partition_alloc_support.h"
 #include "base/apple/bundle_locations.h"
 #include "base/apple/foundation_util.h"
 #include "base/apple/mach_logging.h"
@@ -691,7 +692,17 @@
   // Finalize feature state and finish up initialization that was deferred for
   // feature state to be fully setup.
   FinalizeFeatureState(feature_state, params_.io_thread_runner);
+
+  // Reconfigure PartitionAlloc with the finalized feature list.
+  base::allocator::PartitionAllocSupport::Get()
+      ->ReconfigureAfterFeatureListInit(switches::kAppShim);
+
   base::ThreadPoolInstance::Get()->StartWithDefaultParams();
+
+  // Reconfigure PartitionAlloc after task runner / ThreadPool initialization.
+  base::allocator::PartitionAllocSupport::Get()->ReconfigureAfterTaskRunnerInit(
+      switches::kAppShim);
+
   SetUpMenu();
 
   if (result != chrome::mojom::AppShimLaunchResult::kSuccess) {
diff --git a/chrome/app_shim/app_shim_controller_browsertest.mm b/chrome/app_shim/app_shim_controller_browsertest.mm
index 682a32892..7b16220 100644
--- a/chrome/app_shim/app_shim_controller_browsertest.mm
+++ b/chrome/app_shim/app_shim_controller_browsertest.mm
@@ -41,6 +41,8 @@
 #include "components/webapps/common/web_app_id.h"
 #include "content/public/test/browser_test.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "partition_alloc/buildflags.h"
+#include "partition_alloc/partition_address_space.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/multiprocess_func_list.h"
 #include "url/gurl.h"
@@ -159,6 +161,12 @@
     base::ReadFileToString(log_file, &log_string);
     std::vector<std::string> log = base::SplitString(
         log_string, "\n", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+    const char* expected_brp_log =
+#if PA_BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT)
+        "BRP Enabled: 1";
+#else
+        "BRP Enabled: N/A (BRP not supported)";
+#endif
     EXPECT_THAT(log, testing::ElementsAre(
                          "Shim Started",
                          base::StringPrintf(
@@ -168,6 +176,7 @@
                          base::StringPrintf(
                              "Final Trial Group: %s",
                              variations::HashNameAsHexString(kTrialGroup2Name)),
+                         expected_brp_log,
                          "Window Created: NativeWidgetMacOverlayNSWindow"));
 
     // If the test failed, it can be hard to debug why without getting output
@@ -269,6 +278,15 @@
         if ([window isKindOfClass:[BrowserNativeWidgetWindow class]]) {
           log(base::StringPrintf("Final Trial Group: %s",
                                  GetActiveGroupForTestTrial()));
+#if PA_BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT)
+          void* p = malloc(64);
+          bool in_brp = partition_alloc::IsManagedByPartitionAllocBRPPool(
+              reinterpret_cast<uintptr_t>(p));
+          free(p);
+          log(base::StringPrintf("BRP Enabled: %d", in_brp));
+#else
+          log("BRP Enabled: N/A (BRP not supported)");
+#endif
           [window performClose:nil];
         }
       }));

diff --git a/chrome/app_shim/app_shim_controller_browsertest.mm b/chrome/app_shim/app_shim_controller_browsertest.mm
index 682a32892..7b16220 100644
--- a/chrome/app_shim/app_shim_controller_browsertest.mm
+++ b/chrome/app_shim/app_shim_controller_browsertest.mm
@@ -41,6 +41,8 @@
 #include "components/webapps/common/web_app_id.h"
 #include "content/public/test/browser_test.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "partition_alloc/buildflags.h"
+#include "partition_alloc/partition_address_space.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/multiprocess_func_list.h"
 #include "url/gurl.h"
@@ -159,6 +161,12 @@
     base::ReadFileToString(log_file, &log_string);
     std::vector<std::string> log = base::SplitString(
         log_string, "\n", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+    const char* expected_brp_log =
+#if PA_BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT)
+        "BRP Enabled: 1";
+#else
+        "BRP Enabled: N/A (BRP not supported)";
+#endif
     EXPECT_THAT(log, testing::ElementsAre(
                          "Shim Started",
                          base::StringPrintf(
@@ -168,6 +176,7 @@
                          base::StringPrintf(
                              "Final Trial Group: %s",
                              variations::HashNameAsHexString(kTrialGroup2Name)),
+                         expected_brp_log,
                          "Window Created: NativeWidgetMacOverlayNSWindow"));
 
     // If the test failed, it can be hard to debug why without getting output
@@ -269,6 +278,15 @@
         if ([window isKindOfClass:[BrowserNativeWidgetWindow class]]) {
           log(base::StringPrintf("Final Trial Group: %s",
                                  GetActiveGroupForTestTrial()));
+#if PA_BUILDFLAG(ENABLE_BACKUP_REF_PTR_SUPPORT)
+          void* p = malloc(64);
+          bool in_brp = partition_alloc::IsManagedByPartitionAllocBRPPool(
+              reinterpret_cast<uintptr_t>(p));
+          free(p);
+          log(base::StringPrintf("BRP Enabled: %d", in_brp));
+#else
+          log("BRP Enabled: N/A (BRP not supported)");
+#endif
           [window performClose:nil];
         }
       }));