1781122 - Implement setPreventsCapture support for DRM video on Mac

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, enhancement)

Description

[Jim Mathies [:jimm]]

There's a newer capture related call introduced in 10.15 we should set on video layers when content capture is active.

https://source.chromium.org/chromium/chromium/src/+/main:ui/accelerated_widget_mac/ca_renderer_layer_tree.mm;drc=a3d665ee5b870abe22cce8ce2eef0abcd38025b5;l=1189

Not sure if this would fall under graphics or media.

Comment 1

[Jim Mathies [:jimm]]

Hey Brad, trying to find someone to look at this. Chrome implemented this a while back on new versions of the OS. This might fall on media team, not sure. Curious if you have any thoughts.

Comment 2

[Brad Werth [:bradwerth] | Out until Feb 2025]

(In reply to Jim Mathies [:jimm] from comment #1)

Hey Brad, trying to find someone to look at this. Chrome implemented this a while back on new versions of the OS. This might fall on media team, not sure. Curious if you have any thoughts.

Yeah, we can set that property on AVSampleBufferDisplayLayer. We use that layer when the gfx.core-animation.specialize-video pref is set, which it is now for all Apple Silicon since Bug 1772024 landed. Bug 1747999 is the blocker that keeps us from turning it on for Intel macOS. Anyway, in time, all our video will use this layer and we can start using its DRM-preserving capabilities now.

I'll build a patch that sets the DRM-appropriate flag in this layer when needed.

Comment 3

[Brad Werth [:bradwerth] | Out until Feb 2025]

(In reply to Jim Mathies [:jimm] from comment #0)

Not sure if this would fall under graphics or media.

Because of the WebRender pipeline, this DRM flag will probably have to pass through to RenderTextureHost which makes it a graphics issue. Actually setting the flag on the layer is trivial.

Comment 4

[Brad Werth [:bradwerth] | Out until Feb 2025]

Looks like this will be a 3-step process:

1. Annotate the video at the decoder level (in the VideoInfo structure?) that it comes from a DRM source. I'm surprised this isn't already available. It's possible that TrackInfo::mCrypto::IsEncrypted() signifies this.
2. Propagate that information through WebRender so that the video texture is annotated with DRM-ness as it emerges from WebRender and is sent to the compositor as a native texture. This will be tricky and will require touching a lot of code in small ways.
3. When the compositor displays the native texture, check the DRM flag and set the property on the video layer. This is the easy part.

Comment 5

[Brad Werth [:bradwerth] | Out until Feb 2025]

(Edited) I was mistaken. Firefox does not black out Netflix content, currently.

Interestingly, when testing this with Netflix content in a window, I found that the macOS Capture tool already blacks-out the video portion of the captured region. I'm not sure what mechanism accomplishes this. YouTube can be captured normally.

Comment 6

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: Bug 1781122 Part 1: Make ChromiumCDMParent mark its Images as DRM.

This also modifies Image to track whether or not it is from a DRM source.
Later parts of the patch move this characteristic into the textures that
are used by compositors.

Comment 7

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: Bug 1781122 Part 2: Make TextureHost aware of DRM Images, and set this on macOS.

At point of display, we need the TextureHost to know whether or not its
texture was created from a DRM Image. The throughline of data is:

Image -> TextureClient -> TextureHost

The TextureClient is generated by the Image, so it has access to the DRM
state of the Image, but the TextureHost is built from the raw texture data
and from TextureFlags. This patch updates TextureFlags to include a
DRM_SOURCE bit for use by the TextureHost.

The TextureClient and TextureHost are platform-specific classes. The
creation of the TextureClient by the Image is done in a platform-specific
subclass of Image. This patch only implements this pipeline for macOS.
There doesn't seem to be a way to do this in cross-platform classes, but
other platforms can follow the pattern used here.

Depends on D155295

Comment 8

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: Bug 1781122 Part 3: Make macOS video layers prevent capture when TextureHost is DRM.

Depends on D155296

Comment 9

[Brad Werth [:bradwerth] | Out until Feb 2025]

Attachment: WIP: Bug 1781122 Part 4: Add a test of canvas capture.

This creates a new test for checking that we black out canvas capture of
EME content. The existing test, test_eme_canvas_blocked, tests a lot of
EME content and is disabled on various platforms for incompatibility with
certain EME features. This uses a much shorter lists of video-only
encrypted media and will pass on more platforms.

Comment 10

[Brad Werth [:bradwerth] | Out until Feb 2025]

I didn't realize that we already had an established canvas snapshot protection mechanism which is tested by (test_eme_canvas_blocked.html)[https://searchfox.org/mozilla-central/source/dom/media/test/test_eme_canvas_blocked.html). I assume that doesn't protect against OS screenshot tools, which is why this Bug exists. Alastor, is that correct? If so, do you have any advice on how to construct a test that exercises something like an OS-based screenshot?

Comment 11

[Alastor Wu [:alwu]]

Yes, that is what I understand as well. We prohibit stream capturing for encrypted content, but there is no way for a media element against OS level screen shot.

I don't know much about screenshot. I found some codes which seem related with screenshot, but not sure if they are also implemented based on canvas.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6fa7ede8ee41
Part 1: Make ChromiumCDMParent mark its Images as DRM. r=media-playback-reviewers,gfx-reviewers,alwu,sotaro
https://hg.mozilla.org/integration/autoland/rev/26f3e8647964
Part 2: Make TextureHost aware of DRM Images, and set this on macOS. r=gfx-reviewers,sotaro
https://hg.mozilla.org/integration/autoland/rev/7e2decd8cf2c
Part 3: Make macOS video layers prevent capture when TextureHost is DRM. r=mstange

Comment 13

[Cristina Cozmuta (:CrissCozmuta)]

https://hg.mozilla.org/mozilla-central/rev/6fa7ede8ee41
https://hg.mozilla.org/mozilla-central/rev/26f3e8647964
https://hg.mozilla.org/mozilla-central/rev/7e2decd8cf2c