1036423 - Reintroduce "permissions" permission.

Status: RESOLVED FIXED

(Firefox OS Graveyard :: FindMyDevice, defect)

Description

[Guilherme Gonçalves [:ggp]]

Bug 1032903 removed the "permissions" permission from FMD. As it turns out, this permission controls access to the mozPermissionSettings API, which is needed by the track command. We need to reintroduce the permission, and "track" will be broken until we do.

Comment 1

[Guilherme Gonçalves [:ggp]]

Attachment: gaia pull request

Sorry for overlooking this, here's a patch.

Comment 2

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Looks good on gaia-try[1], merging.

Master: https://github.com/mozilla-b2g/gaia/commit/bc59445675c1cadefdd9d6b2db185aca7b2f099d

[1] https://tbpl.mozilla.org/?rev=a00a82bb082927d43f3f0a7a3059560705142c8f&tree=Gaia-Try

Comment 3

[Ryan VanderMeulen [:RyanVM]]

v2.0: https://github.com/mozilla-b2g/gaia/commit/6af4a6a5d0b5b420c59cf5c856cd5a13ee35aac9

Comment 4

[Gregor Wagner [:gwagner]]

How come this doesn't have a proper security and webapi review? The 'permission' permission is probably the API that can cause the most damage for the user.

Comment 5

[Guilherme Gonçalves [:ggp]]

This bug is just about restoring a permission that was accidentally removed in another patch, so I assume you are questioning its introduction in the first place. The 'permission' permission was added back in bug 938901, when FMD first landed on Gaia after being reviewed by a module owner. FMD has since gone through a client-side security review (bug 938357) as well, but no issues related to permissions were raised.

If there was any other review procedure we should have followed, for either this bug or bug 938901, I wasn't aware of it, and I apologize. Please let me know what we can do about it, and I'll make sure this doesn't happen again.

Comment 6

[Gregor Wagner [:gwagner]]

(In reply to Guilherme Gonçalves [:ggp] from comment #5)
> This bug is just about restoring a permission that was accidentally removed
> in another patch, so I assume you are questioning its introduction in the
> first place. The 'permission' permission was added back in bug 938901, when
> FMD first landed on Gaia after being reviewed by a module owner. FMD has
> since gone through a client-side security review (bug 938357) as well, but
> no issues related to permissions were raised.
> 
> If there was any other review procedure we should have followed, for either
> this bug or bug 938901, I wasn't aware of it, and I apologize. Please let me
> know what we can do about it, and I'll make sure this doesn't happen again.

Using the permission API for this use-case is pretty big overkill. We should rather fix it in another way. I talked to Jonas about this and the easiest fix is to introduce a geolocation-noprompt permission.

Comment 7

[Guilherme Gonçalves [:ggp]]

Fair enough, I filed bug 1058330 for the FMD changes.

Comment 8

[Shine(Leave from Mozilla)]

Dear Guilherme,
Could you please provide a repro video or steps, thanks!

Comment 9

[Guilherme Gonçalves [:ggp]]

This change ended up being reverted by bug 1058330, in which we replaced the 'permissions' permission with 'geolocation-noprompt'. Verifying this only requires making sure that FMD manages to track a device successfully without triggering the geolocation permission prompt.