1090137 - Add moz-bluetooth permission for Loop application

Status: RESOLVED DUPLICATE of bug 1091417

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Add moz-bluetooth permission

Comment 1

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

See also:
Bug 1087463 - [Loop] FirfoxHello VT call is not routing to BT headset

Comment 2

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

See also:
Bug 1088068 - Trusted hosted apps and AVRCP

Comment 3

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Previous discussion with Paul:
1. If the THA gets hacked they get access to all of bluetooth. Given what we expose to THA already, I’m not _super_ worried but its is additional attack surface.
THA can already get all your data anyways via deviceStorage. But just be aware of that. 
2. The THA app would need to be very careful not to interfere with Gaia here.
If we do want to expose it, then I would suggest we do something like loop, i.e. prefix the exposed permission with moz- so regular privileged apps can’t get the permission.

Comment 4

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Given the fact, Loop application needs to have bluetooth permission to establish Bluetooth SCO connection, we need to have ALLOW_ACTION permission for privilege apps. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1087463#c4

Comment 5

[Tony Chung [:tchung]]

Is this bug a dupe of 1087483?

Comment 6

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Tony Chung [:tchung] from comment #5)
> Is this bug a dupe of 1087483?

I cannot access bug 1087483. I'm not authorized to access bug #1087483.

Comment 7

[Tony Chung [:tchung]]

typo. i meant bug 1087463.

Comment 8

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Tony Chung [:tchung] from comment #7)
> typo. i meant bug 1087463.
Not a dupe, but depends on this bug.
Because Loop application still needs to call |ConnectSco| function in their application. Loop application needs moz-bluetooth permission to access those Certified only Bluetooth APIs.

Comment 9

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Attachment: Bug 1090137 - Add moz-bluetooth permission for THA/Loop application

Comment 10

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Comment on attachment 8513238 [details] [diff] [review]
Bug 1090137 - Add moz-bluetooth permission for THA/Loop application

I would suggest that we create a separate permission for THA. Exposing all of bluetooth to Loop is a bit of a risk, its only one app, and its at least privileged (static & protected by CSP), and we review the source.

Since THA apps have a different risk profile, and only need AVRCP, maybe we should probably try to minimise the risk by creating a separate, more restrictive permission for them?

Comment 11

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Attachment: Bug 1090137 - Add moz-bluetooth permission for Loop application

Comment 12

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Paul Theriault [:pauljt] from comment #10)
> Comment on attachment 8513238 [details] [diff] [review]
> Bug 1090137 - Add moz-bluetooth permission for THA/Loop application
> 
> I would suggest that we create a separate permission for THA. Exposing all
> of bluetooth to Loop is a bit of a risk, its only one app, and its at least
> privileged (static & protected by CSP), and we review the source.
> 
> Since THA apps have a different risk profile, and only need AVRCP, maybe we
> should probably try to minimise the risk by creating a separate, more
> restrictive permission for them?

Paul, thanks for your comments. I think for THA, I probably open another bug. This bug will focus on Loop application.

Comment 13

[bhavana bajaj [:bajaj]]

Blockign on this given we need it for https://bugzilla.mozilla.org/show_bug.cgi?id=1087463

Comment 14

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 8513283 [details] [diff] [review]
Bug 1090137 - Add moz-bluetooth permission for Loop application

Review of attachment 8513283 [details] [diff] [review]:
-----------------------------------------------------------------

This is fine with me, but I think paul should review.

I'm also not sure what's involved with getting marketplace to add this permission to the list of permissions that they review for.

It seems very unfortunate that Loop needs to access bluetooth in order to get the audio routed correctly. That seems like something we should just do automatically. But that's of course way too late to do for both 2.0 and 2.1.

Comment 15

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Jonas Sicking (:sicking) from comment #14)
> Comment on attachment 8513283 [details] [diff] [review]
> Bug 1090137 - Add moz-bluetooth permission for Loop application
> 
> Review of attachment 8513283 [details] [diff] [review]:
> -----------------------------------------------------------------
> It seems very unfortunate that Loop needs to access bluetooth in order to
> get the audio routed correctly. That seems like something we should just do
> automatically. But that's of course way too late to do for both 2.0 and 2.1.
I opened a bug for long-term solution. See Bug 1091417 in detail.

Comment 16

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

See Bug 1087463, is it possible to defer BT SCO API to v2.2?

Comment 17

[Maria Angeles Oteo (:oteo)]

(In reply to Shawn Huang [:shawnjohnjr] from comment #16)
> See Bug 1087463, is it possible to defer BT SCO API to v2.2?

I agree, nominating to 2.2