1882985 - [flatpak] Thuderbird can't access hardware security key, preventing MFA login flows from completing

Status: RESOLVED FIXED

(Thunderbird :: Build Config, defect, P2)

Description

[axel simon]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0

Steps to reproduce:

Tried to log in to a Google account with multi-factor / two factor authentication turned on with a hardware security key (solokey, cf. https://bugzilla.mozilla.org/show_bug.cgi?id=1882724)

Actual results:

Nothing, i couldn't confirm security key because Thunderbird couldn't see the key.

Expected results:

Thunderbird should have been able to find the hardware security key connected over USB and interact with it, letting the user do the touch-to-confirm song and dance.

It couldn't because the flatpak on Flathub does not ask for the right permissions by default.
It needs to ask for device=all (or maybe some less wide permission, but device=input didn't work for me).

Comment 1

[Daniel Darnell [:dandarnell]]

Attachment: Bug 1882985 - Grant flatpak device=all permission to fix MFA. r=#thunderbird-build-system-reviewers

Depends on D205475

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/831c210d7f86
Grant flatpak device=all permission to fix MFA. r=rjl DONTBUILD

Comment 3

[Daniel Darnell [:dandarnell]]

Comment on attachment 9393984 [details]
Bug 1882985 - Grant flatpak device=all permission to fix MFA. r=#thunderbird-build-system-reviewers

[Approval Request Comment]
User impact if declined: Broken MFA
Testing completed (on c-c, etc.): on c-c
Risk to taking this patch (and alternatives if risky): low

Comment 4

[Wayne Mery (:wsmwk)]

Comment on attachment 9393984 [details]
Bug 1882985 - Grant flatpak device=all permission to fix MFA. r=#thunderbird-build-system-reviewers

[Triage Comment]
Approved for beta

Comment 5

[Daniel Darnell [:dandarnell]]

Thunderbird 125.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/1138dbaf1ef7