707636 - Define safe permissions to local DB's ContentProvider to only allow sync to access it

Status: RESOLVED WORKSFORME

(Firefox for Android Graveyard :: General, defect, P4)

Description

[Lucas Rocha (:lucasr)]

Sign both apps with same signature? Granting custom access to Sync app? We need figure out the right/safe way to do it.

Comment 1

[Doug Turner (:dougt)]

we are probably just going to import their code, and build it ourselves.  more info coming and tbd.

Comment 2

[Brad Lassey [:blassey] (use needinfo?)]

Sync will ship with us, no permissions needed

Comment 3

[Richard Newman [:rnewman]]

If we don't have access during development, then shipping becomes a tad bit more difficult!

This should be as simple as adding protectionLevel="signature" to a permission element and marking it as exported, which allows only apps signed with the same signature to access that element, and otherwise forbids access entirely.

  http://developer.android.com/guide/topics/manifest/permission-element.html

Alternatively, please morph this bug into "Share sharedUserId between Native Sync and Native Fennec AndroidManifest.xml files". One or the other must be done, or we can't access the provider from our builds.

Comment 4

[Doug Turner (:dougt)]

or... you could just do your dev in hg/mozilla-central.

Comment 5

[Lucas Rocha (:lucasr)]

Attachment: Use "signature" permissions on BrowserProvider

Comment 6

[Mark Finkle (:mfinkle) (use needinfo?)]

Comment on attachment 580159 [details] [diff] [review]
Use "signature" permissions on BrowserProvider

Is a provider exported="true" by default? Still might add that to be explicit.

Comment 7

[Richard Newman [:rnewman]]

Comment on attachment 580159 [details] [diff] [review]
Use "signature" permissions on BrowserProvider

Review of attachment 580159 [details] [diff] [review]:
-----------------------------------------------------------------

Yes, exported defaults to true. Looks like the right solution according to the docs. f+.

Comment 8

[Lucas Rocha (:lucasr)]

Pushed: http://hg.mozilla.org/mozilla-central/rev/e79b3396889c

Comment 9

[Lucas Rocha (:lucasr)]

Looks like this has been fixed a long time ago. Closing.