801704 - Remove permission checks and use the mozPermissionSettings instead

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia, defect, P1)

Description

[[:fabrice] Fabrice Desré]

Currently Gaia does some permission checks just by looking for permissions in the manifests. This does not take into account the privilege level of the app so any app asking for a permission gets it.

I think that's pretty bad.

Comment 1

[Daniel Veditz [:dveditz]]

Isn't this part of the security model in the process of being implemented? This could be a known problem filed elsewhere. But if it's not, yeah, it needs to be fixed.

Comment 2

[Etienne Segonzac (:etienne)]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> Isn't this part of the security model in the process of being implemented?
> This could be a known problem filed elsewhere. But if it's not, yeah, it
> needs to be fixed.

It's really gaia specific I don't think it's linked to anything else.

BTW, ff nobody comes first I'll probably get to it early next week.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Gaia should never do permission checks.  That's like one criminal frisking another criminal.

What's this being done for?

Comment 4

[Etienne Segonzac (:etienne)]

(In reply to Chris Jones [:cjones] [:warhammer] from comment #3)
> Gaia should never do permission checks.  That's like one criminal frisking
> another criminal.
> 
> What's this being done for?

Attention screen and background services, your favorites Gaia hacks :)

So yep, it's a matter of making the sms app use system messages (which apparently isn't going to happen for v1 :/) and moving the attention screen permission check in gecko.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(In reply to Etienne Segonzac (:etienne) from comment #4)
> So yep, it's a matter of making the sms app use system messages (which
> apparently isn't going to happen for v1 :/)

Erm, that's news to me!  But let's carry on that discussion elsewhere.

Comment 6

[Etienne Segonzac (:etienne)]

Attachment: Patch proposal

Comment 7

[Etienne Segonzac (:etienne)]

https://github.com/mozilla-b2g/gaia/pull/6002