55 lines
4.9 KiB
ReStructuredText
55 lines
4.9 KiB
ReStructuredText
Remote Permissions
|
|
==================
|
|
|
|
The remote permission service offers a simple way to set default permissions
|
|
through `remote settings
|
|
<https://remote-settings.readthedocs.io/en/latest/introduction.html>`__. For a
|
|
general introduction to the permission system, see the :doc:`permission manager
|
|
documentation <manager>`.
|
|
|
|
This mechanism is only meant to be used in combination with permissions that
|
|
control exceptions for web compatibility. For example, remote permissions are
|
|
used to set permissions of type ``https-only-load-insecure``, allowing
|
|
HTTPS-First exceptions to be set through remote settings if a site is known to
|
|
be broken with HTTPS-First. A bad example of remote permission would be using
|
|
them to set permissions of the type ``uitour``. Permissions of that type grant
|
|
sites access to a set of special APIs. These kinds of permissions should be set
|
|
directly in source at `browser/app/permissions
|
|
<https://searchfox.org/mozilla-central/source/browser/app/permissions>`__.
|
|
|
|
To limit the types of permissions that are allowed to be set through remote
|
|
settings, the permission types that are allowed to be set through remote
|
|
permissions are specified `in-source
|
|
<https://searchfox.org/mozilla-central/source/extensions/permissions/RemotePermissionService.sys.mjs#:~:text=ALLOWED_PERMISSION_VALUES>`__.
|
|
Both updating this allowlist, and adding new remote permissions requires a
|
|
review.
|
|
|
|
Implementing an exception list with remote permissions
|
|
----------------------------------------------------------------
|
|
|
|
If you want to set up a new site exception list for your feature with remote
|
|
permissions, you can roughly follow these steps:
|
|
|
|
1. If it doesn't exist already: Choose a new permission type and set up code
|
|
that checks for that permission type (for example, using the permission
|
|
manager's `testExactPermissionFromPrincipal
|
|
<manager.html#testexactpermissionfromprincipal>`__ method).
|
|
2. File bug in `Core :: Permission Manager
|
|
<https://bugzilla.mozilla.org/enter_bug.cgi?assigned_to=nobody%40mozilla.org&blocked=remote-permissions&bug_ignored=0&bug_severity=--&bug_status=NEW&bug_type=task&cc=emz%40mozilla.com&cc=maltejur%40mozilla.com&cf_a11y_review_project_flag=---&cf_accessibility_severity=---&cf_fx_iteration=---&cf_fx_points=---&cf_has_str=---&cf_performance_impact=---&cf_status_firefox134=---&cf_status_firefox135=---&cf_status_firefox136=---&cf_status_firefox_esr115=---&cf_status_firefox_esr128=---&cf_status_thunderbird_esr115=---&cf_status_thunderbird_esr128=---&cf_tracking_firefox134=---&cf_tracking_firefox135=---&cf_tracking_firefox136=---&cf_tracking_firefox_esr115=---&cf_tracking_firefox_esr128=---&cf_tracking_firefox_relnote=---&cf_tracking_thunderbird_esr115=---&cf_tracking_thunderbird_esr128=---&cf_webcompat_priority=---&cf_webcompat_score=---&comment=_Remote%20permission%20changes%20for%20this%20permission%20type%20should%20be%20requested%20in%20bugs%20blocking%20this%20bug%20or%20documented%20in%20comments%20on%20this%20bug._%0D%0A%0D%0A_Patches%20updating%20the%20in-source%20allowlist%20should%20be%20attached%20directly%20to%20this%20bug._&component=Permission%20Manager&contenttypemethod=list&contenttypeselection=text%2Fplain&defined_cc=emz%40mozilla.com%2C%20maltejur%40mozilla.com&defined_groups=1&filed_via=standard_form&flag_type-203=X&flag_type-37=X&flag_type-41=X&flag_type-607=X&flag_type-721=X&flag_type-737=X&flag_type-787=X&flag_type-799=X&flag_type-803=X&flag_type-846=X&flag_type-855=X&flag_type-863=X&flag_type-864=X&flag_type-930=X&flag_type-936=X&flag_type-937=X&flag_type-963=X&flag_type-967=X&keywords=leave-open%2Cmeta%2C%20&needinfo_role=other&needinfo_type=needinfo_from&op_sys=Unspecified&priority=--&product=Core&rep_platform=Unspecified&short_desc=%5Bmeta%5D%20Remote%20Permissions%20for%20permission%20type%20%27%3Cpermission%20name%3E%27&target_milestone=---&version=unspecified>`__
|
|
and attach a patch updating ``ALLOWED_PERMISSION_VALUES`` in
|
|
`extensions/permissions/RemotePermissionService.sys.mjs
|
|
<https://searchfox.org/mozilla-central/source/extensions/permissions/RemotePermissionService.sys.mjs#:~:text=ALLOWED_PERMISSION_VALUES>`__
|
|
to include your new permission.
|
|
3. For each change to your specific remote permissions, open a bug blocking the
|
|
bug you filed in the step above to request your changes to be added to remote
|
|
settings
|
|
4. (Optional) If you expect to regularly make updates to the remote permission
|
|
collection, you can also file a bug in `Infrastructure & Operations ::
|
|
Corporate VPN: ACL requests
|
|
<https://bugzilla.mozilla.org/enter_bug.cgi?product=Infrastructure%20%26%20Operations&component=Corporate%20VPN%3A%20ACL%20requests>`__
|
|
requesting direct access to the `remote settings admin UI
|
|
<https://remote-settings.readthedocs.io/en/latest/getting-started.html>`__
|
|
and the ``remote-permissions`` collection. With that, you can request your
|
|
changes directly in the remote settings admin UI. For transparency reasons,
|
|
we still ask you though to document the changes you make in the bug you filed
|
|
in step 2.
|