Ben Turner (not reading bugmail, use the needinfo flag!) Reporter
	Description • 12 years ago

It looks like the "fmradio" permission is not properly checked. A few problems:

1. In the child process we throw an exception if the fmradio permission isn't granted. Most DOM APIs just return null instead of throwing.

2. The child process communicates with the parent via the message manager, but the parent message manager doesn't ever check the fmradio permission in DOMFMRadioParent.jsm.

3. Once we're in the parent process the HAL security checks are skipped.

	Andrew Overholt [:overholt]
	Comment 1 • 12 years ago

Gregor, Doug said you should be the lucky owner of this bug.  Congrats!  :)

	Andrew Overholt [:overholt]
	Comment 3 • 12 years ago

Setting priority based on triage discussions.  Feel free to decrease priority if you disagree.

	Gregor Wagner [:gwagner] Assignee
	Comment 4 • 12 years ago

There is still one point left: 
3. Once we're in the parent process the HAL security checks are skipped.

bent suggested
a) remove the hal remoting entirely and rely only on messagemanager
b) leave both in place and add additional checks to HalParent

cjones any preferences for this?

	Chris Jones [:cjones] inactive; ni?/f?/r? if you need me
	Comment 5 • 12 years ago

I don't know why we remoted both the hal:: api and the dom api.  At this point, option (1) seems to make more sense, since the hal:: remoting should all be dead code.

	Gregor Wagner [:gwagner] Assignee
	Comment 6 • 12 years ago

(In reply to Chris Jones [:cjones] [:warhammer] from comment #5)
> I don't know why we remoted both the hal:: api and the dom api.  At this
> point, option (1) seems to make more sense, since the hal:: remoting should
> all be dead code.

slee: can you file a followup and fix this?

	StevenLee[:slee]
	Comment 7 • 12 years ago

(In reply to Gregor Wagner [:gwagner] from comment #6)
> (In reply to Chris Jones [:cjones] [:warhammer] from comment #5)
> > I don't know why we remoted both the hal:: api and the dom api.  At this
> > point, option (1) seems to make more sense, since the hal:: remoting should
> > all be dead code.
> 
> slee: can you file a followup and fix this?

Sure, I will file a bug fixing this.

	Gregor Wagner [:gwagner] Assignee
	Comment 8 • 12 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/b298c038c661

	Ryan VanderMeulen [:RyanVM]
	Comment 9 • 12 years ago

https://hg.mozilla.org/mozilla-central/rev/b298c038c661

	Ryan VanderMeulen [:RyanVM]
	Comment 10 • 12 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/89af02e96916
https://hg.mozilla.org/releases/mozilla-beta/rev/51713a1c0b37