ubuntu-phone team mailing list archive

[Olivier Tilloy <olivier.tilloy@xxxxxxxxxxxxx>]

On Sat, Mar 5, 2016 at 12:37 PM, Peter Bittner <peter.bittner@xxxxxxx> wrote:
> Oli,
>
> 2016-03-05 12:02 GMT+01:00 Oliver Grawert:
>> a missing apparmor block is one thing, but apps that can access
>> hardware without you knowing by prompting at the first access is
>> definitely a critical bug.
>
> No, there is no prompt for microphone access in the web app. In the
> plain browser there is a prompt which says, "Allow this domain access
> the camera and microphone" (the final part even cut off in the German
> translation). BTW, is this a joint permission, or is this request
> combined "manually" in a single dialog for UX reasons?

That prompt comes from the browser (not apparmor/trust-store), and it
is indeed a joint permission, which originates from a call to
MediaDevices.getUserMedia() with both audio and video as constraints
(see https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia
for documentation).
Denying access from that prompt should deny access to both audio and
video. Thanks for filing bug #1553482, we’re looking into it.



> Looks like this is really a (security) bug, because even the plain web
> browser can access the microphone when you deny the permission to
> access camera and microphone. You can try at e.g.
> https://appear.in/test-drive on your Ubuntu phone. I've reported it at
> https://bugs.launchpad.net/ubuntu/+source/webbrowser-app/+bug/1553482
>
> Okay, that's one thing. Now, what about the web app? How can I make
> the permission dialog pop up in the web app?

See my answer on https://launchpad.net/bugs/1554202.