WebAPI/Security/PermissionsAPI

Permission API

Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=707625
Brief purpose of API: Allow an app to manage app permissions in a centralized location
General Use Cases: None
Inherent threats: Change security and privacy permissions, potentially leading to device compromise
Threat severity: Critical

Regular web content (unauthenticated)

• Use cases for unauthenticated code:None
• Authorization model for normal content: None
• Authorization model for installed content: None
• Potential mitigations:

Trusted (authenticated by publisher)

• Use cases for authenticated code: None
• Use cases for trusted code: None
• Potential mitigations:

Certified (vouched for by trusted 3rd party)

• Use cases for certified code: Centralized permissions management app; modify per-app settings
• Authorization model: Implicit
• Potential mitigations: None

Note: We are not exposing permission settings to non-certified apps. Apps cannot determine their current settings without actually requesting a permission.