HERE conditions cannot be loaded

[Víctor R. Ruiz]

After the latest confinement upgrade to webbrowser-app, HERE terms and conditions are no longer accessible.

Test case.
- Flash the phone.
- Finish the setup wizard.
- Finish gesture tutorial.
- Open location indicator.
- Tap on "Read HERE terms and conditions".

Expected result.
- Webbrowser app is launched and T&C file is loaded and displayed.

Actual result.
- Webbrowser app cannot read local files, T&C file gives an error.

[Jean-Baptiste Lallement (jibel)]

I think that the browser cannot access this file now that it is confined.

[Olivier Tilloy (osomon)]

Indeed, that is a regression, something we overlooked when testing confinement of the browser.
With the confinement, browsing anywhere on the filesystem (file:// URLs) is forbidden. Not sure whether we can easily add an exception to the apparmor profile for that one file (which by the way is localized, so it’s not actually just one file, we’d need a wildcard exception for file:///custom/vendor/here/location-provider-consent/*.html), and if it’s desirable at all from a security standpoint.
Is the expectation that these TOS have to be available offline? Or is it ok to point users to the same page online, with an http:// link?

[Jean-Baptiste Lallement (jibel)]

Some else should confirm but I think it is expected to be available offline since you can use the service with network connection and the TOS are also available during the wizard where the Wifi connection is not necessarily up.

[Tyler Hicks (tyhicks)]

As long as these terms and conditions html files are under our control (meaning that Canonical provides them in the system image) and the terms and conditions html files are the only files in the location-provider-consent directory, adding a rule such as this to the profile should be no problem:

  /custom/vendor/here/location-provider-consent/*.html r,