Disable ownership on mobile

client/internal/ipcauth/authz_gate.go

@@ -87,6 +87,10 @@ func (g *AuthzGate) resolveLevel(id Identity, target Target) AuthzLevel {
 	if !target.Owned {
 		return AuthzLevelIdentified
 	}
+	// With ownership off, reaching the profile is also reaching its session.
+	if ProfileOwnershipDisabled() {
+		return AuthzLevelSessionHolder
+	}
 	if holder, running := g.st.SessionHolder(); !running || holder.Matches(id) {
 		return AuthzLevelSessionHolder
 	}

client/internal/ipcauth/authz_gate_test.go

@@ -176,6 +176,19 @@ func TestAuthorizeCarriesTheTargetForAPrivilegedCaller(t *testing.T) {
 	assert.Equal(t, "/profiles/abcd1111.json", got)
 }
 
+// With ownership off, somebody else's live session is not a reason to refuse.
+func TestAuthorizeIgnoresAHeldSessionWhenOwnershipDisabled(t *testing.T) {
+	t.Setenv(EnvDisableProfileOwnership, "true")
+	g := gateFor(t, stubState{
+		target:  Target{Path: "/profiles/mine.json", Owned: true},
+		running: true,
+		holder:  Principal{Kind: KindUID, Value: "4242"},
+	})
+
+	_, err := g.authorize(transportCtx(unprivUser, nil), servicePath+"Up", &proto.UpRequest{})
+	assert.NoError(t, err)
+}
+
 func TestAuthorizeBlamesAHeldSession(t *testing.T) {
 	g := gateFor(t, stubState{
 		target:  Target{Path: "/profiles/mine.json", Owned: true},

client/internal/ipcauth/identity.go

@@ -37,9 +37,15 @@ const EnvDisableProfileOwnership = "NB_DISABLE_PROFILE_OWNERSHIP"
 
 var logProfileOwnershipDisabledOrError sync.Once
 
-// defaultProfileClaimDisabled reports whether the environment turns off
-// profile ownership. A ownership check will always return true.
-func isProfileOwnershipDisabled() bool {
+// ProfileOwnershipDisabled reports whether profile ownership is turned off, so
+// every identified caller reaches every profile and controls its session.
+//
+// Mobile records no owners. The app is the only caller and the platform sandbox
+// already isolates one install from another.
+func ProfileOwnershipDisabled() bool {
+	if runtime.GOOS == "android" || runtime.GOOS == "ios" {
+		return true
+	}
 	val := os.Getenv(EnvDisableProfileOwnership)
 	if val == "" {
 		return false
@@ -310,9 +316,6 @@ func looksLikeSID(v string) bool {
 // A principal is a config value, not a caller, so it is never converted into an
 // Identity.
 func (p Principal) Matches(id Identity) bool {
-	if isProfileOwnershipDisabled() {
-		return true
-	}
 	if !id.Known() {
 		return false
 	}