1006051 - implement nsIParentalControlsService on the Mac

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Doug Turner (:dougt)]

The MacOS has Parental Controls.  We should implement nsIParentalControlsService.  
(If we did, networking can send the https prefer safe header)

Stubbed out here:
     https://github.com/dougt/gecko-dev/compare/parental_controls_mac?expand=1


It looks like there isn't a simple API for knowing if an account is 'managed'.  But if you look in `dscl . readall /users`, you can see associated mxc data.  Maybe that is how you go about determining account type.

Comment 1

[Doug Turner (:dougt)]

Attachment: patch v.1

I need to test if this compiles on linux.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

Comment on attachment 8418403 [details] [diff] [review]
patch v.1

This looks fine to me.

But there's one small cause for concern:

+  mEnabled = CFPreferencesAppValueIsForced(CFSTR("restrictWeb"),
+             CFSTR("com.apple.familycontrols.contentfilter"));

After what I admit is only a quick web search, I can't find any doc or code sample that explains/uses the second parameter.  It does sound reasonable.  And you tell me (on IRC) that it's an instance of a "preference domain", and I did find the following quote:

CoreFoundation.CFPreferencesAppValueIsForced(keyName, preferenceDomain)

http://www.mactech.com/articles/mactech/Vol.25/25.08/2508MacEnterprise-SystemFrameworkScripting/index.html

It'd be nice to have a detailed explanation of why this works, and what the alternatives are (if any).  But Apple's docs are notoriously incomplete.  And our main concern is that we have something that "works" -- which I assume this does :-)

Comment 3

[Doug Turner (:dougt)]

MacOS has no parental control apis.  All of this is handled via managed preferences (as near as I can tell).  Child (or restricted accounts) have certain preferences that are applied to their account which they can not change.  If you run the follow command, you can see all of the preferences that are active on our account:

dscl . readall /users


If you create a child account, you'll see these settings in the XML named 'MCXSettings':

879 MCXSettings:
 880  <?xml version="1.0" encoding="UTF-8"?>
 881 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 882 <plist version="1.0">
 883 <dict>
 884         <key>mcx_application_data</key>
 885         <dict>
 886                 <key>com.apple.Dictionary</key>
 887                 <dict>
 888                         <key>Forced</key>
 889                         <array>
 890                                 <dict>
 891                                         <key>mcx_data_timestamp</key>
 892                                         <date>2014-05-05T17:19:55Z</date>
 893                                         <key>mcx_preference_settings</key>
 894                                         <dict>
 895                                                 <key>parentalControl</key>
 896                                                 <true/>
 897                                         </dict>
 898                                 </dict>
 899                         </array>
 900                 </dict>
 901                 <key>com.apple.familycontrols.contentfilter</key>
 902                 <dict>
 903                         <key>Forced</key>
 904                         <array>
 905                                 <dict>
 906                                         <key>mcx_data_timestamp</key>
 907                                         <date>2014-05-05T17:19:55Z</date>
 908                                         <key>mcx_preference_settings</key>
 909                                         <dict>
 910                                                 <key>restrictWeb</key>
 911                                                 <true/>
 912                                                 <key>useContentFilter</key>
 913                                                 <true/>
 914                                         </dict>
 915                                 </dict>
 916                         </array>
 917                 </dict>



You can check for the existence of these preferences by searching for the corresponding domain.  In our case, "com.apple.familycontrols.contentfilter".


It doesn't appear that there is any better way.

Comment 4

[Doug Turner (:dougt)]

https://tbpl.mozilla.org/?tree=Try&rev=b132b3357dff

Comment 5

[Doug Turner (:dougt)]

Attachment: 318a7232650b

smichaud reviewed the mac bits.

This file are some rote changes to make a Default and a Mac implementation.  Ted can you review the build changes?

Comment 6

[(not currently active) Ted Mielczarek]

Comment on attachment 8418579 [details] [diff] [review]
318a7232650b

Review of attachment 8418579 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/components/parentalcontrols/moz.build
@@ +10,5 @@
>  
>  XPIDL_MODULE = 'parentalcontrols'
>  
> +if not CONFIG['MOZ_DISABLE_PARENTAL_CONTROLS']:
> +    if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':

Any reason you switched this from OS_ARCH to MOZ_WIDGET_TOOLKIT? (Probably doesn't matter all that much in reality.)

Comment 7

[Doug Turner (:dougt)]

> Any reason you switched this from OS_ARCH to MOZ_WIDGET_TOOLKIT? (Probably doesn't matter all that much in reality.)

Just to be consistent -- i wanted it to be testing the same thing in each of the if stmts

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7202bd8d3e15

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7202bd8d3e15

Comment 10

[Richard Newman [:rnewman]]

https://hg.mozilla.org/integration/fx-team/rev/0e21ce9682d8

Comment 11

[Richard Newman [:rnewman]]

I landed a tiny follow-up, 'cos I reckon you wanted a WindowContext, not a CocoadowContext. (Spotted in Bug 1042715.)

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0e21ce9682d8