1269292 - Add ability to disallow users to enable/disable addons

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, defect)

Description

[YUKI "Piro" Hiroshi]

For enterprise use, specific addons are always required to be activated. MCD (Mission Control Desktop) can disallow to install addons by `lockPref("xpinstall.enabled", false);` directive, but it doesn't prevent changing enabled/disabled state of addons by the user. Currently we can do it by disabling the addon manager itself by userChrome.css and others, but after XUL is ended we need something to alter it.

This is similar to the bug 1269288 but different.

Comment 1

[YUKI "Piro" Hiroshi]

A sample plan of the API is here:

chrome.extensions.lock() // disallow to install/uninstall/enable/disable addons
chrome.extensions.unlock() // allow to install/uninstall/enable/disable addons

The subject says that about enabling/disabling, but the main demand of this API is for enterprise use. The list of active addons should be locked completely in such usecase.

Because the administrator restrict operations only by the user, the method can have an optional parameter to control the level of restriction: by the user, or by anyone (other addons, via APIs).

This API should require special permissions.

Comment 2

[YUKI "Piro" Hiroshi]

APIs to control addons by an addon is proposed at the bug 1269288

Comment 3

[Andy McKay]

We don't plan on this API in WebExtensions. Moving over to Firefox to see if that's something that would happen through configuration of other means.

Comment 4

[Andrew Swan [:aswan]]

Doing this in the Add-ons Manager would be simple enough, but to what would we expose this API?  Webextensions has already refused (and would have an interesting chicken-and-egg problem if it was to be implemented there...)
Mike, any thoughts?

Comment 5

[Mike Kaply [:mkaply]]

If it were me, I would do a preference whitelist and a preference blacklist (based on IDs), and then I would only honor that preference if it was locked (implying it was set by a system administrator).

That would be pretty straightforward - check if a given ID is in the list of allowed/disallowed IDs, and if so enable/disable it always.

Comment 6

[Shane Caraveo (:mixedpuppy)]

Removing from webextensions-additional-apis, this belongs in some kind of policy system.

Comment 7

[YUKI "Piro" Hiroshi]

I think this is covered by the policy "BlockAboutAddons":true, because we need to access to the addon manager to enable/disable addons.