1416898 - Firefox can be updated by non-administrators without an administrator password

Status: RESOLVED INVALID

(Toolkit :: Application Update, defect)

Description

[u579149]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:56.0) Gecko/20100101 Firefox/56.0
Build ID: 20171024165158

Steps to reproduce:

A user without administrator access opened Firefox. The "automatically install updates" option was turned on (as is default).


Actual results:

Firefox automatically updated to the latest version without requiring an administrator password.


Expected results:

No user should be able to update Firefox without administrator permission and password.

Comment 1

[Molly Howell (she/her) (mostly inactive)]

This is by design; it's the function of the Mozilla Maintenance Service. Please see this support page:

https://support.mozilla.org/en-US/kb/what-mozilla-maintenance-service

where you'll find an explanation and instructions for how to disable or uninstall the service, if this behavior isn't something you want.

Comment 2

[u579149]

This problem occurred on a MacBook running Mac OS version 10.12.6. Mozilla Maintenance Service applies to Windows only, according the linked article.

Comment 3

[Molly Howell (she/her) (mostly inactive)]

Oh, sorry, I overlooked the platform in your user agent there.

Can you check the permissions on the contents of Firefox.app? If the non-administrator user doesn't have write permissions there, then there should indeed have been a prompt for admin credentials.

Comment 4

[u579149]

Thanks for the quick reply. I'm going to call the non-administrator account "Fred", to make things easier.

Interestingly, Fred had read and write permissions, as did Admin. I've removed the errant permission for Fred, which should probably prevent this from happening again.

Any ideas how Fred got write permission on Firefox? I've only ever used the official Firefox installation packages.

I wonder if it is possible that I did an installation when logged in as Fred, entering an administrator password to perform the installation. And then somehow the permissions on Firefox remained read/write for Fred? I'm not sure that's what happened, just throwing it out as a theory. Even in that case though, I wouldn't expect Fred to retain write permission after the installation was finished.

Comment 5

[Molly Howell (she/her) (mostly inactive)]

I'm not a Mac expert (as you can probably guess by my quick assumption of Windows), but from skimming some of the older bugs around Mac permissions and updates, it looks like we've seen cases where an OS update has altered the permissions in the app bundle, so I suppose that could have happened at some point. The updater does also touch those permissions of course, but only ever to limit write access to the admin group.

Closing this bug again, since it looks like the updater was behaving as intended.