1433168 - Figure out what to do with Policies when Firefox is uninstalled

Status: RESOLVED WORKSFORME

(Firefox :: Enterprise Policies, enhancement)

Description

[:Felipe Gomes (needinfo for replies!)]

On https://bugzilla.mozilla.org/show_bug.cgi?id=1426362#c1 there was a comment saying that uninstalling Firefox should clear the policies file added to the installation directory.

I don't know if that's the right thing to do or not, so I'm filing a bug to check with the experts.. :)

And there's also the questions that, in addition to this file in the install dir, on Windows policies might come from the registry too. If we do clear the policies file, should we also clear them in the registry case?

Comment 1

[Molly Howell (she/her) (no longer active)]

My opinion would be that anything inside the installation directory is considered to be associated with that specific installation, and so it should be removed when that installation is removed. If we want policy configuration to be able to outlive a single installation, then we should support placing the file in a system-wide configuration directory outside of any specific installation, and the uninstaller would not remove those files.

Same goes for registry entries. I don't know where we're planning on putting those, but if it's in a key specific to the installation, then they should be removed along with the installation; if it's in a system-wide location, then the uninstaller should leave them alone. If it's group policy we're talking about, then those registry entries are managed by the policy editor.

Comment 2

[:Felipe Gomes (needinfo for replies!)]

(In reply to Matt Howell [:mhowell] from comment #1)
> My opinion would be that anything inside the installation directory is
> considered to be associated with that specific installation, and so it
> should be removed when that installation is removed. If we want policy
> configuration to be able to outlive a single installation, then we should
> support placing the file in a system-wide configuration directory outside of
> any specific installation, and the uninstaller would not remove those files.

Ok, makes sense. Do we need to do some work to actively make this happen? i.e., does the uninstaller need to know about this file to remove it?


> 
> Same goes for registry entries. I don't know where we're planning on putting
> those, but if it's in a key specific to the installation, then they should
> be removed along with the installation; if it's in a system-wide location,
> then the uninstaller should leave them alone. If it's group policy we're
> talking about, then those registry entries are managed by the policy editor.

Yeah, the registry entries will come from group policy, so I think there's nothing to worry about them on uninstall time, and just leave them there.

Comment 3

[:Felipe Gomes (needinfo for replies!)]

(In reply to :Felipe Gomes (needinfo me!) from comment #2)
> > If we want policy
> > configuration to be able to outlive a single installation, then we should
> > support placing the file in a system-wide configuration directory outside of
> > any specific installation

BTW, is there precedent for such thing? It never came up before as a requirement, but I'm wondering if it's something we should consider

Comment 4

[Molly Howell (she/her) (no longer active)]

(In reply to :Felipe Gomes (needinfo me!) from comment #2)
> Do we need to do some work to actively make this happen?
> i.e., does the uninstaller need to know about this file to remove it?

It looks like the file goes in the distribution directory? In that case, no, there's nothing to do; the uninstaller already removes that whole directory unconditionally.

(In reply to :Felipe Gomes (needinfo me!) from comment #3)
> BTW, is there precedent for such thing? It never came up before as a
> requirement, but I'm wondering if it's something we should consider

There's no current precedent within Firefox, but every platform we support provides a directory that's intended to be used this way. I suppose the use case would be making sure that polices take effect on new installations that users create themselves; if we only look inside the install path, a user could just download a .zip package and run that copy (assuming the administrator hasn't blocked that some other way) and have no policy applied to them at all.

Comment 5

[:Felipe Gomes (needinfo for replies!)]

(In reply to Matt Howell [:mhowell] from comment #4)
> (In reply to :Felipe Gomes (needinfo me!) from comment #2)
> > Do we need to do some work to actively make this happen?
> > i.e., does the uninstaller need to know about this file to remove it?
> 
> It looks like the file goes in the distribution directory? In that case, no,
> there's nothing to do; the uninstaller already removes that whole directory
> unconditionally.

Ok, looks like there's nothing to do here, this is already handled automatically!

So we will end up with several nice ways to define policies:
 - per installation, using policies.json (which will get removed if uninstalled)
 - per user, using GPO through HKEY_CURRENT_USER
 - machine wide, using GPO through HKEY_LOCAL_MACHINE
 - company wide, distributing GPO through ActiveDirectory