1457142 - Policies: Disable/Configure camera access

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, enhancement, P1)

Description

[narutards]

Under about:preferences#privacy you have the option to configure a list of websites that are allowed to access your camera and to deny the permission to any new websites.

It would be really nice if you could configure this through the enterprise GPOs.

Comment 1

[narutards]

The option I'm looking for is "permissions.default.camera".

Comment 2

[Kanika Saini]

Attachment: Bug 1457142 - Added Policy: Camera Access

Review commit: https://reviewboard.mozilla.org/r/245304/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/245304/

Comment 3

[Kanika Saini]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/245304/diff/1-2/

Comment 4

[Kanika Saini]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/245304/diff/2-3/

Comment 5

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

https://reviewboard.mozilla.org/r/245304/#review253382

::: browser/components/enterprisepolicies/Policies.jsm:121
(Diff revision 3)
> +      if (param.BlockNewRequests) {
> +        if (param.Locked) {
> +          setAndLockPref("permissions.default.camera", 2);
> +        } else {
> +          setDefaultPref("permissions.default.camera", 2);
> +        }
> +      } else if (!param.BlockNewRequests) {
> +        if (param.Locked) {
> +          setAndLockPref("permissions.default.camera", 0);
> +        } else {
> +          setDefaultPref("permissions.default.camera", 0);
> +        }
> +      }
> +    }
> +  },

this is not quite perfect because if BlockNewRequests is not defined, it will enter the !param.BlockNewRequests block.

What you should do is check:

`if ("BlockNewRequests" in param) {`

and then inside that block you decide about setting the value 2 or 2 depending if that is true or false

::: browser/components/enterprisepolicies/tests/browser/browser_policy_camera_access.js:32
(Diff revision 3)
> +                     Ci.nsIPermissionManager.DENY_ACTION,
> +                     Ci.nsIPermissionManager.EXPIRE_SESSION);
> +});
> +
> +add_task(async function test_setup_activate_policies() {
> +  await setupPolicyEngineWithJson("camera_access.json");

I know that you just followed the example from the other test.. it was one of the first tests that were written, but after that, we decided to not create these external .json files anymore, and just have the JSON inlined in the test

The setupPolicyEngineWithJson supports it. See for example https://searchfox.org/mozilla-central/rev/5a744713370ec47969595e369fd5125f123e6d24/browser/components/enterprisepolicies/tests/browser/browser_policy_cookie_settings.js#134

Comment 6

[Kanika Saini]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/245304/diff/3-4/

Comment 7

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

https://reviewboard.mozilla.org/r/245304/#review253624

Comment 8

[:Felipe Gomes (needinfo for replies!)]

Mike, are you fine with the names of the policy and the properties here?

Comment 9

[Mike Kaply [:mkaply]]

I'm almost starting to wish we'd put all of these under a top level "Permissions" category so we could have just called it "Camera"

Permissions->Camera

Naming is hard.

Since we're basically going to be using this model for a number of other permissons, I'm also wondering if we think we need to make all three options available in this case:

Always Ask/Block/Allow

And use an enum.

But then I don't know what to name it. Because the enum is really the "Camera" permission and we need a way to lock it.

Unrelated - have we verify that locking this preference locks it in page permissions (It can't be overridden)

Comment 10

[Kanika Saini]

Comment on attachment 8979044 [details]
Bug 1457142 - Added Policy: Camera Access

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/245304/diff/4-5/