1460086 - Remove or disable pref: browser.policies.alternatePath

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, enhancement, P1)

Description

[Robin Steuber (she/her) [:bytesized]]

In order for the Background Update Agent to be able to determine whether updates are disabled, it needs to be able to find the policies regarding this. This means that those policies must be stored in their default locations.

Additionally, this pref could be considered a bit of a security risk.

The pref should either be removed entirely or made available only for testing.

Comment 1

[Mike Kaply [:mkaply]]

As we add support for other policy types (Mac plist) and allow policies.json in other location for Linux, querying the policies file isn't going to be enough.

There's going to need to be a better way to ask Firefox the status of certain policies.

Comment 2

[Robin Steuber (she/her) [:bytesized]]

The Background Update Agent cannot ask Firefox anything. The whole point of the Background Update Agent is that it runs when Firefox is not running.

Comment 3

[Mike Kaply [:mkaply]]

I'm ok with this, but we need to fix Linux first so it looks in the right place.

Comment 4

[Robin Steuber (she/her) [:bytesized]]

I just tested adding a policies.json on Linux without using `browser.policies.alternatePath` and it seems like it works fine. Can you clarify what needs to be fixed?

Comment 5

[Robin Steuber (she/her) [:bytesized]]

Attachment: Bug 1460086 - Disable pref: browser.policies.alternatePath except in testing and Nightly

Review commit: https://reviewboard.mozilla.org/r/245896/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/245896/

Comment 6

[Robin Steuber (she/her) [:bytesized]]

mkaply told me on IRC that he meant that in Linux, Firefox should be able to be managed *without* the policies.json. This feature has not been implemented yet.

Comment 7

[Mike Kaply [:mkaply]]

Comment on attachment 8979756 [details]
Bug 1460086 - Disable pref: browser.policies.alternatePath except in testing and Nightly

https://reviewboard.mozilla.org/r/245896/#review252176

Comment 8

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8979756 [details]
Bug 1460086 - Disable pref: browser.policies.alternatePath except in testing and Nightly

https://reviewboard.mozilla.org/r/245896/#review252188

I'm fine with changing this, but I think there was a bit of misunderstanding over the IRC talk. What Mike meant is not that Linux will be configured without policies.json. It's that on Linux the path might be different, outside of the install dir.. And instead of just one location, it will probably be a list of possible paths to look (in some pre-defined order). It's something that you can handle in the updater agent, but I just wanted to make it sure that it was clear.

::: browser/components/enterprisepolicies/EnterprisePolicies.js:375
(Diff revision 1)
>  
>      let alternatePath = Services.prefs.getStringPref(PREF_ALTERNATE_PATH, "");
>  
> -    if (alternatePath && (!configFile || !configFile.exists())) {
> -      // We only want to use the alternate file path if the file on the install
> -      // folder doesn't exist. Otherwise it'd be possible for a user to override
> +    // Check if we are in automation *before* we use the synchronous
> +    // nsIFile.exists() function or allow the config file to be overriden
> +    if (Cu.isInAutomation && alternatePath && (!configFile || !configFile.exists())) {

The first thing to check should be if an alternatePath was even given.. If it's empty than there's no need for the other checks.. so please put it in first.

Another thing that I'd like to keep supporting is Nightly builds, since this is very useful for our own manual testing..

There's no need to actually support it in the updater agent.. We can just document somewhere (probably not here) that this alternate path won't work to disable app updates on nightly builds)

(You can use AppConstants.NIGHTLY_BUILD for that)

Comment 9

[Robin Steuber (she/her) [:bytesized]]

Comment on attachment 8979756 [details]
Bug 1460086 - Disable pref: browser.policies.alternatePath except in testing and Nightly

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/245896/diff/1-2/

Comment 10

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 8979756 [details]
Bug 1460086 - Disable pref: browser.policies.alternatePath except in testing and Nightly

https://reviewboard.mozilla.org/r/245896/#review252656

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c2ac7dded317
Disable pref: browser.policies.alternatePath except in testing and Nightly r=Felipe,mkaply

Comment 12

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/c2ac7dded317