1493249 - Add support for security devices

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, enhancement, P1)

Description

[Mike Kaply [:mkaply]]

Add support for adding PKCS11 security devices.

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1493249 - Add policy for security devices.

Comment 2

[:Felipe Gomes (needinfo for replies!)]

Note: this should have tests, both for the policy itself, but also for the parsing of patternProperties (you could add it to https://searchfox.org/mozilla-central/source/toolkit/components/utils/test/browser/browser_JsonSchemaValidator.js )

Comment 3

[Mike Kaply [:mkaply]]

There's really no good way to test the policy. We're calling a known API that is tested.

I wasn't sure where to add the validator test.

Comment 4

[:Felipe Gomes (needinfo for replies!)]

Comment on attachment 9011041 [details]
Bug 1493249 - Add policy for security devices.

:Felipe Gomes (needinfo me!) has approved the revision.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/86baeb291e66
Add policy for security devices. r=Felipe

Comment 6

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/86baeb291e66

Comment 7

[Emil Ghitta, QA [:emilghitta]]

This bug was covered by the overall testing efforts invested in the Additional Enterprise Policies feature.

Marking this as verified fixed using Firefox 64.0a1 (BuildId:20181011220118) on Windows 10 64bit and macOS 10.13.6

Comment 8

[Mike Kaply [:mkaply]]

Attachment: Patch for ESR

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy change to align with Firefox 64

User impact if declined: 

Fix Landed on Version: 64

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Policy only change

String or UUID changes made by this patch: None

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9024119 [details] [diff] [review]
Patch for ESR

Verified in 64, OK to uplift this enterprise policy change.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/b9c34e2086c2

Comment 11

[Emil Ghitta, QA [:emilghitta]]

Hi Mike,

I tried verifying this issue using the esr build (provided in comment 10) but it seems that the policy is not recognized.

Console output: 

Enterprise Policies:Unknown policy: SecurityDevices

Comment 12

[Mike Kaply [:mkaply]]

Attachment: Followup

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: Missing part of previous patch

User impact if declined: Function doesn't work

Fix Landed on Version: 

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): corrects schema change

String or UUID changes made by this patch:

Comment 13

[Mike Kaply [:mkaply]]

I screwed up and forgot a piece of the patch. This is needed before bug 1498223 will apply.

Comment 14

[Liz Henry (:lizzard) (relman/hg->git project)]

Thanks Emil and Mike! Good catch.

Comment 15

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9025722 [details] [diff] [review]
Followup

Fix for new enterprise policy on ESR.

Comment 16

[Liz Henry (:lizzard) (relman/hg->git project)]

Mike, did this ever actually land on ESR60?

Comment 17

[Mike Kaply [:mkaply]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #16)
> Mike, did this ever actually land on ESR60?

No, thanks for the reminder.

https://hg.mozilla.org/releases/mozilla-esr60/rev/ff3b417e363f65040aa4eb38d249a740191f7c87

Comment 18

[Mike Kaply [:mkaply]]

Emil

Can you reverify when the next esr nightly is available?

Comment 19

[Mike Kaply [:mkaply]]

Attachment: Correct esr60 iterator problem

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: Another followup to patch

User impact if declined: Feature won't work

Fix Landed on Version: ESR only

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Liz, I'm very sorry about this. I should have tested more thoroughly instead of just assuming this will work. All other ESR patches will be built and tested locally.

String or UUID changes made by this patch:

Comment 20

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9028359 [details] [diff] [review]
Correct esr60 iterator problem

Another follow-up fix for ESR, approved for 60.4.0esr. Glad we've got QA verifying these!

Comment 21

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/641d73998992

Comment 22

[Emil Ghitta, QA [:emilghitta]]

This is verified fixed using Firefox 60.3.1esr (provided in comment 21) on Windows 10 64bit and macOS 10.14