1496869 - Firefox can be started in safe-mode from terminal when DisableSafeMode policy is enabled

Status: NEW

(Firefox :: Enterprise Policies, defect, P2)

Description

[Stefan [:StefanG_QA]]

STR:
1. Open Terminal and type:
`defaults write org.mozilla.nightly EnterprisePoliciesEnabled -bool YES`
`defaults write org.mozilla.nightly DisableSafeMode -bool YES`
2. Go to Firefox directory and run in terminal ./firefox -safe-mode 
verify "Start in Safe mode" is not available
3. Start Firefox and verify it is in Safe mode

AR: "Start in Safe mode" is available in a pop-up window
ER: "Start in Safe mode" should not be available and Fx should not start in safe mode

Comment 1

[Stephen A Pohl [:spohl]]

Stefan, for all of these bugs, could you please check if JSON policies exhibit the same problem? Thank you!

Comment 2

[Stefan [:StefanG_QA]]

I'm able to reproduce the same behavior using JSON file on macOS. When the policy is active, I`m able to open same mode from terminal.

Comment 3

[Mike Kaply [:mkaply]]

We special cased this for Windows and only supported it via registry.

Note sure if we want to do the same for Mac.

Comment 4

[:Felipe Gomes (needinfo for replies!)]

Oh this is a good point, with the new Mac support we could do it too through the plist

Comment 5

[:Felipe Gomes (needinfo for replies!)]

Stephen, the DisableSafeMode policy is a very special case in Firefox as it's not handled by the policy engine, because the safe mode code runs much earlier than that.

So what we did was to add Windows specific code that directly checks the registry for this policy [1]. This means that it's only supported on GPO, and not on policies.json, but that's fine as that is documented.

Do you think we could do something similar here to add a direct check to the plist for the specific "DisableSafeMode" policy?

I guess it would be just a matter of another exposed function like nsMacPreferencesReader::PoliciesEnabled


https://searchfox.org/mozilla-central/rev/8848b9741fc4ee4e9bc3ae83ea0fc048da39979f/toolkit/xre/SafeMode.h#68-69

Comment 6

[Stephen A Pohl [:spohl]]

Yes, I think this should be possible.

Comment 7

[Jeffrey Ethelred]

Same problem on Linux. When will it be fixed?

Comment 8

[Jeffrey Ethelred]

Reproduced on Linux using the policies.json file.

Comment 9

[Mike Kaply [:mkaply]]

This is not really possible on Linux because we can't read policies.json early in startup.