1507291 - Remove the concept of machine_only policies (they don't work like we thought)

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, enhancement, P1)

Description

[Mike Kaply [:mkaply]]

When we came up with machine_only policies, we thought we were solving a problem where applications without admin privileges could write to the HKEY_CURRENT_USER part of registry.

While this is generally true, it is NOT true about HKEY_CURRENT_USER\Software\Policies. It is only writable by administrators.

So our machine_only doesn't add any additional protection.

See discussion here:

https://github.com/mozilla/policy-templates/issues/286#issuecomment-436886413

(And I have verified this)

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1507291 - Remove concept of machine_only policies.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/49bac5821786
Remove concept of machine_only policies. r=Felipe,flod

Comment 3

[Narcis Beleuzu [:NarcisB]]

Backed out 

Backout link: https://hg.mozilla.org/integration/autoland/rev/4f54c06663d5fbf546d0c7be5acf710060d28972
Push link: https://hg.mozilla.org/integration/autoland/rev/49bac582178687862538a0f2f9e5663156d2ba70
Log link: https://treeherder.mozilla.org/logviewer.html#?job_id=212047661&repo=autoland&lineNumber=295

Comment 4

[Narcis Beleuzu [:NarcisB]]

^^ 
Backed out for Linting failure on WindowsGPOParser.jsm

Comment 5

[Mike Kaply [:mkaply]]

I wonder why phabricator didn't catch the linting error.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cec3c30f287b
Remove concept of machine_only policies. r=Felipe,flod

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/cec3c30f287b

Comment 8

[Mike Kaply [:mkaply]]

Comment on attachment 9025170 [details]
Bug 1507291 - Remove concept of machine_only policies.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: None

User impact if declined: Can't set certain policies

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: No

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): This is just removing a concept that come to find out isn't needed.
Would be nice to get it done as quick as possible so as not to force people to use machine policy unnecessarily.

String changes made/needed:

Comment 9

[Julien Cristau [:jcristau]]

Can you attach a patch for uplift that doesn't touch the ftl files?

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9025170 [details]
Bug 1507291 - Remove concept of machine_only policies.

[Triage Comment]
Per IRC discussion with Julien, taking it for 64.0b11 with FTL changes removed from the uplift.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/27727035c0de

Comment 12

[Cristian Baica [:cbaica], Release Desktop QA]

As per comment 8 and further discussion with Mike, this bug does not need any further investigation and any special verification from QA.
Based on that I'm closing this ticket as verified fixed.