1522823 - Missing Group Policy Option to blacklist ALL extension except whitelisted/allowed

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect, P1)

Description

[Innovative]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Steps to reproduce:

• Install the Firefox ADMX templated
• Browse to the extensions options for Firefox
• Configured "Extensions to uninstall" with a * for the value

Actual results:

Nothing (kind of expected)

Expected results:

• We use this currently with Google Chrome's GPO settings.
• We need to block/blacklist all extensions except for what we want to allow and/or force install.
• Using a * is a easy way to do this if it works, but it does not work, nor is the naming or GPO options really geared towards that.
• There is no "whitelist" settings for permitted extensions

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1522823 - Policy for whitelist/blacklist addons by ID.

Comment 2

[Mike Kaply [:mkaply]]

This is a first pass. It needs more tests and I'm investigating emulating Chrome's URL blocking as well.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/61f3f19ee0de
Policy for whitelist/blacklist addons by ID. r=aswan,flod

Comment 7

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/61f3f19ee0de

Comment 9

[Cristian Baica [:cbaica], Release Desktop QA]

Tested the implementation of the policy on windows 10 x64, ubuntu 18.04 and macOS 10.13 using Fx69.0b7, Fx68.0.1.
Testing was done using by applying the policy via .json file. Also note that, as mentioned in c#0, setting the * via GPO on windows, does nothing.
Tested using the parameters mentioned in the policies-schema.json file.

I have also tried installing an addon from a third party site while the installation mode was set to blocked, but received a notification that Firefox the site from installing addons. The prompt can be seen at this link.

Comment 10

[Irene Smith]

There doesn't seem to be any existing documentation framework for this issue on MDN. This is the existing page:

Enterprise Deployment

The links on that page lead to support.mozilla.org, like this: How is Firefox Enterprise different from normal Firefox?

Let me know how you would like to document this.

Comment 11

[Mike Kaply [:mkaply]]

This will be documented on our enterprise policy page here:

https://github.com/mozilla/policy-templates/blob/master/README.md

I had to remove the documentation for now because of a bad bug.

It will be updated for Firefox 69.

Comment 12

[Irene Smith]

(In reply to Mike Kaply [:mkaply] from comment #11)

This will be documented on our enterprise policy page here:

https://github.com/mozilla/policy-templates/blob/master/README.md

I had to remove the documentation for now because of a bad bug.

It will be updated for Firefox 69.

Thanks for the update! I've pushed the documentation issue to the next sprint and added it to our Firefox 69 Epic.

Comment 13

[Chris Mills [:cmills]]

Note added to the FX69 rel notes:

https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/69#Other_changes

I don't think this requires any other documentation change, but let me know if the wording needs improving. Thanks!

Comment 14

[Mike Kaply [:mkaply]]

LGTM. Thanks!