1644528 - Allow cipher policy to enable ciphers

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, enhancement, P3)

Description

[Mike Kaply [:mkaply]]

When I originally envisioned the cipher policy, it was only to allow folks to turn them off

There might be cases where we turned things off an enterprise needs something on for some reason.

So we should allow for this.

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1644528 - Allow DisabledCiphers policy to enable ciphers. r?keeler

Comment 2

[Mike Kaply [:mkaply]]

Attachment: Bug 1644528 - Allow DisabledCiphers policy to enable ciphers. r?keeler

https://phabricator.services.mozilla.com/D78966

Depends on D78966

Comment 3

[Mike Kaply [:mkaply]]

Attachment: Bug 1644528 - Allow DisabledCiphers policy to enable ciphers. r?keeler

https://phabricator.services.mozilla.com/D78966

Comment 4

[J.C. Jones [:jcj] (he/they)]

Seems like this would be useful in ESR 78. It's getting late, but could still make b9 if it were requested immediately

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/96cb8930adee
Allow DisabledCiphers policy to enable ciphers. r=keeler

Comment 6

[Mike Kaply [:mkaply]]

Comment on attachment 9155413 [details]
Bug 1644528 - Allow DisabledCiphers policy to enable ciphers. r?keeler

Beta/Release Uplift Approval Request

• User impact if declined: Enterprises unable to reenable ciphers that we disable.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only.
• String changes made/needed:

Comment 7

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/96cb8930adee

Comment 8

[Julien Cristau [:jcristau] (back August 18)]

Comment on attachment 9155413 [details]
Bug 1644528 - Allow DisabledCiphers policy to enable ciphers. r?keeler

approved for 78.0b9

Comment 9

[Julien Cristau [:jcristau] (back August 18)]

https://hg.mozilla.org/releases/mozilla-beta/rev/926a371d4880

Comment 10

[Mike Kaply [:mkaply]]

Attachment: Patch for ESR 68

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy only, parity with 78
User impact if declined: Policy for 68 doesn't match 78
Fix Landed on Version: 78
Risk to taking this patch (and alternatives if risky): Low

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.

I realize this is late and if it doesn't make it until next ESR, I understand, but this allows for us to have one policy that works for 78 and 68/

Comment 11

[Ryan VanderMeulen [:RyanVM]]

This missed the 68.10esr build unfortunately, but we can still uplift it for the 68.11esr build shipping alongside Fx79/78.1esr.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9158347 [details] [diff] [review]
Patch for ESR 68

Approved for 68.11esr.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/6674321a4375