1655361 - mach bootstrap should configure Windows for optimal building (e.g. Windows Defender)

Status: RESOLVED FIXED

(Firefox Build System :: Bootstrap Configuration, enhancement, P3)

Description

[Cameron McCormack (:heycam)]

I just remembered that I should have added my source directory to the Windows Defender exclusion list. It would be nice if mach bootstrap could do this automatically, or if not possible, to prompt me to do it if it detects that the exclusions hasn't been added.

Comment 1

[Mike Hommey [:glandium]]

It probably can't do it automatically, otherwise malware could just disable it for itself. I don't know if it's possible to check the exclusion list through some API...

Comment 2

[Mike Hommey [:glandium]]

(also, if such an API exists, it would probably only tell about Windows Defender, not about other antivirus software)

Comment 3

[Ricky Stewart]

We can certainly do some version of this for Windows Defender at least. I don't know if there's a lower-level API, but powershell -inputformat none -outputformat text -NonInteractive -Command (Get-MpPreference).ExclusionPath can list the exclusions, and we can subprocess into that from bootstrap. There's an analogous powershell invocation to add the exclusion, though it requires elevated permissions and doing that from Python is more complicated.

Comment 4

[Ricky Stewart]

Huh, I didn't know that powershell.exe isn't accessible from MozillaBuild... not really sure what to do with that. I guess I can trawl through the System32 directory to try to find the right location of the binary, but my Windows isn't good enough to be able to come up with the least error-prone way of doing that.

Comment 5

[Ricky Stewart]

Apparently the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths can be used to determine whether certain exclusions are added, but I haven't figured out the right incantation of winreg calls to robustly determine whether a given directory is properly excluded.

Comment 6

[Mitchell Hentges [:mhentges] 🦀]

Attachment: Bug 1655361: Prints a warning if Windows Defender is watching the Firefox checkout directory

There's a Windows Defender CLI available via Powershell, but MozillaBuild doesn't have access to Powershell. So, instead, we
determine the excluded locations by checking the registry at HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths.

Also updates our Windows Defender docs to make them:

• More easily link-able
• Have direct advice to resolve the issue

Comment 7

[Mitchell Hentges [:mhentges] 🦀]

Attachment: Bug 1655361: Prints a warning if Windows Defender is not excluding the Firefox checkout directory

There's a Windows Defender CLI available via Powershell, but MozillaBuild doesn't have access to Powershell. So, instead, we
determine the excluded locations by checking the registry at HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths.

Also updates our Windows Defender docs to make them:

• More easily link-able
• Have direct advice to resolve the issue

Depends on D83572

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/272ef8e25986
Prints a warning if Windows Defender is watching the Firefox checkout directory r=firefox-build-system-reviewers,rstewart

Comment 9

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/272ef8e25986