1812480 - Firefox Installs From .pkg Files Require Password Prompt to Update

Status: NEW

(Release Engineering :: General, defect, P3)

Description

[Haik Aftandilian [:haik]]

When installing Firefox from a .pkg (not a .dmg), the installer places Firefox in /Applications with owner:group permissions as root:wheel. As a result of the 'wheel' group ownership, when the install of Firefox is updated, the update requires the user to authenticate with their password (or any admin account password). This allows Firefox's privileged updater to run which updates files and leaves the permissions as root:admin so that future updates by admin users can proceed without a password prompt.

It would be better if .pkg installs were configured to install Firefox with admin group ownership (i.e., root:admin) so that Firefox could be updated without a password prompt.

According to the pkgbuild(1) man page, this can be accomplished with the --ownership option.

Example Firefox pkg: Firefox_110_b5.pkg

Comment 1

[Haik Aftandilian [:haik]]

@mkaply, do you know if enterprise use requires we install Firefox with root:wheel ownership on macOS so that Firefox can not be updated by non-admin users? This question only applies to installs from the .pkg files.

Comment 2

[Mike Kaply [:mkaply]]

I got a response from one admin and they said it really doesn't make a difference.

I'm assuming you either have to put in the password at install or first update, right?

Comment 3

[Haik Aftandilian [:haik]]

(In reply to Mike Kaply [:mkaply] from comment #2)

I got a response from one admin and they said it really doesn't make a difference.

OK, thanks.

I'm assuming you either have to put in the password at install or first update, right?

Sorry, my question was not worded correctly. This only applies to admin users. Non-admin users need an admin user to authenticate in order to install and for every update regardless of this proposed change. Fixing this would just be streamlining the first update for admin users so I think it's a clear-cut improvement.

The way it is now, you have to put in the password both at install time and on the first update.

If we changed the .pkg install to install Firefox with root:admin ownership, then the user would only need to input the password when they install.

Comment 4

[Mike Kaply [:mkaply]]

If we changed the .pkg install to install Firefox with root:admin ownership, then the user would only need to input the password when they install.

That seems like the right thing to do.

Comment 5

[Kris Wright :KrisWright]

We had a chance to investigate this bug yesterday to mixed results - the actual ownership issue is coming from further up the chain and the tooling on the current hardware does not provide for us an easy fix. Current hardware in our release pipeline which executes packaging code involves older mac minis with tooling outdated to the necessary commands to create copies of the archive with the correct ownership, or to change the ownership altogether. When we change the hardware and tooling on which we generate the signed .pkgs (part of a larger project), we will be able to fix this. For now, moving to releng.

Comment 6

[Heitor Neiva [:hneiva]]

Hey :KrisWright is this still happening?

Comment 7

[Haik Aftandilian [:haik]]

We definitely still want to address this, but it's not being worked on right now.

Comment 8

[Heitor Neiva [:hneiva]]

I'm expecting we'll look into this again once we have the new mac hardware in place. (Newer version of xcode)