1812480 - Firefox Installs From .pkg Files Require Password Prompt to Update

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P3)

Description

[Haik Aftandilian [:haik]]

When installing Firefox from a .pkg (not a .dmg), the installer places Firefox in /Applications with owner:group permissions as root:wheel. As a result of the 'wheel' group ownership, when the install of Firefox is updated, the update requires the user to authenticate with their password (or any admin account password). This allows Firefox's privileged updater to run which updates files and leaves the permissions as root:admin so that future updates by admin users can proceed without a password prompt.

It would be better if .pkg installs were configured to install Firefox with admin group ownership (i.e., root:admin) so that Firefox could be updated without a password prompt.

According to the pkgbuild(1) man page, this can be accomplished with the --ownership option.

Example Firefox pkg: Firefox_110_b5.pkg

Comment 1

[Haik Aftandilian [:haik]]

@mkaply, do you know if enterprise use requires we install Firefox with root:wheel ownership on macOS so that Firefox can not be updated by non-admin users? This question only applies to installs from the .pkg files.

Comment 2

[Mike Kaply [:mkaply]]

I got a response from one admin and they said it really doesn't make a difference.

I'm assuming you either have to put in the password at install or first update, right?

Comment 3

[Haik Aftandilian [:haik]]

(In reply to Mike Kaply [:mkaply] from comment #2)

I got a response from one admin and they said it really doesn't make a difference.

OK, thanks.

I'm assuming you either have to put in the password at install or first update, right?

Sorry, my question was not worded correctly. This only applies to admin users. Non-admin users need an admin user to authenticate in order to install and for every update regardless of this proposed change. Fixing this would just be streamlining the first update for admin users so I think it's a clear-cut improvement.

The way it is now, you have to put in the password both at install time and on the first update.

If we changed the .pkg install to install Firefox with root:admin ownership, then the user would only need to input the password when they install.

Comment 4

[Mike Kaply [:mkaply]]

If we changed the .pkg install to install Firefox with root:admin ownership, then the user would only need to input the password when they install.

That seems like the right thing to do.

Comment 5

[Kris Wright :KrisWright]

We had a chance to investigate this bug yesterday to mixed results - the actual ownership issue is coming from further up the chain and the tooling on the current hardware does not provide for us an easy fix. Current hardware in our release pipeline which executes packaging code involves older mac minis with tooling outdated to the necessary commands to create copies of the archive with the correct ownership, or to change the ownership altogether. When we change the hardware and tooling on which we generate the signed .pkgs (part of a larger project), we will be able to fix this. For now, moving to releng.

Comment 6

[Heitor Neiva [:hneiva]]

Hey :KrisWright is this still happening?

Comment 7

[Haik Aftandilian [:haik]]

We definitely still want to address this, but it's not being worked on right now.

Comment 8

[Heitor Neiva [:hneiva]]

I'm expecting we'll look into this again once we have the new mac hardware in place. (Newer version of xcode)

Comment 9

[BMO Github Automation]

Attachment: [mozilla-releng/scriptworker-scripts] feat(iscript) Bug 1812480 - Change file ownership before creating pkgs (#1331)

Comment 10

[Heitor Neiva [:hneiva]]

Attachment: Bug 1812480 - Change Mac pkgs contents mode r?#releng,spohl

Comment 11

[Heitor Neiva [:hneiva]]

Attachment: Bug 1812480 - Switch mac pkg source to repackaged instead of iscript r?#releng

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9d0a9a94b715
https://hg.mozilla.org/integration/autoland/rev/bbfaaa1961ad
Change Mac pkgs contents mode r=spohl,releng-reviewers,bhearsum
https://github.com/mozilla-firefox/firefox/commit/e40679fc7168
https://hg.mozilla.org/integration/autoland/rev/270347904442
Switch mac pkg source to repackaged instead of iscript r=releng-reviewers,taskgraph-reviewers,ahal

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3a7b8eaf95b4
https://hg.mozilla.org/integration/autoland/rev/8c2eafc08725
Revert "Bug 1812480 - Switch mac pkg source to repackaged instead of iscript r=releng-reviewers,taskgraph-reviewers,ahal" for causing gecko decision failures

Comment 14

[rperta]

Backed out for causing gecko decision failures
Backout link
Push with failures
Failure log(s)

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1a92842445c3
https://hg.mozilla.org/integration/autoland/rev/67a6e91524f8
Change Mac pkgs contents mode r=spohl,releng-reviewers,bhearsum
https://github.com/mozilla-firefox/firefox/commit/454142c38996
https://hg.mozilla.org/integration/autoland/rev/b000ac6beec8
Switch mac pkg source to repackaged instead of iscript r=releng-reviewers,taskgraph-reviewers,ahal

Comment 16

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/67a6e91524f8
https://hg.mozilla.org/mozilla-central/rev/b000ac6beec8

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c983b985e46a
https://hg.mozilla.org/mozilla-central/rev/4addf98c4ca8
Revert "Bug 1812480 - Switch mac pkg source to repackaged instead of iscript r=releng-reviewers,taskgraph-reviewers,ahal" for causing Beetmover repackages build bustages

Comment 18

[rperta]

https://hg.mozilla.org/mozilla-central/rev/4addf98c4ca8

Comment 19

[Mike Kaply [:mkaply]]

Can you give me a description for this for the enterprise readme?

Comment 20

[Heitor Neiva [:hneiva]]

:mkaply I'd do something along the lines of:

MacOS pkg installer: set installed file ownership to root:admin instead of root:wheel. This allows any user in the admin group (administrators) to update the app in place without being prompted for credentials, matching the behavior users expect from a standard Mac application install.

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b631498c8f31
https://hg.mozilla.org/integration/autoland/rev/335faf2a507e
Change Mac pkgs contents mode r=spohl,releng-reviewers,bhearsum
https://github.com/mozilla-firefox/firefox/commit/7f047ab3533d
https://hg.mozilla.org/integration/autoland/rev/db4d2e5f6e68
Switch mac pkg source to repackaged instead of iscript r=releng-reviewers,taskgraph-reviewers,ahal

Comment 22

[amarc]

https://hg.mozilla.org/mozilla-central/rev/335faf2a507e
https://hg.mozilla.org/mozilla-central/rev/db4d2e5f6e68