MB 38: Mullvad Browser configuration

browser/app/profile/000-mullvad-browser.js

+// Preferences specific to Mullvad Browser
+
+// Do not show the bookmark panel for now, because it makes the initial browser
+// window (about:home) bigger, and regular pages will show letterbox margins as
+// a result.
+pref("browser.toolbars.bookmarks.visibility", "never");
+
+// mullvad-browser#19: Enable Mullvad's DOH
+pref("network.trr.uri", "https://dns.mullvad.net/dns-query");
+pref("network.trr.default_provider_uri", "https://dns.mullvad.net/dns-query");
+pref("network.trr.mode", 3);
+pref("doh-rollout.provider-list", "[{\"UIName\":\"Mullvad\",\"autoDefault\":true,\"canonicalName\":\"\",\"id\":\"mullvad\",\"last_modified\":0,\"schema\":0,\"uri\":\"https://dns.mullvad.net/dns-query\"},{\"UIName\":\"Mullvad (Ad-blocking)\",\"autoDefault\":false,\"canonicalName\":\"\",\"id\":\"mullvad\",\"last_modified\":0,\"schema\":0,\"uri\":\"https://adblock.dns.mullvad.net/dns-query\"}]");
+// mullvad-browser#122: Audit DoH heuristics
+pref("doh-rollout.disable-heuristics", true);
+
+// mullvad-browser#37: Customization for the about dialog
+pref("app.releaseNotesURL.aboutDialog", "about:blank");
+
+// mullvad-browser#94: Disable legacy global microphone/webcam indicator
+// Disable the legacy Firefox Quantum-styled global webcam/microphone indicator in favor of each
+// platform's native indicator
+pref("privacy.webrtc.legacyGlobalIndicator", false);
+
+// mullvad-browser#87: Windows and Linux need additional work to make the
+// default browser choice working.
+// We are shipping only the portable versions for the initial release anyway, so
+// we leave this popup enabled only on macOS.
+#ifndef XP_MACOSX
+pref("browser.shell.checkDefaultBrowser", false);
+#endif
+
+// mullvad-browser#228: default to spoof en-US and skip showing the dialog
+pref("privacy.spoof_english", 2);

browser/app/profile/001-base-profile.js

@@ -70,10 +70,10 @@ pref("browser.helperApps.deleteTempFileOnExit", true);
 pref("browser.download.enable_spam_prevention", true);
 
 // Misc privacy: Disk
-pref("signon.rememberSignons", false);
-pref("browser.formfill.enable", false);
+pref("signon.rememberSignons", false, locked);
+pref("browser.formfill.enable", false, locked);
 pref("signon.formlessCapture.enabled", false); // Added with tor-browser#41496
-pref("signon.autofillForms", false);
+pref("signon.autofillForms", false, locked);
 // Do not store extra data (form, scrollbar positions, cookies, POST data) for
 // the session restore functionality.
 pref("browser.sessionstore.privacy_level", 2);
@@ -311,7 +311,7 @@ pref("security.remote_settings.crlite_filters.enabled", false);
 pref("security.pki.crlite_mode", 0);
 
 // Disable website password breach alerts
-pref("signon.management.page.breach-alerts.enabled", false);
+pref("signon.management.page.breach-alerts.enabled", false, locked);
 
 // Disable remote "password recipes". They are a way to improve the UX of the
 // password manager by havinc specific heuristics for some sites.
@@ -352,7 +352,6 @@ pref("dom.disable_window_move_resize", true);
 // Set video VP9 to 0 for everyone (bug 22548)
 pref("media.benchmark.vp9.threshold", 0);
 pref("privacy.resistFingerprinting.block_mozAddonManager", true); // Bug 26114
-pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API
 pref("dom.webmidi.enabled", false); //  Bug 41398: Disable Web MIDI API
 // tor-browser#42043: Stop reporting device IDs (and spoof their number without
 // RFP, RFP already reports 1 audioinput and 1 videoinput, but still has
@@ -484,7 +483,6 @@ pref("network.http.http2.enable-hpack-dump", false, locked);
 // tor-browser#23044: Make sure we don't have any GIO supported protocols
 // (defense in depth measure)
 pref("network.gio.supported-protocols", "");
-pref("media.peerconnection.enabled", false); // Disable WebRTC interfaces
 // Mullvad Browser enables WebRTC by default, meaning that there the following prefs
 // are first-line defense, rather than "in depth" (mullvad-browser#40)
 // tor-browser#41667 - Defense in depth: use mDNS to avoid local IP leaks on Android too if user enables WebRTC

browser/config/mozconfigs/base-browser

@@ -19,15 +19,10 @@ ac_add_options --enable-base-browser-update
 
 ac_add_options --enable-bundled-fonts
 
-# See bug #41587
-ac_add_options --disable-updater
-
 ac_add_options --disable-tests
 ac_add_options --disable-debug
 
 ac_add_options --disable-crashreporter
-# Before removing, please notice that WebRTC does not work on mingw (Bug 1393901)
-ac_add_options --disable-webrtc
 ac_add_options --disable-parental-controls
 ac_add_options --enable-proxy-bypass-protection
 # See bugs #30575 and #32418: system policies are harmful either because they
@@ -50,5 +45,3 @@ fi
 
 # tor-browser#42337
 ac_add_options --enable-geckodriver
-
-ac_add_options --with-relative-data-dir=BaseBrowser/Data/Browser

browser/config/mozconfigs/mullvad-browser

+. $topsrcdir/browser/config/mozconfigs/base-browser
+
+export MOZ_APP_BASENAME=MullvadBrowser
+mk_add_options MOZ_APP_DISPLAYNAME="Mullvad Browser"
+
+ac_add_options --with-user-appdir=Mullvad
+
+ac_add_options --with-relative-data-dir=../Data
+
+ac_add_options --with-distribution-id=net.mullvad

browser/installer/package-manifest.in

@@ -269,6 +269,7 @@
 @RESPATH@/browser/defaults/settings/blocklists
 @RESPATH@/browser/defaults/settings/main
 @RESPATH@/browser/defaults/settings/security-state
+@RESPATH@/browser/@PREF_DIR@/000-mullvad-browser.js
 @RESPATH@/browser/@PREF_DIR@/001-base-profile.js
 
 ; Warning: changing the path to channel-prefs.js can cause bugs (Bug 756325)

browser/moz.build

@@ -57,6 +57,7 @@ if CONFIG["MOZ_ARTIFACT_BUILDS"]:
 # These files are specified in this moz.build to pick up DIST_SUBDIR as set in
 # this directory, which is un-set in browser/app.
 JS_PREFERENCE_PP_FILES += [
+    "app/profile/000-mullvad-browser.js",
     "app/profile/001-base-profile.js",
     "app/profile/firefox.js",
 ]

moz.configure

@@ -980,6 +980,9 @@ set_define("BASE_BROWSER_VERSION", base_browser_version)
 set_define("BASE_BROWSER_VERSION_QUOTED", base_browser_version_quoted)
 
 
+set_define("MULLVAD_BROWSER", True)
+
+
 # Please do not add configure checks from here on.
 
 # Fallthrough to autoconf-based configure

mozconfig-linux-aarch64

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 ac_add_options --target=aarch64-unknown-linux-gnu
 

mozconfig-linux-x86_64

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 # Moz switched to lld for all Linux targets in Bug 1839739.
 ac_add_options --enable-linker=lld

mozconfig-linux-x86_64-asan

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 export CFLAGS="-fsanitize=address -Dxmalloc=myxmalloc"
 export CXXFLAGS="-fsanitize=address -Dxmalloc=myxmalloc"

mozconfig-linux-x86_64-dev

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 # This mozconfig file is not used in official builds.
 # It is only intended to be used when doing incremental Linux builds
@@ -8,6 +8,7 @@
 ac_add_options --enable-linker=lld
 
 export MOZILLA_OFFICIAL=
+ac_add_options --with-branding=browser/branding/mb-nightly
 
 ac_add_options --enable-default-toolkit=cairo-gtk3
 

mozconfig-macos

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 ac_add_options --enable-strip
 

mozconfig-macos-dev

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 # This mozconfig file is not used in official builds.
 # It is only intended to be used when doing incremental macOS builds

mozconfig-windows-x86_64

-. $topsrcdir/browser/config/mozconfigs/base-browser
+. $topsrcdir/browser/config/mozconfigs/mullvad-browser
 
 ac_add_options --target=x86_64-w64-mingw32
 ac_add_options --with-toolchain-prefix=x86_64-w64-mingw32-
@@ -8,7 +8,6 @@ ac_add_options --enable-strip
 # Bits is Background Intelligent Transfer Service
 ac_add_options --disable-bits-download
 ac_add_options --disable-maintenance-service
-ac_add_options --disable-default-browser-agent
 
 # See bug #13379
 ac_add_options --enable-nss-mar

taskcluster/ci/source-test/mozlint.yml

@@ -212,6 +212,7 @@ lintpref:
         files-changed:
             - 'modules/libpref/init/all.js'
             - 'modules/libpref/init/StaticPrefList.yaml'
+            - 'browser/app/profile/000-mullvad-browser.js'
             - 'browser/app/profile/001-base-profile.js'
             - 'browser/app/profile/firefox.js'
             - 'mobile/android/app/mobile.js'