Unverified Commit de98a143 authored by Kathleen Brade's avatar Kathleen Brade Committed by Matthew Finkel
Browse files

Bug 32418: Allow updates to be disabled via an enterprise policy. 

Restrict the Enterprise Policies mechanism to only consult a
policies.json file (avoiding the Windows Registry and macOS's
file system attributes).

Add a few disabledByPolicy() checks to the update service to
avoid extraneous (and potentially confusing) log messages when
updates are disabled by policy.

Sample content for distribution/policies.json:
{
  "policies": {
    "DisableAppUpdate": true
  }
}

On Linux, avoid reading policies from /etc/firefox/policies/policies.json
parent 57097125

toolkit/components/enterprisepolicies/EnterprisePolicies.js

+12 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ 
 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */



// To ensure that policies intended for Firefox or another browser will not

// be used, Tor Browser only looks for policies in ${InstallDir}/distribution

#define AVOID_SYSTEM_POLICIES MOZ_PROXY_BYPASS_PROTECTION



const { XPCOMUtils } = ChromeUtils.import(

  "resource://gre/modules/XPCOMUtils.jsm"

);
@@ -11,9 +15,11 @@ const { AppConstants } = ChromeUtils.import( 
);



XPCOMUtils.defineLazyModuleGetters(this, {

#ifndef AVOID_SYSTEM_POLICIES

  WindowsGPOParser: "resource://gre/modules/policies/WindowsGPOParser.jsm",

  macOSPoliciesParser:

    "resource://gre/modules/policies/macOSPoliciesParser.jsm",

#endif

  Policies: "resource:///modules/policies/Policies.jsm",

  JsonSchemaValidator:

    "resource://gre/modules/components-utils/JsonSchemaValidator.jsm",
@@ -117,11 +123,13 @@ EnterprisePoliciesManager.prototype = { 


  _chooseProvider() {

    let platformProvider = null;

#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "win") {

      platformProvider = new WindowsGPOPoliciesProvider();

    } else if (AppConstants.platform == "macosx") {

      platformProvider = new macOSPoliciesProvider();

    }

#endif

    let jsonProvider = new JSONPoliciesProvider();

    if (platformProvider && platformProvider.hasPolicies) {

      if (jsonProvider.hasPolicies) {
@@ -470,6 +478,7 @@ class JSONPoliciesProvider { 
  _getConfigurationFile() {

    let configFile = null;



#ifndef AVOID_SYSTEM_POLICIES

    if (AppConstants.platform == "linux") {

      let systemConfigFile = Cc["@mozilla.org/file/local;1"].createInstance(

        Ci.nsIFile
@@ -482,6 +491,7 @@ class JSONPoliciesProvider { 
        return systemConfigFile;

      }

    }

#endif



    try {

      let perUserPath = Services.prefs.getBoolPref(PREF_PER_USER_DIR, false);
@@ -563,6 +573,7 @@ class JSONPoliciesProvider { 
  }

}



#ifndef AVOID_SYSTEM_POLICIES

class WindowsGPOPoliciesProvider {

  constructor() {

    this._policies = null;
@@ -637,6 +648,7 @@ class macOSPoliciesProvider { 
    return this._failed;

  }

}

#endif



class CombinedProvider {

  constructor(primaryProvider, secondaryProvider) {

toolkit/components/enterprisepolicies/moz.build

+3 −1
Original line number Diff line number Diff line
@@ -19,10 +19,12 @@ TEST_DIRS += [ 


if CONFIG['MOZ_WIDGET_TOOLKIT'] != "android":

    EXTRA_COMPONENTS += [

        'EnterprisePolicies.js',

        'EnterprisePolicies.manifest',

        'EnterprisePoliciesContent.js',

    ]

    EXTRA_PP_COMPONENTS += [

        'EnterprisePolicies.js',

    ]



if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':

    EXTRA_JS_MODULES.policies += [

toolkit/mozapps/update/UpdateService.jsm

+16 −0
Original line number Diff line number Diff line
@@ -3268,6 +3268,14 @@ UpdateService.prototype = { 
   * See nsIUpdateService.idl

   */

  get canApplyUpdates() {

    if (this.disabledByPolicy) {

      LOG(

        "UpdateService.canApplyUpdates - unable to apply updates, " +

          "the option has been disabled by the administrator."

      );

      return false;

    }



    return getCanApplyUpdates() && hasUpdateMutex();

  },
@@ -3275,6 +3283,14 @@ UpdateService.prototype = { 
   * See nsIUpdateService.idl

   */

  get canStageUpdates() {

    if (this.disabledByPolicy) {

      LOG(

        "UpdateService.canStageUpdates - unable to stage updates, " +

          "the option has been disabled by the administrator."

      );

      return false;

    }



    return getCanStageUpdates();

  },