diff options
Diffstat (limited to 'toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs')
| -rw-r--r-- | toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs | 740 |
1 files changed, 740 insertions, 0 deletions
diff --git a/toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs b/toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs new file mode 100644 index 0000000000..15fa2193c6 --- /dev/null +++ b/toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs @@ -0,0 +1,740 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + JsonSchemaValidator: + "resource://gre/modules/components-utils/JsonSchemaValidator.sys.mjs", + Policies: "resource:///modules/policies/Policies.sys.mjs", + WindowsGPOParser: "resource://gre/modules/policies/WindowsGPOParser.sys.mjs", + macOSPoliciesParser: + "resource://gre/modules/policies/macOSPoliciesParser.sys.mjs", +}); + +// This is the file that will be searched for in the +// ${InstallDir}/distribution folder. +const POLICIES_FILENAME = "policies.json"; + +// When true browser policy is loaded per-user from +// /run/user/$UID/appname +const PREF_PER_USER_DIR = "toolkit.policies.perUserDir"; +// For easy testing, modify the helpers/sample.json file, +// and set PREF_ALTERNATE_PATH in firefox.js as: +// /your/repo/browser/components/enterprisepolicies/helpers/sample.json +const PREF_ALTERNATE_PATH = "browser.policies.alternatePath"; +// For testing GPO, you can set an alternate location in testing +const PREF_ALTERNATE_GPO = "browser.policies.alternateGPO"; + +// For testing, we may want to set PREF_ALTERNATE_PATH to point to a file +// relative to the test root directory. In order to enable this, the string +// below may be placed at the beginning of that preference value and it will +// be replaced with the path to the test root directory. +const MAGIC_TEST_ROOT_PREFIX = "<test-root>"; +const PREF_TEST_ROOT = "mochitest.testRoot"; + +const PREF_LOGLEVEL = "browser.policies.loglevel"; + +// To force disallowing enterprise-only policies during tests +const PREF_DISALLOW_ENTERPRISE = "browser.policies.testing.disallowEnterprise"; + +// To allow for cleaning up old policies +const PREF_POLICIES_APPLIED = "browser.policies.applied"; + +ChromeUtils.defineLazyGetter(lazy, "log", () => { + let { ConsoleAPI } = ChromeUtils.importESModule( + "resource://gre/modules/Console.sys.mjs" + ); + return new ConsoleAPI({ + prefix: "Enterprise Policies", + // tip: set maxLogLevel to "debug" and use log.debug() to create detailed + // messages during development. See LOG_LEVELS in Console.sys.mjs for details. + maxLogLevel: "error", + maxLogLevelPref: PREF_LOGLEVEL, + }); +}); + +const isXpcshell = Services.env.exists("XPCSHELL_TEST_PROFILE_DIR"); + +// We're only testing for empty objects, not +// empty strings or empty arrays. +function isEmptyObject(obj) { + if (typeof obj != "object" || Array.isArray(obj)) { + return false; + } + for (let key of Object.keys(obj)) { + if (!isEmptyObject(obj[key])) { + return false; + } + } + return true; +} + +export function EnterprisePoliciesManager() { + Services.obs.addObserver(this, "profile-after-change", true); + Services.obs.addObserver(this, "final-ui-startup", true); + Services.obs.addObserver(this, "sessionstore-windows-restored", true); + Services.obs.addObserver(this, "EnterprisePolicies:Restart", true); +} + +EnterprisePoliciesManager.prototype = { + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsISupportsWeakReference", + "nsIEnterprisePolicies", + ]), + + _initialize() { + if (Services.prefs.getBoolPref(PREF_POLICIES_APPLIED, false)) { + if ("_cleanup" in lazy.Policies) { + let policyImpl = lazy.Policies._cleanup; + + for (let timing of Object.keys(this._callbacks)) { + let policyCallback = policyImpl[timing]; + if (policyCallback) { + this._schedulePolicyCallback( + timing, + policyCallback.bind( + policyImpl, + this /* the EnterprisePoliciesManager */ + ) + ); + } + } + } + Services.prefs.clearUserPref(PREF_POLICIES_APPLIED); + } + + let provider = this._chooseProvider(); + + if (provider.failed) { + this.status = Ci.nsIEnterprisePolicies.FAILED; + this._reportEnterpriseTelemetry(); + return; + } + + if (!provider.hasPolicies) { + this.status = Ci.nsIEnterprisePolicies.INACTIVE; + this._reportEnterpriseTelemetry(); + return; + } + + this.status = Ci.nsIEnterprisePolicies.ACTIVE; + this._parsedPolicies = {}; + this._reportEnterpriseTelemetry(provider.policies); + this._activatePolicies(provider.policies); + + Services.prefs.setBoolPref(PREF_POLICIES_APPLIED, true); + }, + + _reportEnterpriseTelemetry(policies = {}) { + let excludedDistributionIDs = [ + "mozilla-mac-eol-esr115", + "mozilla-win-eol-esr115", + ]; + let distroId = Services.prefs + .getDefaultBranch(null) + .getCharPref("distribution.id", ""); + + let policiesLength = Object.keys(policies).length; + + Services.telemetry.scalarSet("policies.count", policiesLength); + + let isEnterprise = + // As we migrate folks to ESR for other reasons (deprecating an OS), + // we need to add checks here for distribution IDs. + (AppConstants.IS_ESR && !excludedDistributionIDs.includes(distroId)) || + // If there are multiple policies then its enterprise. + policiesLength > 1 || + // If ImportEnterpriseRoots isn't the only policy then it's enterprise. + (policiesLength && !policies.Certificates?.ImportEnterpriseRoots); + + Services.telemetry.scalarSet("policies.is_enterprise", isEnterprise); + }, + + _chooseProvider() { + let platformProvider = null; + if (AppConstants.platform == "win" && AppConstants.MOZ_SYSTEM_POLICIES) { + platformProvider = new WindowsGPOPoliciesProvider(); + } else if ( + AppConstants.platform == "macosx" && + AppConstants.MOZ_SYSTEM_POLICIES + ) { + platformProvider = new macOSPoliciesProvider(); + } + let jsonProvider = new JSONPoliciesProvider(); + if (platformProvider && platformProvider.hasPolicies) { + if (jsonProvider.hasPolicies) { + return new CombinedProvider(platformProvider, jsonProvider); + } + return platformProvider; + } + return jsonProvider; + }, + + _activatePolicies(unparsedPolicies) { + let { schema } = ChromeUtils.importESModule( + "resource:///modules/policies/schema.sys.mjs" + ); + + for (let policyName of Object.keys(unparsedPolicies)) { + let policySchema = schema.properties[policyName]; + let policyParameters = unparsedPolicies[policyName]; + + if (!policySchema) { + lazy.log.error(`Unknown policy: ${policyName}`); + continue; + } + + if (policySchema.enterprise_only && !areEnterpriseOnlyPoliciesAllowed()) { + lazy.log.error(`Policy ${policyName} is only allowed on ESR`); + continue; + } + + let { valid: parametersAreValid, parsedValue: parsedParameters } = + lazy.JsonSchemaValidator.validate(policyParameters, policySchema, { + allowAdditionalProperties: true, + }); + + if (!parametersAreValid) { + lazy.log.error(`Invalid parameters specified for ${policyName}.`); + continue; + } + + let policyImpl = lazy.Policies[policyName]; + + if (policyImpl.validate && !policyImpl.validate(parsedParameters)) { + lazy.log.error( + `Parameters for ${policyName} did not validate successfully.` + ); + continue; + } + + this._parsedPolicies[policyName] = parsedParameters; + + for (let timing of Object.keys(this._callbacks)) { + let policyCallback = policyImpl[timing]; + if (policyCallback) { + this._schedulePolicyCallback( + timing, + policyCallback.bind( + policyImpl, + this /* the EnterprisePoliciesManager */, + parsedParameters + ) + ); + } + } + } + }, + + _callbacks: { + // The earliest that a policy callback can run. This will + // happen right after the Policy Engine itself has started, + // and before the Add-ons Manager has started. + onBeforeAddons: [], + + // This happens after all the initialization related to + // the profile has finished (prefs, places database, etc.). + onProfileAfterChange: [], + + // Just before the first browser window gets created. + onBeforeUIStartup: [], + + // Called after all windows from the last session have been + // restored (or the default window and homepage tab, if the + // session is not being restored). + // The content of the tabs themselves have not necessarily + // finished loading. + onAllWindowsRestored: [], + }, + + _schedulePolicyCallback(timing, callback) { + this._callbacks[timing].push(callback); + }, + + _runPoliciesCallbacks(timing) { + let callbacks = this._callbacks[timing]; + while (callbacks.length) { + let callback = callbacks.shift(); + try { + callback(); + } catch (ex) { + lazy.log.error("Error running ", callback, `for ${timing}:`, ex); + } + } + }, + + async _restart() { + DisallowedFeatures = {}; + + Services.ppmm.sharedData.delete("EnterprisePolicies:Status"); + Services.ppmm.sharedData.delete("EnterprisePolicies:DisallowedFeatures"); + + this._status = Ci.nsIEnterprisePolicies.UNINITIALIZED; + this._parsedPolicies = undefined; + for (let timing of Object.keys(this._callbacks)) { + this._callbacks[timing] = []; + } + + // Simulate the startup process. This step-by-step is a bit ugly but it + // tries to emulate the same behavior as of a normal startup. + let notifyTopicOnIdle = topic => + new Promise(resolve => { + ChromeUtils.idleDispatch(() => { + this.observe(null, topic, ""); + resolve(); + }); + }); + await notifyTopicOnIdle("policies-startup"); + await notifyTopicOnIdle("profile-after-change"); + await notifyTopicOnIdle("final-ui-startup"); + await notifyTopicOnIdle("sessionstore-windows-restored"); + }, + + // nsIObserver implementation + observe: function BG_observe(subject, topic, data) { + switch (topic) { + case "policies-startup": + // Before the first set of policy callbacks runs, we must + // initialize the service. + this._initialize(); + + this._runPoliciesCallbacks("onBeforeAddons"); + break; + + case "profile-after-change": + this._runPoliciesCallbacks("onProfileAfterChange"); + break; + + case "final-ui-startup": + this._runPoliciesCallbacks("onBeforeUIStartup"); + break; + + case "sessionstore-windows-restored": + this._runPoliciesCallbacks("onAllWindowsRestored"); + + // After the last set of policy callbacks ran, notify the test observer. + Services.obs.notifyObservers( + null, + "EnterprisePolicies:AllPoliciesApplied" + ); + break; + + case "EnterprisePolicies:Restart": + this._restart().then(null, console.error); + break; + } + }, + + disallowFeature(feature, neededOnContentProcess = false) { + DisallowedFeatures[feature] = neededOnContentProcess; + + // NOTE: For optimization purposes, only features marked as needed + // on content process will be passed onto the child processes. + if (neededOnContentProcess) { + Services.ppmm.sharedData.set( + "EnterprisePolicies:DisallowedFeatures", + new Set( + Object.keys(DisallowedFeatures).filter(key => DisallowedFeatures[key]) + ) + ); + } + }, + + // ------------------------------ + // public nsIEnterprisePolicies members + // ------------------------------ + + _status: Ci.nsIEnterprisePolicies.UNINITIALIZED, + + set status(val) { + this._status = val; + if (val != Ci.nsIEnterprisePolicies.INACTIVE) { + Services.ppmm.sharedData.set("EnterprisePolicies:Status", val); + } + }, + + get status() { + return this._status; + }, + + isAllowed: function BG_sanitize(feature) { + return !(feature in DisallowedFeatures); + }, + + getActivePolicies() { + return this._parsedPolicies; + }, + + setSupportMenu(supportMenu) { + SupportMenu = supportMenu; + }, + + getSupportMenu() { + return SupportMenu; + }, + + setExtensionPolicies(extensionPolicies) { + ExtensionPolicies = extensionPolicies; + }, + + getExtensionPolicy(extensionID) { + if (ExtensionPolicies && extensionID in ExtensionPolicies) { + return ExtensionPolicies[extensionID]; + } + return null; + }, + + setExtensionSettings(extensionSettings) { + ExtensionSettings = extensionSettings; + if ( + "*" in extensionSettings && + "install_sources" in extensionSettings["*"] + ) { + InstallSources = new MatchPatternSet( + extensionSettings["*"].install_sources + ); + } + }, + + getExtensionSettings(extensionID) { + let settings = null; + if (ExtensionSettings) { + if (extensionID in ExtensionSettings) { + settings = ExtensionSettings[extensionID]; + } else if ("*" in ExtensionSettings) { + settings = ExtensionSettings["*"]; + } + } + return settings; + }, + + mayInstallAddon(addon) { + // See https://dev.chromium.org/administrators/policy-list-3/extension-settings-full + if (!ExtensionSettings) { + return true; + } + if (addon.id in ExtensionSettings) { + if ("installation_mode" in ExtensionSettings[addon.id]) { + switch (ExtensionSettings[addon.id].installation_mode) { + case "blocked": + return false; + default: + return true; + } + } + } + if ("*" in ExtensionSettings) { + if ( + ExtensionSettings["*"].installation_mode && + ExtensionSettings["*"].installation_mode == "blocked" + ) { + return false; + } + if ("allowed_types" in ExtensionSettings["*"]) { + return ExtensionSettings["*"].allowed_types.includes(addon.type); + } + } + return true; + }, + + allowedInstallSource(uri) { + return InstallSources ? InstallSources.matches(uri) : true; + }, + + isExemptExecutableExtension(url, extension) { + let urlObject; + try { + urlObject = new URL(url); + } catch (e) { + return false; + } + let { hostname } = urlObject; + let exemptArray = + this.getActivePolicies() + ?.ExemptDomainFileTypePairsFromFileTypeDownloadWarnings; + if (!hostname || !extension || !exemptArray) { + return false; + } + extension = extension.toLowerCase(); + let domains = exemptArray + .filter(item => item.file_extension.toLowerCase() == extension) + .map(item => item.domains) + .flat(); + for (let domain of domains) { + if (Services.eTLD.hasRootDomain(hostname, domain)) { + return true; + } + } + return false; + }, +}; + +let DisallowedFeatures = {}; +let SupportMenu = null; +let ExtensionPolicies = null; +let ExtensionSettings = null; +let InstallSources = null; + +/** + * areEnterpriseOnlyPoliciesAllowed + * + * Checks whether the policies marked as enterprise_only in the + * schema are allowed to run on this browser. + * + * This is meant to only allow policies to run on ESR, but in practice + * we allow it to run on channels different than release, to allow + * these policies to be tested on pre-release channels. + * + * @returns {Bool} Whether the policy can run. + */ +function areEnterpriseOnlyPoliciesAllowed() { + if (Cu.isInAutomation || isXpcshell) { + if (Services.prefs.getBoolPref(PREF_DISALLOW_ENTERPRISE, false)) { + // This is used as an override to test the "enterprise_only" + // functionality itself on tests. + return false; + } + return true; + } + + return ( + AppConstants.IS_ESR || + AppConstants.MOZ_DEV_EDITION || + AppConstants.NIGHTLY_BUILD + ); +} + +/* + * JSON PROVIDER OF POLICIES + * + * This is a platform-agnostic provider which looks for + * policies specified through a policies.json file stored + * in the installation's distribution folder. + */ + +class JSONPoliciesProvider { + constructor() { + this._policies = null; + this._readData(); + } + + get hasPolicies() { + return this._policies !== null && !isEmptyObject(this._policies); + } + + get policies() { + return this._policies; + } + + get failed() { + return this._failed; + } + + _getConfigurationFile() { + let configFile = null; + + if (AppConstants.platform == "linux" && AppConstants.MOZ_SYSTEM_POLICIES) { + let systemConfigFile = Services.dirsvc.get("SysConfD", Ci.nsIFile); + systemConfigFile.append("policies"); + systemConfigFile.append(POLICIES_FILENAME); + if (systemConfigFile.exists()) { + return systemConfigFile; + } + } + + try { + let perUserPath = Services.prefs.getBoolPref(PREF_PER_USER_DIR, false); + if (perUserPath) { + configFile = Services.dirsvc.get("XREUserRunTimeDir", Ci.nsIFile); + } else { + configFile = Services.dirsvc.get("XREAppDist", Ci.nsIFile); + } + configFile.append(POLICIES_FILENAME); + } catch (ex) { + // Getting the correct directory will fail in xpcshell tests. This should + // be handled the same way as if the configFile simply does not exist. + } + + let alternatePath = Services.prefs.getStringPref(PREF_ALTERNATE_PATH, ""); + + // Check if we are in automation *before* we use the synchronous + // nsIFile.exists() function or allow the config file to be overriden + // An alternate policy path can also be used in Nightly builds (for + // testing purposes), but the Background Update Agent will be unable to + // detect the alternate policy file so the DisableAppUpdate policy may not + // work as expected. + if ( + alternatePath && + (Cu.isInAutomation || AppConstants.NIGHTLY_BUILD || isXpcshell) && + (!configFile || !configFile.exists()) + ) { + if (alternatePath.startsWith(MAGIC_TEST_ROOT_PREFIX)) { + // Intentionally not using a default value on this pref lookup. If no + // test root is set, we are not currently testing and this function + // should throw rather than returning something. + let testRoot = Services.prefs.getStringPref(PREF_TEST_ROOT); + let relativePath = alternatePath.substring( + MAGIC_TEST_ROOT_PREFIX.length + ); + if (AppConstants.platform == "win") { + relativePath = relativePath.replace(/\//g, "\\"); + } + alternatePath = testRoot + relativePath; + } + + configFile = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile); + configFile.initWithPath(alternatePath); + } + + return configFile; + } + + _readData() { + let configFile = this._getConfigurationFile(); + if (!configFile) { + // Do nothing, _policies will remain null + return; + } + try { + let data = Cu.readUTF8File(configFile); + if (data) { + lazy.log.debug(`policies.json path = ${configFile.path}`); + lazy.log.debug(`policies.json content = ${data}`); + this._policies = JSON.parse(data).policies; + + if (!this._policies) { + lazy.log.error("Policies file doesn't contain a 'policies' object"); + this._failed = true; + } + } + } catch (ex) { + if ( + ex instanceof Components.Exception && + ex.result == Cr.NS_ERROR_FILE_NOT_FOUND + ) { + // Do nothing, _policies will remain null + } else if (ex instanceof SyntaxError) { + lazy.log.error(`Error parsing JSON file: ${ex}`); + this._failed = true; + } else { + lazy.log.error(`Error reading JSON file: ${ex}`); + this._failed = true; + } + } + } +} + +class WindowsGPOPoliciesProvider { + constructor() { + this._policies = null; + + let wrk = Cc["@mozilla.org/windows-registry-key;1"].createInstance( + Ci.nsIWindowsRegKey + ); + + // Machine policies override user policies, so we read + // user policies first and then replace them if necessary. + this._readData(wrk, wrk.ROOT_KEY_CURRENT_USER); + // We don't access machine policies in testing + if (!Cu.isInAutomation && !isXpcshell) { + this._readData(wrk, wrk.ROOT_KEY_LOCAL_MACHINE); + } + } + + get hasPolicies() { + return this._policies !== null && !isEmptyObject(this._policies); + } + + get policies() { + return this._policies; + } + + get failed() { + return this._failed; + } + + _readData(wrk, root) { + try { + let regLocation = "SOFTWARE\\Policies"; + if (Cu.isInAutomation || isXpcshell) { + try { + regLocation = Services.prefs.getStringPref(PREF_ALTERNATE_GPO); + } catch (e) {} + } + wrk.open(root, regLocation, wrk.ACCESS_READ); + if (wrk.hasChild("Mozilla\\" + Services.appinfo.name)) { + lazy.log.debug( + `root = ${ + root == wrk.ROOT_KEY_CURRENT_USER + ? "HKEY_CURRENT_USER" + : "HKEY_LOCAL_MACHINE" + }` + ); + this._policies = lazy.WindowsGPOParser.readPolicies( + wrk, + this._policies + ); + } + wrk.close(); + } catch (e) { + lazy.log.error("Unable to access registry - ", e); + } + } +} + +class macOSPoliciesProvider { + constructor() { + this._policies = null; + let prefReader = Cc["@mozilla.org/mac-preferences-reader;1"].createInstance( + Ci.nsIMacPreferencesReader + ); + if (!prefReader.policiesEnabled()) { + return; + } + this._policies = lazy.macOSPoliciesParser.readPolicies(prefReader); + } + + get hasPolicies() { + return this._policies !== null && Object.keys(this._policies).length; + } + + get policies() { + return this._policies; + } + + get failed() { + return this._failed; + } +} + +class CombinedProvider { + constructor(primaryProvider, secondaryProvider) { + // Combine policies with primaryProvider taking precedence. + // We only do this for top level policies. + this._policies = primaryProvider._policies; + for (let policyName of Object.keys(secondaryProvider.policies)) { + if (!(policyName in this._policies)) { + this._policies[policyName] = secondaryProvider.policies[policyName]; + } + } + } + + get hasPolicies() { + // Combined provider always has policies. + return true; + } + + get policies() { + return this._policies; + } + + get failed() { + // Combined provider never fails. + return false; + } +} |