X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/9cc250613f8038e7ce99f720bf8fb7799d9a28f8..f3926a1c009d70169d94f89e826371bba3ef3b5e:/docs/index.md diff --git a/docs/index.md b/docs/index.md index 1befebd..c4ab917 100644 --- a/docs/index.md +++ b/docs/index.md @@ -676,7 +676,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/AutoLaunchProtocolsFromOriginsOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOriginsOneLine ``` Value (string): ``` @@ -954,7 +954,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/BookmarksOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BookmarksOneLine ``` Value (string): ``` @@ -1199,7 +1199,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ContainersOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ContainersOneLine ``` Value (string): ``` @@ -1246,7 +1246,7 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati `AgentName` is the name of the DLP agent. This is used in dialogs and notifications about DLP operations. The default is "A DLP Agent". -`AgentTimeout` is the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `DefaultResult` is set to 1 or 2. The default is 30. +`AgentTimeout` is the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `TimeoutResult` is set to 1 or 2. The default is 300. `AllowUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be allowed without consulting the agent. The default is "^about:(?!blank|srcdoc).*", meaning that any pages that start with "about:" will be exempt from DLP except for "about:blank" and "about:srcdoc", as these can be controlled by web content. @@ -1266,15 +1266,41 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati `Enabled` indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2. +`InterceptionPoints` controls settings for specific interception points. + +* The `Clipboard` entry controls clipboard operations for files and text. + * `Enabled` indicates whether clipboard operations should use DLP. The default is true. + * `PlainTextOnly` indicates whether to only analyze the text/plain format on the clipboard. If this + value is false, all formats will be analyzed, which some DLP agents may not expect. Regardless of + this value, files will be analyzed as usual. The default is true. +* The `DragAndDrop` entry controls drag and drop operations for files and text. + * `Enabled` indicates whether drag and drop operations should use DLP. The default is true. + * `PlainTextOnly` indicates whether to only analyze the text/plain format in what is being dropped. + If this value is false, all formats will be analyzed, which some DLP agents may not expect. + Regardless of this value, files will be analyzed as usual. The default is true. +* The `FileUpload` entry controls file upload operations for files chosen from the file picker. + * `Enabled` indicates whether file upload operations should use DLP. The default is true. +* The `Print` entry controls print operation. + * `Enabled` indicates whether print operations should use DLP. The default is true. + `IsPerUser` indicates whether the pipe the DLP agent has created is per-user or per-system. The default is true, meaning per-user. `PipePathName` is the name of the pipe the DLP agent has created and Firefox will connect to. The default is "path_user". `ShowBlockedResult` indicates whether Firefox should show a notification when a DLP request is denied. The default is true. -**Compatibility:** Firefox 132\ +`TimeoutResult` indicates the desired behavior for DLP requests if the DLP agent does not respond to a request in less than `AgentTimeout` seconds. The default is 0. + +| Value | Description +| --- | --- | +| 0 | Deny the request (default) +| 1 | Warn the user and allow them to choose whether to allow or deny +| 2 | Allow the request + + +**Compatibility:** Firefox 137\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result` +**Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result` #### Windows (GPO) ``` @@ -1286,9 +1312,16 @@ Software\Policies\Mozilla\Firefox\ContentAnalysis\ClientSignature = "My DLP Comp Software\Policies\Mozilla\Firefox\ContentAnalysis\DefaultResult = 0x0 | 0x1 | 0x2 Software\Policies\Mozilla\Firefox\ContentAnalysis\DenyUrlRegexList = "https://example\.com/.* https://subdomain\.example\.com/.*" Software\Policies\Mozilla\Firefox\ContentAnalysis\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Clipboard\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Clipboard\PlainTextOnly = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\DragAndDrop\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\DragAndDrop\PlainTextOnly = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\FileUpload\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Print\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\IsPerUser = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\PipePathName = "pipe_custom_name" Software\Policies\Mozilla\Firefox\ContentAnalysis\ShowBlockedResult = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\TimeoutResult = 0x0 | 0x1 | 0x2 ``` #### Windows (Intune) @@ -1317,6 +1350,7 @@ OMA-URI: Value (string): ``` +``` ``` OMA-URI: @@ -1363,6 +1397,53 @@ Value (string): or ``` OMA-URI: +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints~Clipboard/ContentAnalysis_InterceptionPoints_Clipboard +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints~Clipboard/ContentAnalysis_InterceptionPoints_Clipboard_PlainTextOnly +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints~DragAndDrop/ContentAnalysis_InterceptionPoints_DragAndDrop +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints~DragAndDrop/ContentAnalysis_InterceptionPoints_DragAndDrop_PlainTextOnly +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints/ContentAnalysis_InterceptionPoints_FileUpload_Enabled +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis~InterceptionPoints/ContentAnalysis_InterceptionPoints_Print_Enabled +``` +Value (string): +``` + or +``` +OMA-URI: ``` ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_IsPerUser ``` @@ -1387,6 +1468,15 @@ Value (string): ``` or ``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_TimeoutResult +``` +Value (string): +``` + + +``` #### policies.json ``` @@ -1401,9 +1491,26 @@ Value (string): "DefaultResult": 0 | 1 | 2, "DenyUrlRegexList": "https://example\.com/.* https://subdomain\.example\.com/.*", "Enabled": true | false, + "InterceptionPoints": { + "Clipboard": { + "Enabled": true | false, + "PlainTextOnly": true | false + }, + "DragAndDrop": { + "Enabled": true | false, + "PlainTextOnly": true | false + }, + "FileUpload": { + "Enabled": true | false + }, + "Print": { + "Enabled": true | false + } + }, "IsPerUser": true | false, "PipePathName": "pipe_custom_name", "ShowBlockedResult": true | false, + "TimeoutResult": 0 | 1 | 2, } } } @@ -2476,7 +2583,7 @@ This policy only works on Windows through GPO (not policies.json). #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: @@ -2966,7 +3073,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine ``` Value (string): ``` @@ -3113,6 +3220,7 @@ The configuration for each extension is another dictionary that can contain the | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension. | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`. | `temporarily_allow_weak_signatures`| (Firefox 127) A boolean that indicates whether to allow installing extensions signed using deprecated signature algorithms. +| `private_browsing`| (Firefox 136, Firefox ESR 128.8) A boolean that indicates whether or not this extension should be enabled in private browsing. **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\ **CCK2 Equivalent:** N/A\ @@ -3166,8 +3274,7 @@ Value (string): "installation_mode": "force_installed", "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi" }, - { - "https-everywhere@eff.org": { + "https-everywhere@eff.org": { "installation_mode": "allowed", "updates_disabled": false } @@ -3584,7 +3691,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/HandlersOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HandlersOneLine ``` Value (string): ``` @@ -4200,7 +4307,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ManagedBoomarksOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBoomarksOneLine ``` Value (string): ``` @@ -5252,6 +5359,8 @@ Set and lock preferences. Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences. +**NOTE** There are too many preferences for us to provide documentation on them all. The source file [StaticPrefList.yaml](https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml) contains information on many of them. + Preferences that start with the following prefixes are supported: ``` accessibility. @@ -5265,6 +5374,7 @@ general.autoScroll (Firefox 83, Firefox ESR 78.5) general.smoothScroll (Firefox 83, Firefox ESR 78.5) geo. gfx. +identity.fxaccounts.toolbar (Firefox 133) intl. keyword.enabled (Firefox 95, Firefox ESR 91.4) layers. @@ -5314,6 +5424,12 @@ as well as the following security preferences: |      If true, if an OCSP request times out, the connection fails. | security.osclientcerts.assume_rsa_pss_support | boolean | true |      If false, we don't assume an RSA key can do RSA-PSS. (Firefox 114, Firefox ESR 102.12) +| security.pki.certificate_transparency.disable_for_hosts | | +|      See [this page](https://searchfox.org/mozilla-central/rev/d1fbe983fb7720f0a4aca0e748817af11c1a374e/modules/libpref/init/StaticPrefList.yaml#16334) for more details. +| security.pki.certificate_transparency.disable_for_spki_hashes | | +|      See [this page](https://searchfox.org/mozilla-central/rev/d1fbe983fb7720f0a4aca0e748817af11c1a374e/modules/libpref/init/StaticPrefList.yaml#16344) for more details. +| security.pki.certificate_transparency.mode | integer | 0 +|      Configures Certificate Transparency support mode (Firefox 133) | security.ssl.enable_ocsp_stapling | boolean | true |      If false, OCSP stapling is not enabled. | security.ssl.errorReporting.enabled | boolean | true @@ -5403,7 +5519,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/PreferencesOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PreferencesOneLine ``` Value (string): ``` @@ -5899,11 +6015,11 @@ Note: Starting with Firefox 128, History clears FormData and Downloads as well. `Cookies` -`Downloads` Download History (*Deprecated*) +`Downloads` Download History (*Deprecated - part of History*) -`FormData` Form & Search History (*Deprecated*) +`FormData` Form & Search History -`History` Browsing History, Download History, Form & Search History. +`History` Browsing History, Download History `Sessions` Active Logins @@ -5915,7 +6031,7 @@ Note: Starting with Firefox 128, History clears FormData and Downloads as well. **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6, History update in Firefox 128)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.historyFormDataAndDownloads` (Firefox 128), `privacy.clearOnShutdown_v2.cookiesAndStorage` (Firefox 128), `privacy.clearOnShutdown_v2.cache` (Firefox 128), `privacy.clearOnShutdown_v2.siteSettings` (Firefox 128) +**Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.historyFormDataAndDownloads` (Firefox 128), `privacy.clearOnShutdown_v2.cookiesAndStorage` (Firefox 128), `privacy.clearOnShutdown_v2.cache` (Firefox 128), `privacy.clearOnShutdown_v2.siteSettings` (Firefox 128), `privacy.clearOnShutdown_v2.formdata` (Firefox 128) #### Windows (GPO) ``` @@ -6859,7 +6975,7 @@ to workaround the limit on the length of strings. Put all of your JSON on one li OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/WebsiteFilterOneLine +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WebsiteFilterOneLine ``` Value (string): ```