X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/a87f6c95bd9e8acf03d44cc69aeb324429d2950a..1108a3a6c828634f44d51fbc870f74fd64be205b:/README.md diff --git a/README.md b/README.md index 4543d91..935f7d7 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ **You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** -Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. +Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`. | Policy Name | Description | --- | --- | @@ -57,10 +57,12 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed. | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page. | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration. +| **[`Handlers`](#handlers)** | Configure default application handlers. | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts. | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed. | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation. | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin. +| **[`MasterPassword`](#masterpassword)** | Require or prevent using a master password. | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching). | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page. | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks. @@ -69,7 +71,9 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page. | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page. | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager. +| **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer. | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications. +| **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture. | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed. | **[`Preferences`](#preferences)** | Set and lock some preferences. | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading. @@ -945,7 +949,13 @@ Value (string): ### DisabledCiphers Disable specific cryptographic ciphers. -**Compatibility:** Firefox 76, Firefox ESR 68.8\ +--- +**Note:** + +This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher. + +--- +**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78)\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A @@ -960,6 +970,8 @@ Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_G Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: @@ -973,6 +985,8 @@ OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_GCM_SHA384 ``` Value (string): ``` @@ -1001,6 +1015,10 @@ Value (string): | TLS_RSA_WITH_3DES_EDE_CBC_SHA | + TLS_RSA_WITH_AES_128_GCM_SHA256 + | + TLS_RSA_WITH_AES_256_GCM_SHA384 + | ``` @@ -1018,6 +1036,8 @@ Value (string): "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false + "TLS_RSA_WITH_AES_128_GCM_SHA256": true | false + "TLS_RSA_WITH_AES_256_GCM_SHA384": true | false } } } @@ -1558,8 +1578,8 @@ Value (string): { "policies": { "DisableSecurityBypass": { - "InvalidCertificate": true false, - "SafeBrowsing": true false + "InvalidCertificate": true | false, + "SafeBrowsing": true | false } } } @@ -2069,7 +2089,7 @@ Value (string): "policies": { "EncryptedMediaExtensions": { "Enabled": true | false, - "Locked": true false + "Locked": true | false } } ``` @@ -2366,6 +2386,187 @@ Value (string): } } ``` + + + +### Handlers +Configure default application handlers. This policy is based on the internal format of `handlers.json`. + +You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`). + +Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled. + +| Name | Description | +| --- | --- | +| `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`. +| `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention. +| `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate. +|         `name` | The display name of the handler (might not be used). +|         `path`| The native path to the executable to be used. +|         `uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution. + +**Compatibility:** Firefox 78, Firefox ESR 78\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) = +{ + "mimeTypes": { + "application/msword": { + "action": "useSystemDefault", + "ask": true | false + } + }, + "schemes": { + "mailto": { + "action": "useHelperApp", + "ask": true | false, + "handlers": [{ + "name": "Gmail", + "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s" + }] + } + }, + "extensions": { + "pdf": { + "action": "useHelperApp", + "ask": true | false, + "handlers": [{ + "name": "Adobe Acrobat", + "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe" + }] + } + } +} +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers +``` +Value (string): +``` + + +``` +#### macOS +``` + + Handlers + + mimeTypes + + application/msword + + action + useSystemDefault + ask + | + + + schemes + + mailto + + action + useHelperApp + ask + | + handlers + + + name + Gmail + uriTemplate + https://mail.google.com/mail/?extsrc=mailto&url=%s + + + + + extensions + + pdf + + action + useHelperApp + ask + | + handlers + + + name + Adobe Acrobat + path + /System/Applications/Preview.app + + + + + + +``` +#### policies.json +``` +{ + "mimeTypes": { + "application/msword": { + "action": "useSystemDefault", + "ask": false + } + }, + "schemes": { + "mailto": { + "action": "useHelperApp", + "ask": true | false, + "handlers": [{ + "name": "Gmail", + "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s" + }] + } + }, + "extensions": { + "pdf": { + "action": "useHelperApp", + "ask": true | false, + "handlers": [{ + "name": "Adobe Acrobat", + "path": "/usr/bin/acroread" + }] + } + } +} +``` ### FirefoxHome Customize the Firefox Home page. @@ -2478,7 +2679,9 @@ Configure the default homepage and how Firefox starts. `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session. -**Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4)\ +With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. This allows for locking the homepage, but still allowing the user to choose whether or not they want to restore their session. + +**Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\ **CCK2 Equivalent:** `homePage`,`lockHomePage`\ **Preferences Affected:** `browser.startup.homepage`,`browser.startup.page` @@ -2488,7 +2691,7 @@ Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com" Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org" Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu" -Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" +Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked" ``` #### Windows (Intune) OMA-URI: @@ -2537,7 +2740,7 @@ Value (string): http://example.edu StartPage - none | homepage | previous-session + none | homepage | previous-session | homepage-locked ``` @@ -2550,7 +2753,7 @@ Value (string): "Locked": true | false, "Additional": ["http://example.org/", "http://example.edu/"], - "StartPage": "none" | "homepage" | "previous-session" + "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked" } } } @@ -2684,6 +2887,43 @@ Value (string): } } ``` +### MasterPassword +Require or prevent using a master password. + +If this value is true, a master password is required. If this values is false, it works the same as `DisableMasterPasswordCreation` and removes the master password functionality. + +**Compatibility:** Firefox 78, Firefox ESR 78\ +**CCK2 Equivalent:** `noMasterPassword`\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\MasterPassword = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/MasterPassword +``` +Value (string): +``` + or +``` +#### macOS +``` + + MasterPassword + | + +``` +#### policies.json +``` +{ + "policies": { + "MasterPassword": true | false + } +} +``` ### NetworkPrediction Enable or disable network prediction (DNS prefetching). @@ -2964,6 +3204,56 @@ Value (string): } } ``` +### PDFjs +Disable or configure PDF.js, the built-in PDF viewer. + +If `Enabled` is set to false, the built-in PDF viewer is disabled. + +If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text. + +Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions. + +**Compatibility:** Firefox 77, Firefox ESR 68.9\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `pdfjs.diabled`,`pdfjs.enablePermissions` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions +``` +Value (string): +``` +or +``` +#### macOS +``` + + PDFjs + + Enabled + | + + | + + +``` +#### policies.json +``` +{ + "policies": { + "PSFjs": { + "Enabled": true | false, + "EnablePermissions": true | false + } +} +``` ### Permissions Set permissions associated with camera, microphone, location, notifications, and autoplay. Because these are origins, not domains, entries with unique ports must be specified separately. See examples below. @@ -3205,6 +3495,42 @@ Value (string): } } ``` +### PictureInPicture + +Enable or disable Picture-in-Picture. + +**Compatibility:** Firefox 78, Firefox ESR 78\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\PictureInPicture = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PictureInPicture +``` +Value (string): +``` + or +``` +#### macOS +``` + + PictureInPicture + | + +``` +#### policies.json +``` +{ + "policies": { + "PictureInPicture": true | false + } +} +``` ### PopupBlocking Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.