[Mozilla Enterprise] Firefox ESR Upgrade Deletes Enterprise Policies

Fri Aug 28 08:33:31 UTC 2020

Hello,

I had the same problem in my company with my patching tool. For the first 
install I used the command line /RemoveDistributionDir=false, but the 
patching tool ignores this completely when patching, and is has no option 
to specify this parameter when patching.

I ended up changing rights on the policies.json file at first install to 
deny deletion for everyone:   icacls "C:\Program Files\Mozilla 
Firefox\distribution" /deny *S-1-1-0:(OI)(CI)(DE,DC) /inheritance:d

Never encountered the disappearance of the policies.json file since that.

I hope this helps,
Mickaël

De :    Mike Kaply <mkaply at mozilla.com>
A :     Eddie Rowe <eddie.rowe at tdhca.state.tx.us>
Cc :    "enterprise at mozilla.org" <enterprise at mozilla.org>
Date :  27/08/2020 18:53
Objet : Re: [Mozilla Enterprise] Firefox ESR Upgrade Deletes Enterprise 
Policies
Envoyé par :    "Enterprise" <enterprise-bounces at mozilla.org>

That's the default behavior, but you can prevent it using a command line 
parameter.

See:

https://firefox-source-docs.mozilla.org/browser/installer/windows/installer/FullConfig.html

/RemoveDistributionDir=false 

Mike

On Thu, Aug 27, 2020 at 11:33 AM Eddie Rowe <eddie.rowe at tdhca.state.tx.us> 
wrote:
I discovered today that Firefox ESR 68.12 and Firefox 78.2 may have logic 
built into the .EXE installer to delete folders on systems containing our 
enterprise policies.  After applying the upgrade to a system I noticed the 
Enterprise policies were inactive.  Dropping to the file system I noticed 
the C:\Program files\Mozilla Firefox\Distribution\ folder was missing.  We 
use a third party tool to patch and I think it has its own issues with 
this release so all testing was done manually applying the .EXE upgrade.

Setup:
·       Windows 10 x64
·       Firefox ESR (we moved to 78 to I saw this with 78.2 and I tested 
68.12 and duplicated the behavior)
·       Policies.json file used
·       Windows Group Policy Preference refreshes our Policies.json file

Steps to Reproduce:
1.     Install/setup Firefox ESR 68.11 or 78.1 and verify policies.json 
file is in the proper folder and enterprise policies are applied ala 
about:policies
2.     Launch the upgrade (.EXE installer) and as soon as the dialog 
appears “Doing a Little Housekeeping” you will notice the C:\Program 
files\Mozilla Firefox\Distribution\ disappears
3.     Group Policy will eventually replace the files, but if the browser 
is closed and launched when the files are missing, all the hard work to 
harden Firefox goes by the wayside.  
_______________________________________________
Enterprise mailing list
Enterprise at mozilla.org
https://mail.mozilla.org/listinfo/enterprise

To unsubscribe from this list, please visit 
https://mail.mozilla.org/listinfo/enterprise or send an email to 
enterprise-request at mozilla.org with a subject of "unsubscribe"
_______________________________________________
Enterprise mailing list
Enterprise at mozilla.org
https://mail.mozilla.org/listinfo/enterprise

To unsubscribe from this list, please visit 
https://mail.mozilla.org/listinfo/enterprise or send an email to 
enterprise-request at mozilla.org with a subject of "unsubscribe"

Mickael CINIER

 64 bis avenue Aubert 94300 VINCENNES
 01.73.73.56.05 - 

	Découvrez notre rapport annuel Fonds de garantie.

Voir le rapport

Consultez notre site internet www.fondsdegarantie.fr

Ce courrier électronique et ses éventuelles pièces jointes, envoyés par le 
Fonds de garantie, sont établis à l'intention exclusive de leur destinataire. 
Ils sont confidentiels, couverts et protégés par le secret professionnel. Si 
vous n'êtes pas destinataire de ce message, il vous est strictement interdit de 
le garder, de le distribuer, de le faire suivre ou de le copier. Merci d'en 
avertir immédiatement l'expéditeur par un message en retour et de supprimer la 
transmission originale.  Toute opinion exprimée dans ce message est personnelle 
à son auteur et ne saurait  nécessairement refléter celle du Fonds de garantie. 
L'Internet ne permettant pas d'assurer l'intégrité de ce message, le Fonds de 
garantie décline toute responsabilité au titre de ce message, dans l'hypothèse 
où il  aurait été modifié. La présence de cette note prouve également que ce 
message électronique a été vérifié  par un logiciel antivirus.

This e-mail and any attachment thereto, sent by Fonds de garantie, are intended 
solely for the addressee. It may contain privileged or confidential 
informations. If you are not the entended recipient, any retention, 
dissemination, distribution or copying of this message is strictly prohibited. 
If you have received this message in error, please notify the sender 
immediately by return e-mail and delete the original transmission.  Any opinion 
expressed in this message may be personal to the author and may not necessarily 
reflect the opinion of Fonds de garantie. As the Internet cannot guarantee the 
integrity of this message, Fonds de garantie will not therefore be liable for 
the message if modified. Presence of this message also proves that an antivirus 
program has checked this e-mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20200828/06ff19dd/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 19056 bytes
Desc: not available
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20200828/06ff19dd/attachment.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 968 bytes
Desc: not available
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20200828/06ff19dd/attachment-0001.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 965 bytes
Desc: not available
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20200828/06ff19dd/attachment-0002.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 13676 bytes
Desc: not available
URL: <http://mail.mozilla.org/pipermail/enterprise/attachments/20200828/06ff19dd/attachment-0003.jpe>