Is there a way to disable the installation of Firefox extensions by non-admin users?
migrated from superuser.com Feb 23 '10 at 13:56
This question came from our site for computer enthusiasts and power users.
Sort of. You can apply lock down settings with mozilla.cfg. This, however, will prevent all users from using locked down features though. Administrators can of course swap in/out the config file at will.
Edit: Here's the list of settings we deploy via lock down. It's a K-12 environment, so your needs will likely vary.
I am adding a link to the official Mozilla.org docs regarding locked config settings.
If the information I have provided does not answer your question well enough, please provide additional information describing your needs.
Preventing users from installing addons is more difficult in later versions of Firefox. Firefox does not honor the xpinstall.enabled preference.
For a detailed write-up on how to modify Firefox to prevent Add-on Manager from displaying and how to prevent users from installing add-ons, check out this article.
The instructions are not for the faint of heart, but they do work; I have 700 machines locked down in a K-8 environment using these directions.
For more information on locking down browser settings, check out this article.
To block/prevent extensions (include this in the lock (policy) file):
Double slashes (//) outside code denote comments.
The (user) Scope 1 hybrid location (user profile 'extensions' folder) is the only store of the first installation method and is obsoleted by setting xpinstall.enabled to false, but is not scoped out (extensions.enabledScopes) as a discovered location (second installation method). The second code block above throws an error whenever this location appears, and Firefox exits.
To enable approved extensions via Firefox install_directory\browser\extensions, set
Alternatively (in Windows), to enable approved extensions via Windows registry HKLM, set
To enable both locations, use 12, and 3 respectively.
It's also possible to
Internal store, Centralized extensions (FoxyProxy as example):
Download and unzip FoxyProxy into a top-level subfolder in a network share (e.g. network share FxExts, and subfolder foxyproxy). Next, rename the foxyproxy subfolder with the value between the em:id tags in the unzipped install.rdf file - foxyproxy is renamed as firstname.lastname@example.org.
Next, in a text file enter the path in the first line, i.e. \\server\FxExts\email@example.com, and also rename the text file (including the .txt extension) with the em:id value - New Text Document.txt is renamed as firstname.lastname@example.org.
These text files can be distributed to existing Firefox install_directory\browser\extensions, or included in the Firefox installer core\browser\extensions.
Alternatively or additionally via registry HKLM: Name email@example.com, and Data \\server\FxExts\firstname.lastname@example.org
In either or both cases (Scopes 4 and 8):
Policy filtering (selectively apply settings in the lock file):
In Windows, Deny the Read Data permission on local-settings.js for the users/groups to be exempted. In GNU/Linux systems one option would be to set the base permissions of local-settings.js as 0600 (with root being the ug), add all users to a group (e.g. fxgrp) leaving out the to-be-exempt users, and then
Please note that using OS environment variables is unsafe as it can be bypassed, unless extra measures outside of the lock (policy) file are implemented.
Misc.: The Browser Console's command bar can be disabled by a CSS rule in a style sheet e.g.
Fx.css (style sheet) is loaded in Firefox Safe Mode too, and can specify both chrome (Firefox UI), and content (internal pages, web pages) rules. For NFS, or SMB mounts, or local filesystem, use
[userChrome and userContent].css have the highest precedence, so it would be good to check for the chrome folder too, e.g.
For the details about the nsInterfaces in Components.interfaces.* please see XPCOM interfaces.
PS: To reliably catch errors and conditions in the .cfg file of some Firefox editions, it may be necessary to put the whole lock (policy) contents inside a try block, e.g.