Is there a way to disable the installation of Firefox extensions by non-admin users?
migrated from superuser.com Feb 23 '10 at 13:56
This question came from our site for computer enthusiasts and power users.
Sort of. You can apply lock down settings with mozilla.cfg. This, however, will prevent all users from using locked down features though. Administrators can of course swap in/out the config file at will.
Edit: Here's the list of settings we deploy via lock down. It's a K-12 environment, so your needs will likely vary.
I am adding a link to the official Mozilla.org docs regarding locked config settings.
If the information I have provided does not answer your question well enough, please provide additional information describing your needs.
Preventing users from installing addons is more difficult in later versions of Firefox. Firefox does not honor the xpinstall.enabled preference.
For a detailed write-up on how to modify Firefox to prevent Add-on Manager from displaying and how to prevent users from installing add-ons, check out this article.
The instructions are not for the faint of heart, but they do work; I have 700 machines locked down in a K-8 environment using these directions.
For more information on locking down browser settings, check out this article.
To block/prevent extensions (include this in the lock (policy) file):
Double slashes (//) outside code denote comments.
The (user) Scope 1 hybrid location (user profile 'extensions' folder) is the only store of the first installation method and is obsoleted by setting xpinstall.enabled to false, but is not scoped out (extensions.enabledScopes) as a discovered location (second installation method). The second code block above throws an error whenever this location appears, and Firefox exits.
To enable approved extensions (i.e. extensions in Firefox install_directory\browser\extensions), set
Alternatively (in Windows), to enable approved extensions via Windows registry HKLM, set extensions.enabledScopes to 8, and extensions.autoDisableScopes to 7.
To use both (in Windows) \extensions and HKLM, use 12, and 3 respectively.
It's also possible to
Internal store, Centralized extensions (FoxyProxy as example):
Download and unzip FoxyProxy into a top-level subfolder in a network share (e.g. network share FxExts, and subfolder foxyproxy). Next, rename the foxyproxy subfolder with the value between the em:id tags in the unzipped install.rdf file - foxyproxy is renamed as firstname.lastname@example.org.
Next, in a text file enter the path in the first line, i.e. \\server\FxExts\email@example.com, and also rename the text file (including the .txt extension) with the em:id value - New Text Document.txt is renamed as firstname.lastname@example.org.
These text files can be distributed to existing Firefox install_directory\extensions, or install_directory\browser\extensions, or included in the Fx installer core\browser\extensions.
Alternatively or additionally (in Windows) via registry HKLM: Name (String Value) email@example.com, and Data \\server\FxExts\firstname.lastname@example.org
In either or both cases (text files and registry):
To selectively apply settings in the lock file (policy filtering):
In this example three users are exempt, (or can use different settings, or different settings' values). Use lowercase for the user logon names (jack, jill, vwil). If a user logon name includes space, use quotes: "jack surname":" " Settings specified outside the conditionals (if, else, else if, etc.) would apply to all.
Misc.: The Browser Console's command bar can be disabled by a CSS rule in a style sheet e.g.
[userChrome and userContent].css have the highest precedence, so it would be good to check for the chrome folder too, e.g.
For the details about the nsInterfaces in Components.interfaces.* please see XPCOM Interfaces.
PS: To reliably catch errors and conditions in the .cfg file of some Fx editions, it may be necessary to put the whole lock (policy) contents inside a try block, e.g.