shell-things/etc/firefox/policies/README.md

Firefox policies.json

• https://mozilla.github.io/policy-templates/

The file is pretty self-explanatory, but I prefer Chromium way of handling enterprise policies since it allows me to cut them to multiple different files per whatever I am doing.

• WARNING TO LIBREWOLF USERS
• WARNING TO TRR/ENCRYPTED DNS USERS!
• Extensions
  • Privacy Badger
• Search engines
• Useful looking things for the future
  • Certificate installations
• Things that look useful, but aren’t
  • WebSiteFilter

WARNING TO LIBREWOLF USERS

This file takes priority over /usr/share/librewolf/distribution/policies.json so don’t apply this or a lot of LibreWolf specific customizations stops being in force.

WARNING TO TRR/ENCRYPTED DNS USERS!

If policies.json locks DNS over HTTPS, trr.mode gets locked into 2 which means fallback to system resolver.

Extensions

They are mostly self-explanatory.

Privacy Badger

• jid1-MnnxcxisBPnSXQ-eff@jetpack - Downloaded directly from EFF.

Configured to learn locally and also in incognito as opposed to only relying on vendor list. Also not display the “Welcome to Privacy Badger screen”.

See also:

• https://github.com/EFForg/privacybadger/blob/master/doc/admin-deployment.md
• https://github.com/EFForg/privacybadger/blob/master/src/data/schema.json

Search engines

Policy SearchEngines is only allowed on ESR.

But who cares? Anyway thus DuckDuckGo extension is installed by default so when testing this policy I won’t have to see Google.

Additionally it’s a lie since at least Nightly reads it too without complaining.

Useful looking things for the future

Certificate installations

In the certificates section

{
  "Install": ["my_certificate_here.pem"]
}

Things that look useful, but aren’t

WebSiteFilter

{
  "policies": {
    "WebsiteFilter": {
      "Block": ["<all_urls>"],
      "Exceptions": ["http://example.org/*"]
    }
  }
}

Ok, nice, but my policy is already forcing AdNauseam which enforces my blocklist which is more practical.

Granted users can use private browsing mode to get past it, but I am not blocking actively malicious domains.