?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
gpo: Test certificate policy without NDES
[Samba.git] / python / samba / tests / gpo.py
bloba6a33ea4ba1f454109bbcaae9ee4cf8155b373e2
1 # Unix SMB/CIFS implementation. Tests for smb manipulation
2 # Copyright (C) David Mulder <dmulder@suse.com> 2018
3 #
4 # This program is free software; you can redistribute it and/or modify
5 # it under the terms of the GNU General Public License as published by
6 # the Free Software Foundation; either version 3 of the License, or
7 # (at your option) any later version.
8 #
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13 #
14 # You should have received a copy of the GNU General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16
17 import os, grp, pwd
18 import errno
19 from samba import gpo, tests
20 from samba.gp.gpclass import register_gp_extension, list_gp_extensions, \
21 unregister_gp_extension, GPOStorage, get_gpo_list
22 from samba.param import LoadParm
23 from samba.gp.gpclass import check_refresh_gpo_list, check_safe_path, \
24 check_guid, parse_gpext_conf, atomic_write_conf, get_deleted_gpos_list
25 from subprocess import Popen, PIPE
26 from tempfile import NamedTemporaryFile, TemporaryDirectory
27 from samba.gp import gpclass
28 # Disable privilege dropping for testing
29 gpclass.drop_privileges = lambda _, func, *args : func(*args)
30 from samba.gp.gp_sec_ext import gp_krb_ext, gp_access_ext
31 from samba.gp.gp_scripts_ext import gp_scripts_ext, gp_user_scripts_ext
32 from samba.gp.gp_sudoers_ext import gp_sudoers_ext
33 from samba.gp.vgp_sudoers_ext import vgp_sudoers_ext
34 from samba.gp.vgp_symlink_ext import vgp_symlink_ext
35 from samba.gp.gpclass import gp_inf_ext
36 from samba.gp.gp_smb_conf_ext import gp_smb_conf_ext
37 from samba.gp.vgp_files_ext import vgp_files_ext
38 from samba.gp.vgp_openssh_ext import vgp_openssh_ext
39 from samba.gp.vgp_startup_scripts_ext import vgp_startup_scripts_ext
40 from samba.gp.vgp_motd_ext import vgp_motd_ext
41 from samba.gp.vgp_issue_ext import vgp_issue_ext
42 from samba.gp.vgp_access_ext import vgp_access_ext
43 from samba.gp.gp_gnome_settings_ext import gp_gnome_settings_ext
44 from samba.gp import gp_cert_auto_enroll_ext as cae
45 from samba.gp.gp_firefox_ext import gp_firefox_ext
46 from samba.gp.gp_chromium_ext import gp_chromium_ext
47 from samba.gp.gp_firewalld_ext import gp_firewalld_ext
48 from samba.credentials import Credentials
49 from samba.gp.gp_msgs_ext import gp_msgs_ext
50 from samba.gp.gp_centrify_sudoers_ext import gp_centrify_sudoers_ext
51 from samba.gp.gp_centrify_crontab_ext import gp_centrify_crontab_ext, \
52 gp_user_centrify_crontab_ext
53 from samba.common import get_bytes
54 from samba.dcerpc import preg
55 from samba.ndr import ndr_pack
56 import codecs
57 from shutil import copyfile
58 import xml.etree.ElementTree as etree
59 import hashlib
60 from samba.gp_parse.gp_pol import GPPolParser
61 from glob import glob
62 from configparser import ConfigParser
63 from samba.gp.gpclass import get_dc_hostname
64 from samba import Ldb
65 import ldb as _ldb
66 from samba.auth import system_session
67 import json
68 from shutil import which
69 import requests
70 from cryptography import x509
71 from cryptography.hazmat.primitives import hashes
72 from cryptography.hazmat.backends import default_backend
73 from cryptography.hazmat.primitives.asymmetric import rsa
74 from cryptography.hazmat.primitives.serialization import Encoding
75 from datetime import datetime, timedelta
76 from samba.samba3 import param as s3param
77
78 def dummy_certificate():
79 name = x509.Name([
80 x509.NameAttribute(x509.NameOID.COMMON_NAME,
81 os.environ.get('SERVER'))
82 ])
83 cons = x509.BasicConstraints(ca=True, path_length=0)
84 now = datetime.utcnow()
85
86 key = rsa.generate_private_key(public_exponent=65537, key_size=2048,
87 backend=default_backend())
88
89 cert = (
90 x509.CertificateBuilder()
91 .subject_name(name)
92 .issuer_name(name)
93 .public_key(key.public_key())
94 .serial_number(1000)
95 .not_valid_before(now)
96 .not_valid_after(now + timedelta(seconds=300))
97 .add_extension(cons, False)
98 .sign(key, hashes.SHA256(), default_backend())
99 )
100
101 return cert.public_bytes(encoding=Encoding.DER)
102
103 # Dummy requests structure for Certificate Auto Enrollment
104 class dummy_requests(object):
105 class exceptions(object):
106 ConnectionError = Exception
107
108 def __init__(self, want_exception=False):
109 self.want_exception = want_exception
110
111 def get(self, url=None, params=None):
112 if self.want_exception:
113 raise self.exceptions.ConnectionError
114
115 dummy = requests.Response()
116 dummy._content = dummy_certificate()
117 dummy.headers = {'Content-Type': 'application/x-x509-ca-cert'}
118 return dummy
119
120 realm = os.environ.get('REALM')
121 policies = realm + '/POLICIES'
122 realm = realm.lower()
123 poldir = r'\\{0}\sysvol\{0}\Policies'.format(realm)
124 # the first part of the base DN varies by testenv. Work it out from the realm
125 base_dn = 'DC={0},DC=samba,DC=example,DC=com'.format(realm.split('.')[0])
126 dspath = 'CN=Policies,CN=System,' + base_dn
127 gpt_data = '[General]\nVersion=%d'
128
129 gnome_test_reg_pol = \
130 br"""
131 <?xml version="1.0" encoding="utf-8"?>
132 <PolFile num_entries="26" signature="PReg" version="1">
133 <Entry type="4" type_name="REG_DWORD">
134 <Key>GNOME Settings\Lock Down Settings</Key>
135 <ValueName>Lock Down Enabled Extensions</ValueName>
136 <Value>1</Value>
137 </Entry>
138 <Entry type="4" type_name="REG_DWORD">
139 <Key>GNOME Settings\Lock Down Settings</Key>
140 <ValueName>Lock Down Specific Settings</ValueName>
141 <Value>1</Value>
142 </Entry>
143 <Entry type="4" type_name="REG_DWORD">
144 <Key>GNOME Settings\Lock Down Settings</Key>
145 <ValueName>Disable Printing</ValueName>
146 <Value>1</Value>
147 </Entry>
148 <Entry type="4" type_name="REG_DWORD">
149 <Key>GNOME Settings\Lock Down Settings</Key>
150 <ValueName>Disable File Saving</ValueName>
151 <Value>1</Value>
152 </Entry>
153 <Entry type="4" type_name="REG_DWORD">
154 <Key>GNOME Settings\Lock Down Settings</Key>
155 <ValueName>Disable Command-Line Access</ValueName>
156 <Value>1</Value>
157 </Entry>
158 <Entry type="4" type_name="REG_DWORD">
159 <Key>GNOME Settings\Lock Down Settings</Key>
160 <ValueName>Disallow Login Using a Fingerprint</ValueName>
161 <Value>1</Value>
162 </Entry>
163 <Entry type="4" type_name="REG_DWORD">
164 <Key>GNOME Settings\Lock Down Settings</Key>
165 <ValueName>Disable User Logout</ValueName>
166 <Value>1</Value>
167 </Entry>
168 <Entry type="4" type_name="REG_DWORD">
169 <Key>GNOME Settings\Lock Down Settings</Key>
170 <ValueName>Disable User Switching</ValueName>
171 <Value>1</Value>
172 </Entry>
173 <Entry type="4" type_name="REG_DWORD">
174 <Key>GNOME Settings\Lock Down Settings</Key>
175 <ValueName>Disable Repartitioning</ValueName>
176 <Value>1</Value>
177 </Entry>
178 <Entry type="4" type_name="REG_DWORD">
179 <Key>GNOME Settings\Lock Down Settings</Key>
180 <ValueName>Whitelisted Online Accounts</ValueName>
181 <Value>1</Value>
182 </Entry>
183 <Entry type="4" type_name="REG_DWORD">
184 <Key>GNOME Settings\Lock Down Settings</Key>
185 <ValueName>Compose Key</ValueName>
186 <Value>1</Value>
187 </Entry>
188 <Entry type="4" type_name="REG_DWORD">
189 <Key>GNOME Settings\Lock Down Settings</Key>
190 <ValueName>Dim Screen when User is Idle</ValueName>
191 <Value>1</Value>
192 </Entry>
193 <Entry type="4" type_name="REG_DWORD">
194 <Key>GNOME Settings\Lock Down Settings</Key>
195 <ValueName>Enabled Extensions</ValueName>
196 <Value>1</Value>
197 </Entry>
198 <Entry type="1" type_name="REG_SZ">
199 <Key>GNOME Settings\Lock Down Settings\Compose Key</Key>
200 <ValueName>Key Name</ValueName>
201 <Value>Right Alt</Value>
202 </Entry>
203 <Entry type="4" type_name="REG_DWORD">
204 <Key>GNOME Settings\Lock Down Settings\Dim Screen when User is Idle</Key>
205 <ValueName>Delay</ValueName>
206 <Value>300</Value>
207 </Entry>
208 <Entry type="4" type_name="REG_DWORD">
209 <Key>GNOME Settings\Lock Down Settings\Dim Screen when User is Idle</Key>
210 <ValueName>Dim Idle Brightness</ValueName>
211 <Value>30</Value>
212 </Entry>
213 <Entry type="1" type_name="REG_SZ">
214 <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
215 <ValueName>**delvals.</ValueName>
216 <Value> </Value>
217 </Entry>
218 <Entry type="1" type_name="REG_SZ">
219 <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
220 <ValueName>myextension1@myname.example.com</ValueName>
221 <Value>myextension1@myname.example.com</Value>
222 </Entry>
223 <Entry type="1" type_name="REG_SZ">
224 <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
225 <ValueName>myextension2@myname.example.com</ValueName>
226 <Value>myextension2@myname.example.com</Value>
227 </Entry>
228 <Entry type="1" type_name="REG_SZ">
229 <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
230 <ValueName>**delvals.</ValueName>
231 <Value> </Value>
232 </Entry>
233 <Entry type="1" type_name="REG_SZ">
234 <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
235 <ValueName>/org/gnome/desktop/background/picture-uri</ValueName>
236 <Value>/org/gnome/desktop/background/picture-uri</Value>
237 </Entry>
238 <Entry type="1" type_name="REG_SZ">
239 <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
240 <ValueName>/org/gnome/desktop/background/picture-options</ValueName>
241 <Value>/org/gnome/desktop/background/picture-options</Value>
242 </Entry>
243 <Entry type="1" type_name="REG_SZ">
244 <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
245 <ValueName>/org/gnome/desktop/background/primary-color</ValueName>
246 <Value>/org/gnome/desktop/background/primary-color</Value>
247 </Entry>
248 <Entry type="1" type_name="REG_SZ">
249 <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
250 <ValueName>/org/gnome/desktop/background/secondary-color</ValueName>
251 <Value>/org/gnome/desktop/background/secondary-color</Value>
252 </Entry>
253 <Entry type="1" type_name="REG_SZ">
254 <Key>GNOME Settings\Lock Down Settings\Whitelisted Online Accounts</Key>
255 <ValueName>**delvals.</ValueName>
256 <Value> </Value>
257 </Entry>
258 <Entry type="1" type_name="REG_SZ">
259 <Key>GNOME Settings\Lock Down Settings\Whitelisted Online Accounts</Key>
260 <ValueName>google</ValueName>
261 <Value>google</Value>
262 </Entry>
263 </PolFile>
264 """
265
266 auto_enroll_reg_pol = \
267 br"""
268 <?xml version="1.0" encoding="utf-8"?>
269 <PolFile num_entries="3" signature="PReg" version="1">
270 <Entry type="4" type_name="REG_DWORD">
271 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
272 <ValueName>AEPolicy</ValueName>
273 <Value>7</Value>
274 </Entry>
275 <Entry type="4" type_name="REG_DWORD">
276 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
277 <ValueName>OfflineExpirationPercent</ValueName>
278 <Value>10</Value>
279 </Entry>
280 <Entry type="1" type_name="REG_SZ">
281 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
282 <ValueName>OfflineExpirationStoreNames</ValueName>
283 <Value>MY</Value>
284 </Entry>
285 </PolFile>
286 """
287
288 auto_enroll_unchecked_reg_pol = \
289 br"""
290 <?xml version="1.0" encoding="utf-8"?>
291 <PolFile num_entries="3" signature="PReg" version="1">
292 <Entry type="4" type_name="REG_DWORD">
293 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
294 <ValueName>AEPolicy</ValueName>
295 <Value>0</Value>
296 </Entry>
297 <Entry type="4" type_name="REG_DWORD">
298 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
299 <ValueName>OfflineExpirationPercent</ValueName>
300 <Value>10</Value>
301 </Entry>
302 <Entry type="1" type_name="REG_SZ">
303 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
304 <ValueName>OfflineExpirationStoreNames</ValueName>
305 <Value>MY</Value>
306 </Entry>
307 </PolFile>
308 """
309
310 advanced_enroll_reg_pol = \
311 br"""
312 <?xml version="1.0" encoding="utf-8"?>
313 <PolFile num_entries="30" signature="PReg" version="1">
314 <Entry type="1" type_name="REG_SZ">
315 <Key>Software\Policies\Microsoft\Cryptography</Key>
316 <ValueName>**DeleteKeys</ValueName>
317 <Value>Software\Policies\Microsoft\Cryptography\PolicyServers</Value>
318 </Entry>
319 <Entry type="4" type_name="REG_DWORD">
320 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
321 <ValueName>AEPolicy</ValueName>
322 <Value>7</Value>
323 </Entry>
324 <Entry type="4" type_name="REG_DWORD">
325 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
326 <ValueName>OfflineExpirationPercent</ValueName>
327 <Value>25</Value>
328 </Entry>
329 <Entry type="1" type_name="REG_SZ">
330 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
331 <ValueName>OfflineExpirationStoreNames</ValueName>
332 <Value>MY</Value>
333 </Entry>
334 <Entry type="1" type_name="REG_SZ">
335 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers</Key>
336 <ValueName/>
337 <Value>{5AD0BE6D-3393-4940-BFC3-6E19555A8919}</Value>
338 </Entry>
339 <Entry type="4" type_name="REG_DWORD">
340 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers</Key>
341 <ValueName>Flags</ValueName>
342 <Value>0</Value>
343 </Entry>
344 <Entry type="1" type_name="REG_SZ">
345 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
346 <ValueName>URL</ValueName>
347 <Value>LDAP:</Value>
348 </Entry>
349 <Entry type="1" type_name="REG_SZ">
350 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
351 <ValueName>PolicyID</ValueName>
352 <Value>%s</Value>
353 </Entry>
354 <Entry type="1" type_name="REG_SZ">
355 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
356 <ValueName>FriendlyName</ValueName>
357 <Value>Example</Value>
358 </Entry>
359 <Entry type="4" type_name="REG_DWORD">
360 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
361 <ValueName>Flags</ValueName>
362 <Value>16</Value>
363 </Entry>
364 <Entry type="4" type_name="REG_DWORD">
365 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
366 <ValueName>AuthFlags</ValueName>
367 <Value>2</Value>
368 </Entry>
369 <Entry type="4" type_name="REG_DWORD">
370 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
371 <ValueName>Cost</ValueName>
372 <Value>2147483645</Value>
373 </Entry>
374 <Entry type="1" type_name="REG_SZ">
375 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
376 <ValueName>URL</ValueName>
377 <Value>https://example2.com/ADPolicyProvider_CEP_Certificate/service.svc/CEP</Value>
378 </Entry>
379 <Entry type="1" type_name="REG_SZ">
380 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
381 <ValueName>PolicyID</ValueName>
382 <Value>%s</Value>
383 </Entry>
384 <Entry type="1" type_name="REG_SZ">
385 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
386 <ValueName>FriendlyName</ValueName>
387 <Value>Example2</Value>
388 </Entry>
389 <Entry type="4" type_name="REG_DWORD">
390 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
391 <ValueName>Flags</ValueName>
392 <Value>16</Value>
393 </Entry>
394 <Entry type="4" type_name="REG_DWORD">
395 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
396 <ValueName>AuthFlags</ValueName>
397 <Value>8</Value>
398 </Entry>
399 <Entry type="4" type_name="REG_DWORD">
400 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
401 <ValueName>Cost</ValueName>
402 <Value>10</Value>
403 </Entry>
404 <Entry type="1" type_name="REG_SZ">
405 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
406 <ValueName>URL</ValueName>
407 <Value>https://example0.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP</Value>
408 </Entry>
409 <Entry type="1" type_name="REG_SZ">
410 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
411 <ValueName>PolicyID</ValueName>
412 <Value>%s</Value>
413 </Entry>
414 <Entry type="1" type_name="REG_SZ">
415 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
416 <ValueName>FriendlyName</ValueName>
417 <Value>Example0</Value>
418 </Entry>
419 <Entry type="4" type_name="REG_DWORD">
420 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
421 <ValueName>Flags</ValueName>
422 <Value>16</Value>
423 </Entry>
424 <Entry type="4" type_name="REG_DWORD">
425 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
426 <ValueName>AuthFlags</ValueName>
427 <Value>2</Value>
428 </Entry>
429 <Entry type="4" type_name="REG_DWORD">
430 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
431 <ValueName>Cost</ValueName>
432 <Value>1</Value>
433 </Entry>
434 <Entry type="1" type_name="REG_SZ">
435 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
436 <ValueName>URL</ValueName>
437 <Value>https://example1.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP</Value>
438 </Entry>
439 <Entry type="1" type_name="REG_SZ">
440 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
441 <ValueName>PolicyID</ValueName>
442 <Value>%s</Value>
443 </Entry>
444 <Entry type="1" type_name="REG_SZ">
445 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
446 <ValueName>FriendlyName</ValueName>
447 <Value>Example1</Value>
448 </Entry>
449 <Entry type="4" type_name="REG_DWORD">
450 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
451 <ValueName>Flags</ValueName>
452 <Value>16</Value>
453 </Entry>
454 <Entry type="4" type_name="REG_DWORD">
455 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
456 <ValueName>AuthFlags</ValueName>
457 <Value>2</Value>
458 </Entry>
459 <Entry type="4" type_name="REG_DWORD">
460 <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
461 <ValueName>Cost</ValueName>
462 <Value>1</Value>
463 </Entry>
464 </PolFile>
465 """
466
467 firefox_reg_pol = \
468 b"""
469 <?xml version="1.0" encoding="utf-8"?>
470 <PolFile num_entries="241" signature="PReg" version="1">
471 <Entry type="7" type_name="REG_MULTI_SZ">
472 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
473 <ValueName>ExtensionSettings</ValueName>
474 <Value>{ &quot;*&quot;: { &quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;install_sources&quot;: [&quot;about:addons&quot;,&quot;https://addons.mozilla.org/&quot;], &quot;installation_mode&quot;: &quot;blocked&quot;, &quot;allowed_types&quot;: [&quot;extension&quot;] }, &quot;uBlock0@raymondhill.net&quot;: { &quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;install_url&quot;: &quot;https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi&quot; }, &quot;https-everywhere@eff.org&quot;: { &quot;installation_mode&quot;: &quot;allowed&quot; } }</Value>
475 </Entry>
476 <Entry type="4" type_name="REG_DWORD">
477 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
478 <ValueName>ExtensionUpdate</ValueName>
479 <Value>1</Value>
480 </Entry>
481 <Entry type="4" type_name="REG_DWORD">
482 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
483 <ValueName>SearchSuggestEnabled</ValueName>
484 <Value>1</Value>
485 </Entry>
486 <Entry type="4" type_name="REG_DWORD">
487 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
488 <ValueName>AppAutoUpdate</ValueName>
489 <Value>1</Value>
490 </Entry>
491 <Entry type="1" type_name="REG_SZ">
492 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
493 <ValueName>AppUpdateURL</ValueName>
494 <Value>https://yoursite.com</Value>
495 </Entry>
496 <Entry type="4" type_name="REG_DWORD">
497 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
498 <ValueName>BlockAboutAddons</ValueName>
499 <Value>1</Value>
500 </Entry>
501 <Entry type="4" type_name="REG_DWORD">
502 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
503 <ValueName>BlockAboutConfig</ValueName>
504 <Value>1</Value>
505 </Entry>
506 <Entry type="4" type_name="REG_DWORD">
507 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
508 <ValueName>BlockAboutProfiles</ValueName>
509 <Value>1</Value>
510 </Entry>
511 <Entry type="4" type_name="REG_DWORD">
512 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
513 <ValueName>BlockAboutSupport</ValueName>
514 <Value>1</Value>
515 </Entry>
516 <Entry type="4" type_name="REG_DWORD">
517 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
518 <ValueName>CaptivePortal</ValueName>
519 <Value>1</Value>
520 </Entry>
521 <Entry type="2" type_name="REG_EXPAND_SZ">
522 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
523 <ValueName>DefaultDownloadDirectory</ValueName>
524 <Value>${home}/Downloads</Value>
525 </Entry>
526 <Entry type="4" type_name="REG_DWORD">
527 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
528 <ValueName>DisableAppUpdate</ValueName>
529 <Value>1</Value>
530 </Entry>
531 <Entry type="4" type_name="REG_DWORD">
532 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
533 <ValueName>DisableBuiltinPDFViewer</ValueName>
534 <Value>1</Value>
535 </Entry>
536 <Entry type="4" type_name="REG_DWORD">
537 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
538 <ValueName>DisableDefaultBrowserAgent</ValueName>
539 <Value>1</Value>
540 </Entry>
541 <Entry type="4" type_name="REG_DWORD">
542 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
543 <ValueName>DisableDeveloperTools</ValueName>
544 <Value>1</Value>
545 </Entry>
546 <Entry type="4" type_name="REG_DWORD">
547 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
548 <ValueName>DisableFeedbackCommands</ValueName>
549 <Value>1</Value>
550 </Entry>
551 <Entry type="4" type_name="REG_DWORD">
552 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
553 <ValueName>DisableFirefoxAccounts</ValueName>
554 <Value>1</Value>
555 </Entry>
556 <Entry type="4" type_name="REG_DWORD">
557 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
558 <ValueName>DisableFirefoxScreenshots</ValueName>
559 <Value>1</Value>
560 </Entry>
561 <Entry type="4" type_name="REG_DWORD">
562 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
563 <ValueName>DisableFirefoxStudies</ValueName>
564 <Value>1</Value>
565 </Entry>
566 <Entry type="4" type_name="REG_DWORD">
567 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
568 <ValueName>DisableForgetButton</ValueName>
569 <Value>1</Value>
570 </Entry>
571 <Entry type="4" type_name="REG_DWORD">
572 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
573 <ValueName>DisableFormHistory</ValueName>
574 <Value>1</Value>
575 </Entry>
576 <Entry type="4" type_name="REG_DWORD">
577 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
578 <ValueName>DisableMasterPasswordCreation</ValueName>
579 <Value>1</Value>
580 </Entry>
581 <Entry type="4" type_name="REG_DWORD">
582 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
583 <ValueName>DisablePasswordReveal</ValueName>
584 <Value>1</Value>
585 </Entry>
586 <Entry type="4" type_name="REG_DWORD">
587 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
588 <ValueName>DisablePocket</ValueName>
589 <Value>1</Value>
590 </Entry>
591 <Entry type="4" type_name="REG_DWORD">
592 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
593 <ValueName>DisablePrivateBrowsing</ValueName>
594 <Value>1</Value>
595 </Entry>
596 <Entry type="4" type_name="REG_DWORD">
597 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
598 <ValueName>DisableProfileImport</ValueName>
599 <Value>1</Value>
600 </Entry>
601 <Entry type="4" type_name="REG_DWORD">
602 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
603 <ValueName>DisableProfileRefresh</ValueName>
604 <Value>1</Value>
605 </Entry>
606 <Entry type="4" type_name="REG_DWORD">
607 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
608 <ValueName>DisableSafeMode</ValueName>
609 <Value>1</Value>
610 </Entry>
611 <Entry type="4" type_name="REG_DWORD">
612 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
613 <ValueName>DisableSetDesktopBackground</ValueName>
614 <Value>1</Value>
615 </Entry>
616 <Entry type="4" type_name="REG_DWORD">
617 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
618 <ValueName>DisableSystemAddonUpdate</ValueName>
619 <Value>1</Value>
620 </Entry>
621 <Entry type="4" type_name="REG_DWORD">
622 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
623 <ValueName>DisableTelemetry</ValueName>
624 <Value>1</Value>
625 </Entry>
626 <Entry type="4" type_name="REG_DWORD">
627 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
628 <ValueName>DisplayBookmarksToolbar</ValueName>
629 <Value>1</Value>
630 </Entry>
631 <Entry type="1" type_name="REG_SZ">
632 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
633 <ValueName>DisplayMenuBar</ValueName>
634 <Value>default-on</Value>
635 </Entry>
636 <Entry type="4" type_name="REG_DWORD">
637 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
638 <ValueName>DontCheckDefaultBrowser</ValueName>
639 <Value>1</Value>
640 </Entry>
641 <Entry type="2" type_name="REG_EXPAND_SZ">
642 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
643 <ValueName>DownloadDirectory</ValueName>
644 <Value>${home}/Downloads</Value>
645 </Entry>
646 <Entry type="7" type_name="REG_MULTI_SZ">
647 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
648 <ValueName>Handlers</ValueName>
649 <Value>{ &quot;mimeTypes&quot;: { &quot;application/msword&quot;: { &quot;action&quot;: &quot;useSystemDefault&quot;, &quot;ask&quot;: true } }, &quot;schemes&quot;: { &quot;mailto&quot;: { &quot;action&quot;: &quot;useHelperApp&quot;, &quot;ask&quot;: true, &quot;handlers&quot;: [{ &quot;name&quot;: &quot;Gmail&quot;, &quot;uriTemplate&quot;: &quot;https://mail.google.com/mail/?extsrc=mailto&amp;url=%s&quot; }] } }, &quot;extensions&quot;: { &quot;pdf&quot;: { &quot;action&quot;: &quot;useHelperApp&quot;, &quot;ask&quot;: true, &quot;handlers&quot;: [{ &quot;name&quot;: &quot;Adobe Acrobat&quot;, &quot;path&quot;: &quot;/usr/bin/acroread&quot; }] } } }</Value>
650 </Entry>
651 <Entry type="4" type_name="REG_DWORD">
652 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
653 <ValueName>HardwareAcceleration</ValueName>
654 <Value>1</Value>
655 </Entry>
656 <Entry type="7" type_name="REG_MULTI_SZ">
657 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
658 <ValueName>ManagedBookmarks</ValueName>
659 <Value>[ { &quot;toplevel_name&quot;: &quot;My managed bookmarks folder&quot; }, { &quot;url&quot;: &quot;example.com&quot;, &quot;name&quot;: &quot;Example&quot; }, { &quot;name&quot;: &quot;Mozilla links&quot;, &quot;children&quot;: [ { &quot;url&quot;: &quot;https://mozilla.org&quot;, &quot;name&quot;: &quot;Mozilla.org&quot; }, { &quot;url&quot;: &quot;https://support.mozilla.org/&quot;, &quot;name&quot;: &quot;SUMO&quot; } ] } ]</Value>
660 </Entry>
661 <Entry type="4" type_name="REG_DWORD">
662 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
663 <ValueName>NetworkPrediction</ValueName>
664 <Value>1</Value>
665 </Entry>
666 <Entry type="4" type_name="REG_DWORD">
667 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
668 <ValueName>NewTabPage</ValueName>
669 <Value>1</Value>
670 </Entry>
671 <Entry type="4" type_name="REG_DWORD">
672 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
673 <ValueName>NoDefaultBookmarks</ValueName>
674 <Value>1</Value>
675 </Entry>
676 <Entry type="4" type_name="REG_DWORD">
677 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
678 <ValueName>OfferToSaveLogins</ValueName>
679 <Value>1</Value>
680 </Entry>
681 <Entry type="4" type_name="REG_DWORD">
682 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
683 <ValueName>OfferToSaveLoginsDefault</ValueName>
684 <Value>1</Value>
685 </Entry>
686 <Entry type="1" type_name="REG_SZ">
687 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
688 <ValueName>OverrideFirstRunPage</ValueName>
689 <Value>http://example.org</Value>
690 </Entry>
691 <Entry type="1" type_name="REG_SZ">
692 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
693 <ValueName>OverridePostUpdatePage</ValueName>
694 <Value>http://example.org</Value>
695 </Entry>
696 <Entry type="4" type_name="REG_DWORD">
697 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
698 <ValueName>PasswordManagerEnabled</ValueName>
699 <Value>1</Value>
700 </Entry>
701 <Entry type="7" type_name="REG_MULTI_SZ">
702 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
703 <ValueName>Preferences</ValueName>
704 <Value>{ &quot;accessibility.force_disabled&quot;: { &quot;Value&quot;: 1, &quot;Status&quot;: &quot;default&quot; }, &quot;browser.cache.disk.parent_directory&quot;: { &quot;Value&quot;: &quot;SOME_NATIVE_PATH&quot;, &quot;Status&quot;: &quot;user&quot; }, &quot;browser.tabs.warnOnClose&quot;: { &quot;Value&quot;: false, &quot;Status&quot;: &quot;locked&quot; } }</Value>
705 </Entry>
706 <Entry type="4" type_name="REG_DWORD">
707 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
708 <ValueName>PrimaryPassword</ValueName>
709 <Value>1</Value>
710 </Entry>
711 <Entry type="4" type_name="REG_DWORD">
712 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
713 <ValueName>PromptForDownloadLocation</ValueName>
714 <Value>1</Value>
715 </Entry>
716 <Entry type="1" type_name="REG_SZ">
717 <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
718 <ValueName>**delvals.</ValueName>
719 <Value> </Value>
720 </Entry>
721 <Entry type="1" type_name="REG_SZ">
722 <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
723 <ValueName>1</ValueName>
724 <Value>de</Value>
725 </Entry>
726 <Entry type="1" type_name="REG_SZ">
727 <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
728 <ValueName>2</ValueName>
729 <Value>en-US</Value>
730 </Entry>
731 <Entry type="1" type_name="REG_SZ">
732 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
733 <ValueName>SSLVersionMax</ValueName>
734 <Value>tls1.3</Value>
735 </Entry>
736 <Entry type="1" type_name="REG_SZ">
737 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
738 <ValueName>SSLVersionMin</ValueName>
739 <Value>tls1.3</Value>
740 </Entry>
741 <Entry type="1" type_name="REG_SZ">
742 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
743 <ValueName>SearchBar</ValueName>
744 <Value>unified</Value>
745 </Entry>
746 <Entry type="4" type_name="REG_DWORD">
747 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication</Key>
748 <ValueName>Locked</ValueName>
749 <Value>1</Value>
750 </Entry>
751 <Entry type="4" type_name="REG_DWORD">
752 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication</Key>
753 <ValueName>PrivateBrowsing</ValueName>
754 <Value>1</Value>
755 </Entry>
756 <Entry type="4" type_name="REG_DWORD">
757 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowNonFQDN</Key>
758 <ValueName>NTLM</ValueName>
759 <Value>1</Value>
760 </Entry>
761 <Entry type="4" type_name="REG_DWORD">
762 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowNonFQDN</Key>
763 <ValueName>SPNEGO</ValueName>
764 <Value>1</Value>
765 </Entry>
766 <Entry type="4" type_name="REG_DWORD">
767 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowProxies</Key>
768 <ValueName>NTLM</ValueName>
769 <Value>1</Value>
770 </Entry>
771 <Entry type="4" type_name="REG_DWORD">
772 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowProxies</Key>
773 <ValueName>SPNEGO</ValueName>
774 <Value>1</Value>
775 </Entry>
776 <Entry type="1" type_name="REG_SZ">
777 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
778 <ValueName>**delvals.</ValueName>
779 <Value> </Value>
780 </Entry>
781 <Entry type="1" type_name="REG_SZ">
782 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
783 <ValueName>1</ValueName>
784 <Value>mydomain.com</Value>
785 </Entry>
786 <Entry type="1" type_name="REG_SZ">
787 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
788 <ValueName>1</ValueName>
789 <Value>https://myotherdomain.com</Value>
790 </Entry>
791 <Entry type="1" type_name="REG_SZ">
792 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
793 <ValueName>**delvals.</ValueName>
794 <Value> </Value>
795 </Entry>
796 <Entry type="1" type_name="REG_SZ">
797 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
798 <ValueName>1</ValueName>
799 <Value>mydomain.com</Value>
800 </Entry>
801 <Entry type="1" type_name="REG_SZ">
802 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
803 <ValueName>1</ValueName>
804 <Value>https://myotherdomain.com</Value>
805 </Entry>
806 <Entry type="1" type_name="REG_SZ">
807 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
808 <ValueName>**delvals.</ValueName>
809 <Value> </Value>
810 </Entry>
811 <Entry type="1" type_name="REG_SZ">
812 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
813 <ValueName>1</ValueName>
814 <Value>mydomain.com</Value>
815 </Entry>
816 <Entry type="1" type_name="REG_SZ">
817 <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
818 <ValueName>1</ValueName>
819 <Value>https://myotherdomain.com</Value>
820 </Entry>
821 <Entry type="1" type_name="REG_SZ">
822 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
823 <ValueName>Title</ValueName>
824 <Value>Example</Value>
825 </Entry>
826 <Entry type="1" type_name="REG_SZ">
827 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
828 <ValueName>URL</ValueName>
829 <Value>https://example.com</Value>
830 </Entry>
831 <Entry type="1" type_name="REG_SZ">
832 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
833 <ValueName>Favicon</ValueName>
834 <Value>https://example.com/favicon.ico</Value>
835 </Entry>
836 <Entry type="1" type_name="REG_SZ">
837 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
838 <ValueName>Placement</ValueName>
839 <Value>menu</Value>
840 </Entry>
841 <Entry type="1" type_name="REG_SZ">
842 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
843 <ValueName>Folder</ValueName>
844 <Value>FolderName</Value>
845 </Entry>
846 <Entry type="1" type_name="REG_SZ">
847 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
848 <ValueName>Title</ValueName>
849 <Value>Samba</Value>
850 </Entry>
851 <Entry type="1" type_name="REG_SZ">
852 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
853 <ValueName>URL</ValueName>
854 <Value>www.samba.org</Value>
855 </Entry>
856 <Entry type="1" type_name="REG_SZ">
857 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
858 <ValueName>Favicon</ValueName>
859 <Value/>
860 </Entry>
861 <Entry type="1" type_name="REG_SZ">
862 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
863 <ValueName>Placement</ValueName>
864 <Value>toolbar</Value>
865 </Entry>
866 <Entry type="1" type_name="REG_SZ">
867 <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
868 <ValueName>Folder</ValueName>
869 <Value/>
870 </Entry>
871 <Entry type="1" type_name="REG_SZ">
872 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
873 <ValueName>AcceptThirdParty</ValueName>
874 <Value>never</Value>
875 </Entry>
876 <Entry type="4" type_name="REG_DWORD">
877 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
878 <ValueName>Default</ValueName>
879 <Value>1</Value>
880 </Entry>
881 <Entry type="4" type_name="REG_DWORD">
882 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
883 <ValueName>ExpireAtSessionEnd</ValueName>
884 <Value>1</Value>
885 </Entry>
886 <Entry type="4" type_name="REG_DWORD">
887 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
888 <ValueName>Locked</ValueName>
889 <Value>1</Value>
890 </Entry>
891 <Entry type="4" type_name="REG_DWORD">
892 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
893 <ValueName>RejectTracker</ValueName>
894 <Value>1</Value>
895 </Entry>
896 <Entry type="1" type_name="REG_SZ">
897 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Allow</Key>
898 <ValueName>**delvals.</ValueName>
899 <Value> </Value>
900 </Entry>
901 <Entry type="1" type_name="REG_SZ">
902 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Allow</Key>
903 <ValueName>1</ValueName>
904 <Value>http://example.org/</Value>
905 </Entry>
906 <Entry type="1" type_name="REG_SZ">
907 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\AllowSession</Key>
908 <ValueName>**delvals.</ValueName>
909 <Value> </Value>
910 </Entry>
911 <Entry type="1" type_name="REG_SZ">
912 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\AllowSession</Key>
913 <ValueName>1</ValueName>
914 <Value>http://example.edu/</Value>
915 </Entry>
916 <Entry type="1" type_name="REG_SZ">
917 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Block</Key>
918 <ValueName>**delvals.</ValueName>
919 <Value> </Value>
920 </Entry>
921 <Entry type="1" type_name="REG_SZ">
922 <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Block</Key>
923 <ValueName>1</ValueName>
924 <Value>http://example.edu/</Value>
925 </Entry>
926 <Entry type="4" type_name="REG_DWORD">
927 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
928 <ValueName>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</ValueName>
929 <Value>1</Value>
930 </Entry>
931 <Entry type="4" type_name="REG_DWORD">
932 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
933 <ValueName>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</ValueName>
934 <Value>1</Value>
935 </Entry>
936 <Entry type="4" type_name="REG_DWORD">
937 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
938 <ValueName>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</ValueName>
939 <Value>1</Value>
940 </Entry>
941 <Entry type="4" type_name="REG_DWORD">
942 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
943 <ValueName>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ValueName>
944 <Value>1</Value>
945 </Entry>
946 <Entry type="4" type_name="REG_DWORD">
947 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
948 <ValueName>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</ValueName>
949 <Value>1</Value>
950 </Entry>
951 <Entry type="4" type_name="REG_DWORD">
952 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
953 <ValueName>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</ValueName>
954 <Value>1</Value>
955 </Entry>
956 <Entry type="4" type_name="REG_DWORD">
957 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
958 <ValueName>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ValueName>
959 <Value>1</Value>
960 </Entry>
961 <Entry type="4" type_name="REG_DWORD">
962 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
963 <ValueName>TLS_RSA_WITH_AES_128_CBC_SHA</ValueName>
964 <Value>1</Value>
965 </Entry>
966 <Entry type="4" type_name="REG_DWORD">
967 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
968 <ValueName>TLS_RSA_WITH_AES_128_GCM_SHA256</ValueName>
969 <Value>1</Value>
970 </Entry>
971 <Entry type="4" type_name="REG_DWORD">
972 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
973 <ValueName>TLS_RSA_WITH_AES_256_CBC_SHA</ValueName>
974 <Value>1</Value>
975 </Entry>
976 <Entry type="4" type_name="REG_DWORD">
977 <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
978 <ValueName>TLS_RSA_WITH_AES_256_GCM_SHA384</ValueName>
979 <Value>1</Value>
980 </Entry>
981 <Entry type="4" type_name="REG_DWORD">
982 <Key>Software\\Policies\\Mozilla\\Firefox\\DisableSecurityBypass</Key>
983 <ValueName>InvalidCertificate</ValueName>
984 <Value>1</Value>
985 </Entry>
986 <Entry type="4" type_name="REG_DWORD">
987 <Key>Software\\Policies\\Mozilla\\Firefox\\DisableSecurityBypass</Key>
988 <ValueName>SafeBrowsing</ValueName>
989 <Value>1</Value>
990 </Entry>
991 <Entry type="4" type_name="REG_DWORD">
992 <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
993 <ValueName>Enabled</ValueName>
994 <Value>1</Value>
995 </Entry>
996 <Entry type="4" type_name="REG_DWORD">
997 <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
998 <ValueName>Locked</ValueName>
999 <Value>1</Value>
1000 </Entry>
1001 <Entry type="1" type_name="REG_SZ">
1002 <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
1003 <ValueName>ProviderURL</ValueName>
1004 <Value>URL_TO_ALTERNATE_PROVIDER</Value>
1005 </Entry>
1006 <Entry type="1" type_name="REG_SZ">
1007 <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS\\ExcludedDomains</Key>
1008 <ValueName>**delvals.</ValueName>
1009 <Value> </Value>
1010 </Entry>
1011 <Entry type="1" type_name="REG_SZ">
1012 <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS\\ExcludedDomains</Key>
1013 <ValueName>1</ValueName>
1014 <Value>example.com</Value>
1015 </Entry>
1016 <Entry type="4" type_name="REG_DWORD">
1017 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1018 <ValueName>Value</ValueName>
1019 <Value>1</Value>
1020 </Entry>
1021 <Entry type="4" type_name="REG_DWORD">
1022 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1023 <ValueName>Cryptomining</ValueName>
1024 <Value>1</Value>
1025 </Entry>
1026 <Entry type="4" type_name="REG_DWORD">
1027 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1028 <ValueName>Fingerprinting</ValueName>
1029 <Value>1</Value>
1030 </Entry>
1031 <Entry type="4" type_name="REG_DWORD">
1032 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1033 <ValueName>Locked</ValueName>
1034 <Value>1</Value>
1035 </Entry>
1036 <Entry type="1" type_name="REG_SZ">
1037 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection\\Exceptions</Key>
1038 <ValueName>**delvals.</ValueName>
1039 <Value> </Value>
1040 </Entry>
1041 <Entry type="1" type_name="REG_SZ">
1042 <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection\\Exceptions</Key>
1043 <ValueName>1</ValueName>
1044 <Value>https://example.com</Value>
1045 </Entry>
1046 <Entry type="4" type_name="REG_DWORD">
1047 <Key>Software\\Policies\\Mozilla\\Firefox\\EncryptedMediaExtensions</Key>
1048 <ValueName>Enabled</ValueName>
1049 <Value>1</Value>
1050 </Entry>
1051 <Entry type="4" type_name="REG_DWORD">
1052 <Key>Software\\Policies\\Mozilla\\Firefox\\EncryptedMediaExtensions</Key>
1053 <ValueName>Locked</ValueName>
1054 <Value>1</Value>
1055 </Entry>
1056 <Entry type="1" type_name="REG_SZ">
1057 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1058 <ValueName>**delvals.</ValueName>
1059 <Value> </Value>
1060 </Entry>
1061 <Entry type="2" type_name="REG_EXPAND_SZ">
1062 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1063 <ValueName>1</ValueName>
1064 <Value>https://addons.mozilla.org/firefox/downloads/somefile.xpi</Value>
1065 </Entry>
1066 <Entry type="2" type_name="REG_EXPAND_SZ">
1067 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1068 <ValueName>2</ValueName>
1069 <Value>//path/to/xpi</Value>
1070 </Entry>
1071 <Entry type="1" type_name="REG_SZ">
1072 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Locked</Key>
1073 <ValueName>**delvals.</ValueName>
1074 <Value> </Value>
1075 </Entry>
1076 <Entry type="1" type_name="REG_SZ">
1077 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Locked</Key>
1078 <ValueName>1</ValueName>
1079 <Value>addon_id@mozilla.org</Value>
1080 </Entry>
1081 <Entry type="1" type_name="REG_SZ">
1082 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Uninstall</Key>
1083 <ValueName>**delvals.</ValueName>
1084 <Value> </Value>
1085 </Entry>
1086 <Entry type="1" type_name="REG_SZ">
1087 <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Uninstall</Key>
1088 <ValueName>1</ValueName>
1089 <Value>bad_addon_id@mozilla.org</Value>
1090 </Entry>
1091 <Entry type="4" type_name="REG_DWORD">
1092 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1093 <ValueName>Search</ValueName>
1094 <Value>1</Value>
1095 </Entry>
1096 <Entry type="4" type_name="REG_DWORD">
1097 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1098 <ValueName>TopSites</ValueName>
1099 <Value>1</Value>
1100 </Entry>
1101 <Entry type="4" type_name="REG_DWORD">
1102 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1103 <ValueName>Highlights</ValueName>
1104 <Value>1</Value>
1105 </Entry>
1106 <Entry type="4" type_name="REG_DWORD">
1107 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1108 <ValueName>Pocket</ValueName>
1109 <Value>1</Value>
1110 </Entry>
1111 <Entry type="4" type_name="REG_DWORD">
1112 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1113 <ValueName>Snippets</ValueName>
1114 <Value>1</Value>
1115 </Entry>
1116 <Entry type="4" type_name="REG_DWORD">
1117 <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1118 <ValueName>Locked</ValueName>
1119 <Value>1</Value>
1120 </Entry>
1121 <Entry type="4" type_name="REG_DWORD">
1122 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin</Key>
1123 <ValueName>Default</ValueName>
1124 <Value>1</Value>
1125 </Entry>
1126 <Entry type="4" type_name="REG_DWORD">
1127 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin</Key>
1128 <ValueName>Locked</ValueName>
1129 <Value>1</Value>
1130 </Entry>
1131 <Entry type="1" type_name="REG_SZ">
1132 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Allow</Key>
1133 <ValueName>**delvals.</ValueName>
1134 <Value> </Value>
1135 </Entry>
1136 <Entry type="1" type_name="REG_SZ">
1137 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Allow</Key>
1138 <ValueName>1</ValueName>
1139 <Value>http://example.org/</Value>
1140 </Entry>
1141 <Entry type="1" type_name="REG_SZ">
1142 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Block</Key>
1143 <ValueName>**delvals.</ValueName>
1144 <Value> </Value>
1145 </Entry>
1146 <Entry type="1" type_name="REG_SZ">
1147 <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Block</Key>
1148 <ValueName>1</ValueName>
1149 <Value>http://example.edu/</Value>
1150 </Entry>
1151 <Entry type="1" type_name="REG_SZ">
1152 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1153 <ValueName>StartPage</ValueName>
1154 <Value>homepage</Value>
1155 </Entry>
1156 <Entry type="1" type_name="REG_SZ">
1157 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1158 <ValueName>URL</ValueName>
1159 <Value>http://example.com/</Value>
1160 </Entry>
1161 <Entry type="4" type_name="REG_DWORD">
1162 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1163 <ValueName>Locked</ValueName>
1164 <Value>1</Value>
1165 </Entry>
1166 <Entry type="1" type_name="REG_SZ">
1167 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1168 <ValueName>**delvals.</ValueName>
1169 <Value> </Value>
1170 </Entry>
1171 <Entry type="1" type_name="REG_SZ">
1172 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1173 <ValueName>1</ValueName>
1174 <Value>http://example.org/</Value>
1175 </Entry>
1176 <Entry type="1" type_name="REG_SZ">
1177 <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1178 <ValueName>2</ValueName>
1179 <Value>http://example.edu/</Value>
1180 </Entry>
1181 <Entry type="4" type_name="REG_DWORD">
1182 <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission</Key>
1183 <ValueName>Default</ValueName>
1184 <Value>1</Value>
1185 </Entry>
1186 <Entry type="1" type_name="REG_SZ">
1187 <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1188 <ValueName>**delvals.</ValueName>
1189 <Value> </Value>
1190 </Entry>
1191 <Entry type="1" type_name="REG_SZ">
1192 <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1193 <ValueName>1</ValueName>
1194 <Value>http://example.org/</Value>
1195 </Entry>
1196 <Entry type="1" type_name="REG_SZ">
1197 <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1198 <ValueName>2</ValueName>
1199 <Value>http://example.edu/</Value>
1200 </Entry>
1201 <Entry type="1" type_name="REG_SZ">
1202 <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1203 <ValueName>**delvals.</ValueName>
1204 <Value> </Value>
1205 </Entry>
1206 <Entry type="1" type_name="REG_SZ">
1207 <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1208 <ValueName>1</ValueName>
1209 <Value>http://example.org/</Value>
1210 </Entry>
1211 <Entry type="1" type_name="REG_SZ">
1212 <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1213 <ValueName>2</ValueName>
1214 <Value>http://example.edu/</Value>
1215 </Entry>
1216 <Entry type="4" type_name="REG_DWORD">
1217 <Key>Software\\Policies\\Mozilla\\Firefox\\PDFjs</Key>
1218 <ValueName>EnablePermissions</ValueName>
1219 <Value>1</Value>
1220 </Entry>
1221 <Entry type="4" type_name="REG_DWORD">
1222 <Key>Software\\Policies\\Mozilla\\Firefox\\PDFjs</Key>
1223 <ValueName>Enabled</ValueName>
1224 <Value>1</Value>
1225 </Entry>
1226 <Entry type="1" type_name="REG_SZ">
1227 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay</Key>
1228 <ValueName>Default</ValueName>
1229 <Value>block-audio</Value>
1230 </Entry>
1231 <Entry type="4" type_name="REG_DWORD">
1232 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay</Key>
1233 <ValueName>Locked</ValueName>
1234 <Value>1</Value>
1235 </Entry>
1236 <Entry type="1" type_name="REG_SZ">
1237 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Allow</Key>
1238 <ValueName>**delvals.</ValueName>
1239 <Value> </Value>
1240 </Entry>
1241 <Entry type="1" type_name="REG_SZ">
1242 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Allow</Key>
1243 <ValueName>1</ValueName>
1244 <Value>https://example.org</Value>
1245 </Entry>
1246 <Entry type="1" type_name="REG_SZ">
1247 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Block</Key>
1248 <ValueName>**delvals.</ValueName>
1249 <Value> </Value>
1250 </Entry>
1251 <Entry type="1" type_name="REG_SZ">
1252 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Block</Key>
1253 <ValueName>1</ValueName>
1254 <Value>https://example.edu</Value>
1255 </Entry>
1256 <Entry type="4" type_name="REG_DWORD">
1257 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera</Key>
1258 <ValueName>BlockNewRequests</ValueName>
1259 <Value>1</Value>
1260 </Entry>
1261 <Entry type="4" type_name="REG_DWORD">
1262 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera</Key>
1263 <ValueName>Locked</ValueName>
1264 <Value>1</Value>
1265 </Entry>
1266 <Entry type="1" type_name="REG_SZ">
1267 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1268 <ValueName>**delvals.</ValueName>
1269 <Value> </Value>
1270 </Entry>
1271 <Entry type="1" type_name="REG_SZ">
1272 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1273 <ValueName>1</ValueName>
1274 <Value>https://example.org</Value>
1275 </Entry>
1276 <Entry type="1" type_name="REG_SZ">
1277 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1278 <ValueName>2</ValueName>
1279 <Value>https://example.org:1234</Value>
1280 </Entry>
1281 <Entry type="1" type_name="REG_SZ">
1282 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Block</Key>
1283 <ValueName>**delvals.</ValueName>
1284 <Value> </Value>
1285 </Entry>
1286 <Entry type="1" type_name="REG_SZ">
1287 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Block</Key>
1288 <ValueName>1</ValueName>
1289 <Value>https://example.edu</Value>
1290 </Entry>
1291 <Entry type="4" type_name="REG_DWORD">
1292 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location</Key>
1293 <ValueName>BlockNewRequests</ValueName>
1294 <Value>1</Value>
1295 </Entry>
1296 <Entry type="4" type_name="REG_DWORD">
1297 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location</Key>
1298 <ValueName>Locked</ValueName>
1299 <Value>1</Value>
1300 </Entry>
1301 <Entry type="1" type_name="REG_SZ">
1302 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Allow</Key>
1303 <ValueName>**delvals.</ValueName>
1304 <Value> </Value>
1305 </Entry>
1306 <Entry type="1" type_name="REG_SZ">
1307 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Allow</Key>
1308 <ValueName>1</ValueName>
1309 <Value>https://example.org</Value>
1310 </Entry>
1311 <Entry type="1" type_name="REG_SZ">
1312 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Block</Key>
1313 <ValueName>**delvals.</ValueName>
1314 <Value> </Value>
1315 </Entry>
1316 <Entry type="1" type_name="REG_SZ">
1317 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Block</Key>
1318 <ValueName>1</ValueName>
1319 <Value>https://example.edu</Value>
1320 </Entry>
1321 <Entry type="4" type_name="REG_DWORD">
1322 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone</Key>
1323 <ValueName>BlockNewRequests</ValueName>
1324 <Value>1</Value>
1325 </Entry>
1326 <Entry type="4" type_name="REG_DWORD">
1327 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone</Key>
1328 <ValueName>Locked</ValueName>
1329 <Value>1</Value>
1330 </Entry>
1331 <Entry type="1" type_name="REG_SZ">
1332 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Allow</Key>
1333 <ValueName>**delvals.</ValueName>
1334 <Value> </Value>
1335 </Entry>
1336 <Entry type="1" type_name="REG_SZ">
1337 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Allow</Key>
1338 <ValueName>1</ValueName>
1339 <Value>https://example.org</Value>
1340 </Entry>
1341 <Entry type="1" type_name="REG_SZ">
1342 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Block</Key>
1343 <ValueName>**delvals.</ValueName>
1344 <Value> </Value>
1345 </Entry>
1346 <Entry type="1" type_name="REG_SZ">
1347 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Block</Key>
1348 <ValueName>1</ValueName>
1349 <Value>https://example.edu</Value>
1350 </Entry>
1351 <Entry type="4" type_name="REG_DWORD">
1352 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications</Key>
1353 <ValueName>BlockNewRequests</ValueName>
1354 <Value>1</Value>
1355 </Entry>
1356 <Entry type="4" type_name="REG_DWORD">
1357 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications</Key>
1358 <ValueName>Locked</ValueName>
1359 <Value>1</Value>
1360 </Entry>
1361 <Entry type="1" type_name="REG_SZ">
1362 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Allow</Key>
1363 <ValueName>**delvals.</ValueName>
1364 <Value> </Value>
1365 </Entry>
1366 <Entry type="1" type_name="REG_SZ">
1367 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Allow</Key>
1368 <ValueName>1</ValueName>
1369 <Value>https://example.org</Value>
1370 </Entry>
1371 <Entry type="1" type_name="REG_SZ">
1372 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Block</Key>
1373 <ValueName>**delvals.</ValueName>
1374 <Value> </Value>
1375 </Entry>
1376 <Entry type="1" type_name="REG_SZ">
1377 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Block</Key>
1378 <ValueName>1</ValueName>
1379 <Value>https://example.edu</Value>
1380 </Entry>
1381 <Entry type="4" type_name="REG_DWORD">
1382 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality</Key>
1383 <ValueName>BlockNewRequests</ValueName>
1384 <Value>1</Value>
1385 </Entry>
1386 <Entry type="4" type_name="REG_DWORD">
1387 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality</Key>
1388 <ValueName>Locked</ValueName>
1389 <Value>1</Value>
1390 </Entry>
1391 <Entry type="1" type_name="REG_SZ">
1392 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Allow</Key>
1393 <ValueName>**delvals.</ValueName>
1394 <Value> </Value>
1395 </Entry>
1396 <Entry type="1" type_name="REG_SZ">
1397 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Allow</Key>
1398 <ValueName>1</ValueName>
1399 <Value>https://example.org</Value>
1400 </Entry>
1401 <Entry type="1" type_name="REG_SZ">
1402 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Block</Key>
1403 <ValueName>**delvals.</ValueName>
1404 <Value> </Value>
1405 </Entry>
1406 <Entry type="1" type_name="REG_SZ">
1407 <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Block</Key>
1408 <ValueName>1</ValueName>
1409 <Value>https://example.edu</Value>
1410 </Entry>
1411 <Entry type="4" type_name="REG_DWORD">
1412 <Key>Software\\Policies\\Mozilla\\Firefox\\PictureInPicture</Key>
1413 <ValueName>Enabled</ValueName>
1414 <Value>1</Value>
1415 </Entry>
1416 <Entry type="4" type_name="REG_DWORD">
1417 <Key>Software\\Policies\\Mozilla\\Firefox\\PictureInPicture</Key>
1418 <ValueName>Locked</ValueName>
1419 <Value>1</Value>
1420 </Entry>
1421 <Entry type="4" type_name="REG_DWORD">
1422 <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking</Key>
1423 <ValueName>Default</ValueName>
1424 <Value>1</Value>
1425 </Entry>
1426 <Entry type="4" type_name="REG_DWORD">
1427 <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking</Key>
1428 <ValueName>Locked</ValueName>
1429 <Value>1</Value>
1430 </Entry>
1431 <Entry type="1" type_name="REG_SZ">
1432 <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1433 <ValueName>**delvals.</ValueName>
1434 <Value> </Value>
1435 </Entry>
1436 <Entry type="1" type_name="REG_SZ">
1437 <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1438 <ValueName>1</ValueName>
1439 <Value>http://example.org/</Value>
1440 </Entry>
1441 <Entry type="1" type_name="REG_SZ">
1442 <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1443 <ValueName>2</ValueName>
1444 <Value>http://example.edu/</Value>
1445 </Entry>
1446 <Entry type="4" type_name="REG_DWORD">
1447 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1448 <ValueName>Locked</ValueName>
1449 <Value>1</Value>
1450 </Entry>
1451 <Entry type="1" type_name="REG_SZ">
1452 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1453 <ValueName>Mode</ValueName>
1454 <Value>autoDetect</Value>
1455 </Entry>
1456 <Entry type="1" type_name="REG_SZ">
1457 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1458 <ValueName>HTTPProxy</ValueName>
1459 <Value>hostname</Value>
1460 </Entry>
1461 <Entry type="4" type_name="REG_DWORD">
1462 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1463 <ValueName>UseHTTPProxyForAllProtocols</ValueName>
1464 <Value>1</Value>
1465 </Entry>
1466 <Entry type="1" type_name="REG_SZ">
1467 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1468 <ValueName>SSLProxy</ValueName>
1469 <Value>hostname</Value>
1470 </Entry>
1471 <Entry type="1" type_name="REG_SZ">
1472 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1473 <ValueName>FTPProxy</ValueName>
1474 <Value>hostname</Value>
1475 </Entry>
1476 <Entry type="1" type_name="REG_SZ">
1477 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1478 <ValueName>SOCKSProxy</ValueName>
1479 <Value>hostname</Value>
1480 </Entry>
1481 <Entry type="4" type_name="REG_DWORD">
1482 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1483 <ValueName>SOCKSVersion</ValueName>
1484 <Value>5</Value>
1485 </Entry>
1486 <Entry type="1" type_name="REG_SZ">
1487 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1488 <ValueName>Passthrough</ValueName>
1489 <Value>&lt;local&gt;</Value>
1490 </Entry>
1491 <Entry type="1" type_name="REG_SZ">
1492 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1493 <ValueName>AutoConfigURL</ValueName>
1494 <Value>URL_TO_AUTOCONFIG</Value>
1495 </Entry>
1496 <Entry type="4" type_name="REG_DWORD">
1497 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1498 <ValueName>AutoLogin</ValueName>
1499 <Value>1</Value>
1500 </Entry>
1501 <Entry type="4" type_name="REG_DWORD">
1502 <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1503 <ValueName>UseProxyForDNS</ValueName>
1504 <Value>1</Value>
1505 </Entry>
1506 <Entry type="4" type_name="REG_DWORD">
1507 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1508 <ValueName>SanitizeOnShutdown</ValueName>
1509 <Value>1</Value>
1510 </Entry>
1511 <Entry type="1" type_name="REG_SZ">
1512 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines</Key>
1513 <ValueName>Default</ValueName>
1514 <Value>Google</Value>
1515 </Entry>
1516 <Entry type="4" type_name="REG_DWORD">
1517 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines</Key>
1518 <ValueName>PreventInstalls</ValueName>
1519 <Value>1</Value>
1520 </Entry>
1521 <Entry type="1" type_name="REG_SZ">
1522 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1523 <ValueName>Name</ValueName>
1524 <Value>Example1</Value>
1525 </Entry>
1526 <Entry type="1" type_name="REG_SZ">
1527 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1528 <ValueName>URLTemplate</ValueName>
1529 <Value>https://www.example.org/q={searchTerms}</Value>
1530 </Entry>
1531 <Entry type="1" type_name="REG_SZ">
1532 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1533 <ValueName>Method</ValueName>
1534 <Value>POST</Value>
1535 </Entry>
1536 <Entry type="1" type_name="REG_SZ">
1537 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1538 <ValueName>IconURL</ValueName>
1539 <Value>https://www.example.org/favicon.ico</Value>
1540 </Entry>
1541 <Entry type="1" type_name="REG_SZ">
1542 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1543 <ValueName>Alias</ValueName>
1544 <Value>example</Value>
1545 </Entry>
1546 <Entry type="1" type_name="REG_SZ">
1547 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1548 <ValueName>Description</ValueName>
1549 <Value>Description</Value>
1550 </Entry>
1551 <Entry type="1" type_name="REG_SZ">
1552 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1553 <ValueName>SuggestURLTemplate</ValueName>
1554 <Value>https://www.example.org/suggestions/q={searchTerms}</Value>
1555 </Entry>
1556 <Entry type="1" type_name="REG_SZ">
1557 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1558 <ValueName>PostData</ValueName>
1559 <Value>name=value&amp;q={searchTerms}</Value>
1560 </Entry>
1561 <Entry type="1" type_name="REG_SZ">
1562 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Remove</Key>
1563 <ValueName>**delvals.</ValueName>
1564 <Value> </Value>
1565 </Entry>
1566 <Entry type="1" type_name="REG_SZ">
1567 <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Remove</Key>
1568 <ValueName>1</ValueName>
1569 <Value>Bing</Value>
1570 </Entry>
1571 <Entry type="1" type_name="REG_SZ">
1572 <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1573 <ValueName>Title</ValueName>
1574 <Value>Support Menu</Value>
1575 </Entry>
1576 <Entry type="1" type_name="REG_SZ">
1577 <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1578 <ValueName>URL</ValueName>
1579 <Value>http://example.com/support</Value>
1580 </Entry>
1581 <Entry type="1" type_name="REG_SZ">
1582 <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1583 <ValueName>AccessKey</ValueName>
1584 <Value>S</Value>
1585 </Entry>
1586 <Entry type="4" type_name="REG_DWORD">
1587 <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1588 <ValueName>ExtensionRecommendations</ValueName>
1589 <Value>1</Value>
1590 </Entry>
1591 <Entry type="4" type_name="REG_DWORD">
1592 <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1593 <ValueName>FeatureRecommendations</ValueName>
1594 <Value>1</Value>
1595 </Entry>
1596 <Entry type="4" type_name="REG_DWORD">
1597 <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1598 <ValueName>WhatsNew</ValueName>
1599 <Value>1</Value>
1600 </Entry>
1601 <Entry type="4" type_name="REG_DWORD">
1602 <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1603 <ValueName>UrlbarInterventions</ValueName>
1604 <Value>1</Value>
1605 </Entry>
1606 <Entry type="4" type_name="REG_DWORD">
1607 <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1608 <ValueName>SkipOnboarding</ValueName>
1609 <Value>1</Value>
1610 </Entry>
1611 <Entry type="1" type_name="REG_SZ">
1612 <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Block</Key>
1613 <ValueName>**delvals.</ValueName>
1614 <Value> </Value>
1615 </Entry>
1616 <Entry type="1" type_name="REG_SZ">
1617 <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Block</Key>
1618 <ValueName>1</ValueName>
1619 <Value>&lt;all_urls&gt;</Value>
1620 </Entry>
1621 <Entry type="1" type_name="REG_SZ">
1622 <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Exceptions</Key>
1623 <ValueName>**delvals.</ValueName>
1624 <Value> </Value>
1625 </Entry>
1626 <Entry type="1" type_name="REG_SZ">
1627 <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Exceptions</Key>
1628 <ValueName>1</ValueName>
1629 <Value>http://example.org/*</Value>
1630 </Entry>
1631 <Entry type="1" type_name="REG_SZ">
1632 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1633 <ValueName>AllowedDomainsForApps</ValueName>
1634 <Value>managedfirefox.com,example.com</Value>
1635 </Entry>
1636 <Entry type="4" type_name="REG_DWORD">
1637 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1638 <ValueName>BackgroundAppUpdate</ValueName>
1639 <Value>1</Value>
1640 </Entry>
1641 <Entry type="4" type_name="REG_DWORD">
1642 <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates</Key>
1643 <ValueName>ImportEnterpriseRoots</ValueName>
1644 <Value>1</Value>
1645 </Entry>
1646 <Entry type="1" type_name="REG_SZ">
1647 <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1648 <ValueName>**delvals.</ValueName>
1649 <Value> </Value>
1650 </Entry>
1651 <Entry type="1" type_name="REG_SZ">
1652 <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1653 <ValueName>1</ValueName>
1654 <Value>cert1.der</Value>
1655 </Entry>
1656 <Entry type="1" type_name="REG_SZ">
1657 <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1658 <ValueName>2</ValueName>
1659 <Value>/home/username/cert2.pem</Value>
1660 </Entry>
1661 <Entry type="1" type_name="REG_SZ">
1662 <Key>Software\\Policies\\Mozilla\\Firefox\\SecurityDevices</Key>
1663 <ValueName>NAME_OF_DEVICE</ValueName>
1664 <Value>PATH_TO_LIBRARY_FOR_DEVICE</Value>
1665 </Entry>
1666 <Entry type="4" type_name="REG_DWORD">
1667 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1668 <ValueName>ShowHomeButton</ValueName>
1669 <Value>1</Value>
1670 </Entry>
1671 <Entry type="7" type_name="REG_MULTI_SZ">
1672 <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1673 <ValueName>AutoLaunchProtocolsFromOrigins</ValueName>
1674 <Value>[{&quot;protocol&quot;: &quot;zoommtg&quot;, &quot;allowed_origins&quot;: [&quot;https://somesite.zoom.us&quot;]}]</Value>
1675 </Entry>
1676 </PolFile>
1677 """
1678
1679 firefox_json_expected = \
1680 """
1681 {
1682 "policies": {
1683 "AppAutoUpdate": true,
1684 "AllowedDomainsForApps": "managedfirefox.com,example.com",
1685 "AppUpdateURL": "https://yoursite.com",
1686 "Authentication": {
1687 "SPNEGO": [
1688 "mydomain.com",
1689 "https://myotherdomain.com"
1690 ],
1691 "Delegated": [
1692 "mydomain.com",
1693 "https://myotherdomain.com"
1694 ],
1695 "NTLM": [
1696 "mydomain.com",
1697 "https://myotherdomain.com"
1698 ],
1699 "AllowNonFQDN": {
1700 "SPNEGO": true,
1701 "NTLM": true
1702 },
1703 "AllowProxies": {
1704 "SPNEGO": true,
1705 "NTLM": true
1706 },
1707 "Locked": true,
1708 "PrivateBrowsing": true
1709 },
1710 "AutoLaunchProtocolsFromOrigins": [
1711 {
1712 "protocol": "zoommtg",
1713 "allowed_origins": [
1714 "https://somesite.zoom.us"
1715 ]
1716 }
1717 ],
1718 "BackgroundAppUpdate": true,
1719 "BlockAboutAddons": true,
1720 "BlockAboutConfig": true,
1721 "BlockAboutProfiles": true,
1722 "BlockAboutSupport": true,
1723 "Bookmarks": [
1724 {
1725 "Title": "Example",
1726 "URL": "https://example.com",
1727 "Favicon": "https://example.com/favicon.ico",
1728 "Placement": "menu",
1729 "Folder": "FolderName"
1730 },
1731 {
1732 "Title": "Samba",
1733 "URL": "www.samba.org",
1734 "Favicon": "",
1735 "Placement": "toolbar",
1736 "Folder": ""
1737 }
1738 ],
1739 "CaptivePortal": true,
1740 "Certificates": {
1741 "ImportEnterpriseRoots": true,
1742 "Install": [
1743 "cert1.der",
1744 "/home/username/cert2.pem"
1745 ]
1746 },
1747 "Cookies": {
1748 "Allow": [
1749 "http://example.org/"
1750 ],
1751 "AllowSession": [
1752 "http://example.edu/"
1753 ],
1754 "Block": [
1755 "http://example.edu/"
1756 ],
1757 "Default": true,
1758 "AcceptThirdParty": "never",
1759 "ExpireAtSessionEnd": true,
1760 "RejectTracker": true,
1761 "Locked": true
1762 },
1763 "DisableSetDesktopBackground": true,
1764 "DisableMasterPasswordCreation": true,
1765 "DisableAppUpdate": true,
1766 "DisableBuiltinPDFViewer": true,
1767 "DisabledCiphers": {
1768 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true,
1769 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true,
1770 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true,
1771 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true,
1772 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true,
1773 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true,
1774 "TLS_RSA_WITH_AES_128_CBC_SHA": true,
1775 "TLS_RSA_WITH_AES_256_CBC_SHA": true,
1776 "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true,
1777 "TLS_RSA_WITH_AES_128_GCM_SHA256": true,
1778 "TLS_RSA_WITH_AES_256_GCM_SHA384": true
1779 },
1780 "DisableDefaultBrowserAgent": true,
1781 "DisableDeveloperTools": true,
1782 "DisableFeedbackCommands": true,
1783 "DisableFirefoxScreenshots": true,
1784 "DisableFirefoxAccounts": true,
1785 "DisableFirefoxStudies": true,
1786 "DisableForgetButton": true,
1787 "DisableFormHistory": true,
1788 "DisablePasswordReveal": true,
1789 "DisablePocket": true,
1790 "DisablePrivateBrowsing": true,
1791 "DisableProfileImport": true,
1792 "DisableProfileRefresh": true,
1793 "DisableSafeMode": true,
1794 "DisableSecurityBypass": {
1795 "InvalidCertificate": true,
1796 "SafeBrowsing": true
1797 },
1798 "DisableSystemAddonUpdate": true,
1799 "DisableTelemetry": true,
1800 "DisplayBookmarksToolbar": true,
1801 "DisplayMenuBar": "default-on",
1802 "DNSOverHTTPS": {
1803 "Enabled": true,
1804 "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
1805 "Locked": true,
1806 "ExcludedDomains": [
1807 "example.com"
1808 ]
1809 },
1810 "DontCheckDefaultBrowser": true,
1811 "EnableTrackingProtection": {
1812 "Value": true,
1813 "Locked": true,
1814 "Cryptomining": true,
1815 "Fingerprinting": true,
1816 "Exceptions": [
1817 "https://example.com"
1818 ]
1819 },
1820 "EncryptedMediaExtensions": {
1821 "Enabled": true,
1822 "Locked": true
1823 },
1824 "Extensions": {
1825 "Install": [
1826 "https://addons.mozilla.org/firefox/downloads/somefile.xpi",
1827 "//path/to/xpi"
1828 ],
1829 "Uninstall": [
1830 "bad_addon_id@mozilla.org"
1831 ],
1832 "Locked": [
1833 "addon_id@mozilla.org"
1834 ]
1835 },
1836 "ExtensionSettings": {
1837 "*": {
1838 "blocked_install_message": "Custom error message.",
1839 "install_sources": [
1840 "about:addons",
1841 "https://addons.mozilla.org/"
1842 ],
1843 "installation_mode": "blocked",
1844 "allowed_types": [
1845 "extension"
1846 ]
1847 },
1848 "uBlock0@raymondhill.net": {
1849 "installation_mode": "force_installed",
1850 "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
1851 },
1852 "https-everywhere@eff.org": {
1853 "installation_mode": "allowed"
1854 }
1855 },
1856 "ExtensionUpdate": true,
1857 "FlashPlugin": {
1858 "Allow": [
1859 "http://example.org/"
1860 ],
1861 "Block": [
1862 "http://example.edu/"
1863 ],
1864 "Default": true,
1865 "Locked": true
1866 },
1867 "Handlers": {
1868 "mimeTypes": {
1869 "application/msword": {
1870 "action": "useSystemDefault",
1871 "ask": true
1872 }
1873 },
1874 "schemes": {
1875 "mailto": {
1876 "action": "useHelperApp",
1877 "ask": true,
1878 "handlers": [
1879 {
1880 "name": "Gmail",
1881 "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
1882 }
1883 ]
1884 }
1885 },
1886 "extensions": {
1887 "pdf": {
1888 "action": "useHelperApp",
1889 "ask": true,
1890 "handlers": [
1891 {
1892 "name": "Adobe Acrobat",
1893 "path": "/usr/bin/acroread"
1894 }
1895 ]
1896 }
1897 }
1898 },
1899 "FirefoxHome": {
1900 "Search": true,
1901 "TopSites": true,
1902 "Highlights": true,
1903 "Pocket": true,
1904 "Snippets": true,
1905 "Locked": true
1906 },
1907 "HardwareAcceleration": true,
1908 "Homepage": {
1909 "URL": "http://example.com/",
1910 "Locked": true,
1911 "Additional": [
1912 "http://example.org/",
1913 "http://example.edu/"
1914 ],
1915 "StartPage": "homepage"
1916 },
1917 "InstallAddonsPermission": {
1918 "Allow": [
1919 "http://example.org/",
1920 "http://example.edu/"
1921 ],
1922 "Default": true
1923 },
1924 "LocalFileLinks": [
1925 "http://example.org/",
1926 "http://example.edu/"
1927 ],
1928 "ManagedBookmarks": [
1929 {
1930 "toplevel_name": "My managed bookmarks folder"
1931 },
1932 {
1933 "url": "example.com",
1934 "name": "Example"
1935 },
1936 {
1937 "name": "Mozilla links",
1938 "children": [
1939 {
1940 "url": "https://mozilla.org",
1941 "name": "Mozilla.org"
1942 },
1943 {
1944 "url": "https://support.mozilla.org/",
1945 "name": "SUMO"
1946 }
1947 ]
1948 }
1949 ],
1950 "PrimaryPassword": true,
1951 "NoDefaultBookmarks": true,
1952 "OfferToSaveLogins": true,
1953 "OfferToSaveLoginsDefault": true,
1954 "OverrideFirstRunPage": "http://example.org",
1955 "OverridePostUpdatePage": "http://example.org",
1956 "PasswordManagerEnabled": true,
1957 "PSFjs": {
1958 "Enabled": true,
1959 "EnablePermissions": true
1960 },
1961 "Permissions": {
1962 "Camera": {
1963 "Allow": [
1964 "https://example.org",
1965 "https://example.org:1234"
1966 ],
1967 "Block": [
1968 "https://example.edu"
1969 ],
1970 "BlockNewRequests": true,
1971 "Locked": true
1972 },
1973 "Microphone": {
1974 "Allow": [
1975 "https://example.org"
1976 ],
1977 "Block": [
1978 "https://example.edu"
1979 ],
1980 "BlockNewRequests": true,
1981 "Locked": true
1982 },
1983 "Location": {
1984 "Allow": [
1985 "https://example.org"
1986 ],
1987 "Block": [
1988 "https://example.edu"
1989 ],
1990 "BlockNewRequests": true,
1991 "Locked": true
1992 },
1993 "Notifications": {
1994 "Allow": [
1995 "https://example.org"
1996 ],
1997 "Block": [
1998 "https://example.edu"
1999 ],
2000 "BlockNewRequests": true,
2001 "Locked": true
2002 },
2003 "Autoplay": {
2004 "Allow": [
2005 "https://example.org"
2006 ],
2007 "Block": [
2008 "https://example.edu"
2009 ],
2010 "Default": "block-audio",
2011 "Locked": true
2012 },
2013 "VirtualReality": {
2014 "Allow": [
2015 "https://example.org"
2016 ],
2017 "Block": [
2018 "https://example.edu"
2019 ],
2020 "BlockNewRequests": true,
2021 "Locked": true
2022 }
2023 },
2024 "PictureInPicture": {
2025 "Enabled": true,
2026 "Locked": true
2027 },
2028 "PopupBlocking": {
2029 "Allow": [
2030 "http://example.org/",
2031 "http://example.edu/"
2032 ],
2033 "Default": true,
2034 "Locked": true
2035 },
2036 "Preferences": {
2037 "accessibility.force_disabled": {
2038 "Value": 1,
2039 "Status": "default"
2040 },
2041 "browser.cache.disk.parent_directory": {
2042 "Value": "SOME_NATIVE_PATH",
2043 "Status": "user"
2044 },
2045 "browser.tabs.warnOnClose": {
2046 "Value": false,
2047 "Status": "locked"
2048 }
2049 },
2050 "PromptForDownloadLocation": true,
2051 "Proxy": {
2052 "Mode": "autoDetect",
2053 "Locked": true,
2054 "HTTPProxy": "hostname",
2055 "UseHTTPProxyForAllProtocols": true,
2056 "SSLProxy": "hostname",
2057 "FTPProxy": "hostname",
2058 "SOCKSProxy": "hostname",
2059 "SOCKSVersion": 5,
2060 "Passthrough": "<local>",
2061 "AutoConfigURL": "URL_TO_AUTOCONFIG",
2062 "AutoLogin": true,
2063 "UseProxyForDNS": true
2064 },
2065 "SanitizeOnShutdown": true,
2066 "SearchEngines": {
2067 "Add": [
2068 {
2069 "Name": "Example1",
2070 "URLTemplate": "https://www.example.org/q={searchTerms}",
2071 "Method": "POST",
2072 "IconURL": "https://www.example.org/favicon.ico",
2073 "Alias": "example",
2074 "Description": "Description",
2075 "PostData": "name=value&q={searchTerms}",
2076 "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
2077 }
2078 ],
2079 "Remove": [
2080 "Bing"
2081 ],
2082 "Default": "Google",
2083 "PreventInstalls": true
2084 },
2085 "SearchSuggestEnabled": true,
2086 "SecurityDevices": {
2087 "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
2088 },
2089 "ShowHomeButton": true,
2090 "SSLVersionMax": "tls1.3",
2091 "SSLVersionMin": "tls1.3",
2092 "SupportMenu": {
2093 "Title": "Support Menu",
2094 "URL": "http://example.com/support",
2095 "AccessKey": "S"
2096 },
2097 "UserMessaging": {
2098 "WhatsNew": true,
2099 "ExtensionRecommendations": true,
2100 "FeatureRecommendations": true,
2101 "UrlbarInterventions": true,
2102 "SkipOnboarding": true
2103 },
2104 "WebsiteFilter": {
2105 "Block": [
2106 "<all_urls>"
2107 ],
2108 "Exceptions": [
2109 "http://example.org/*"
2110 ]
2111 },
2112 "DefaultDownloadDirectory": "${home}/Downloads",
2113 "DownloadDirectory": "${home}/Downloads",
2114 "NetworkPrediction": true,
2115 "NewTabPage": true,
2116 "RequestedLocales": ["de", "en-US"],
2117 "SearchBar": "unified"
2118 }
2119 }
2120 """
2121
2122 chromium_reg_pol = \
2123 br"""
2124 <?xml version="1.0" encoding="utf-8"?>
2125 <PolFile num_entries="418" signature="PReg" version="1">
2126 <Entry type="4" type_name="REG_DWORD">
2127 <Key>Software\Policies\Google\Chrome</Key>
2128 <ValueName>AbusiveExperienceInterventionEnforce</ValueName>
2129 <Value>1</Value>
2130 </Entry>
2131 <Entry type="4" type_name="REG_DWORD">
2132 <Key>Software\Policies\Google\Chrome</Key>
2133 <ValueName>AccessibilityImageLabelsEnabled</ValueName>
2134 <Value>0</Value>
2135 </Entry>
2136 <Entry type="4" type_name="REG_DWORD">
2137 <Key>Software\Policies\Google\Chrome</Key>
2138 <ValueName>AdditionalDnsQueryTypesEnabled</ValueName>
2139 <Value>1</Value>
2140 </Entry>
2141 <Entry type="4" type_name="REG_DWORD">
2142 <Key>Software\Policies\Google\Chrome</Key>
2143 <ValueName>AdsSettingForIntrusiveAdsSites</ValueName>
2144 <Value>1</Value>
2145 </Entry>
2146 <Entry type="4" type_name="REG_DWORD">
2147 <Key>Software\Policies\Google\Chrome</Key>
2148 <ValueName>AdvancedProtectionAllowed</ValueName>
2149 <Value>1</Value>
2150 </Entry>
2151 <Entry type="4" type_name="REG_DWORD">
2152 <Key>Software\Policies\Google\Chrome</Key>
2153 <ValueName>AllowCrossOriginAuthPrompt</ValueName>
2154 <Value>0</Value>
2155 </Entry>
2156 <Entry type="4" type_name="REG_DWORD">
2157 <Key>Software\Policies\Google\Chrome</Key>
2158 <ValueName>AllowDeletingBrowserHistory</ValueName>
2159 <Value>1</Value>
2160 </Entry>
2161 <Entry type="4" type_name="REG_DWORD">
2162 <Key>Software\Policies\Google\Chrome</Key>
2163 <ValueName>AllowDinosaurEasterEgg</ValueName>
2164 <Value>0</Value>
2165 </Entry>
2166 <Entry type="4" type_name="REG_DWORD">
2167 <Key>Software\Policies\Google\Chrome</Key>
2168 <ValueName>AllowFileSelectionDialogs</ValueName>
2169 <Value>1</Value>
2170 </Entry>
2171 <Entry type="4" type_name="REG_DWORD">
2172 <Key>Software\Policies\Google\Chrome</Key>
2173 <ValueName>AllowSyncXHRInPageDismissal</ValueName>
2174 <Value>0</Value>
2175 </Entry>
2176 <Entry type="1" type_name="REG_SZ">
2177 <Key>Software\Policies\Google\Chrome</Key>
2178 <ValueName>AllowedDomainsForApps</ValueName>
2179 <Value>managedchrome.com,example.com</Value>
2180 </Entry>
2181 <Entry type="4" type_name="REG_DWORD">
2182 <Key>Software\Policies\Google\Chrome</Key>
2183 <ValueName>AlternateErrorPagesEnabled</ValueName>
2184 <Value>1</Value>
2185 </Entry>
2186 <Entry type="1" type_name="REG_SZ">
2187 <Key>Software\Policies\Google\Chrome</Key>
2188 <ValueName>AlternativeBrowserPath</ValueName>
2189 <Value>${ie}</Value>
2190 </Entry>
2191 <Entry type="4" type_name="REG_DWORD">
2192 <Key>Software\Policies\Google\Chrome</Key>
2193 <ValueName>AlwaysOpenPdfExternally</ValueName>
2194 <Value>1</Value>
2195 </Entry>
2196 <Entry type="4" type_name="REG_DWORD">
2197 <Key>Software\Policies\Google\Chrome</Key>
2198 <ValueName>AmbientAuthenticationInPrivateModesEnabled</ValueName>
2199 <Value>0</Value>
2200 </Entry>
2201 <Entry type="4" type_name="REG_DWORD">
2202 <Key>Software\Policies\Google\Chrome</Key>
2203 <ValueName>AppCacheForceEnabled</ValueName>
2204 <Value>0</Value>
2205 </Entry>
2206 <Entry type="1" type_name="REG_SZ">
2207 <Key>Software\Policies\Google\Chrome</Key>
2208 <ValueName>ApplicationLocaleValue</ValueName>
2209 <Value>en</Value>
2210 </Entry>
2211 <Entry type="4" type_name="REG_DWORD">
2212 <Key>Software\Policies\Google\Chrome</Key>
2213 <ValueName>AudioCaptureAllowed</ValueName>
2214 <Value>0</Value>
2215 </Entry>
2216 <Entry type="4" type_name="REG_DWORD">
2217 <Key>Software\Policies\Google\Chrome</Key>
2218 <ValueName>AudioProcessHighPriorityEnabled</ValueName>
2219 <Value>1</Value>
2220 </Entry>
2221 <Entry type="4" type_name="REG_DWORD">
2222 <Key>Software\Policies\Google\Chrome</Key>
2223 <ValueName>AudioSandboxEnabled</ValueName>
2224 <Value>1</Value>
2225 </Entry>
2226 <Entry type="1" type_name="REG_SZ">
2227 <Key>Software\Policies\Google\Chrome</Key>
2228 <ValueName>AuthNegotiateDelegateAllowlist</ValueName>
2229 <Value>foobar.example.com</Value>
2230 </Entry>
2231 <Entry type="1" type_name="REG_SZ">
2232 <Key>Software\Policies\Google\Chrome</Key>
2233 <ValueName>AuthSchemes</ValueName>
2234 <Value>basic,digest,ntlm,negotiate</Value>
2235 </Entry>
2236 <Entry type="1" type_name="REG_SZ">
2237 <Key>Software\Policies\Google\Chrome</Key>
2238 <ValueName>AuthServerAllowlist</ValueName>
2239 <Value>*.example.com,example.com</Value>
2240 </Entry>
2241 <Entry type="1" type_name="REG_SZ">
2242 <Key>Software\Policies\Google\Chrome</Key>
2243 <ValueName>AutoLaunchProtocolsFromOrigins</ValueName>
2244 <Value>[{&quot;allowed_origins&quot;: [&quot;example.com&quot;, &quot;http://www.example.com:8080&quot;], &quot;protocol&quot;: &quot;spotify&quot;}, {&quot;allowed_origins&quot;: [&quot;https://example.com&quot;, &quot;https://.mail.example.com&quot;], &quot;protocol&quot;: &quot;teams&quot;}, {&quot;allowed_origins&quot;: [&quot;*&quot;], &quot;protocol&quot;: &quot;outlook&quot;}]</Value>
2245 </Entry>
2246 <Entry type="4" type_name="REG_DWORD">
2247 <Key>Software\Policies\Google\Chrome</Key>
2248 <ValueName>AutofillAddressEnabled</ValueName>
2249 <Value>0</Value>
2250 </Entry>
2251 <Entry type="4" type_name="REG_DWORD">
2252 <Key>Software\Policies\Google\Chrome</Key>
2253 <ValueName>AutofillCreditCardEnabled</ValueName>
2254 <Value>0</Value>
2255 </Entry>
2256 <Entry type="4" type_name="REG_DWORD">
2257 <Key>Software\Policies\Google\Chrome</Key>
2258 <ValueName>AutoplayAllowed</ValueName>
2259 <Value>1</Value>
2260 </Entry>
2261 <Entry type="4" type_name="REG_DWORD">
2262 <Key>Software\Policies\Google\Chrome</Key>
2263 <ValueName>BackgroundModeEnabled</ValueName>
2264 <Value>1</Value>
2265 </Entry>
2266 <Entry type="4" type_name="REG_DWORD">
2267 <Key>Software\Policies\Google\Chrome</Key>
2268 <ValueName>BasicAuthOverHttpEnabled</ValueName>
2269 <Value>0</Value>
2270 </Entry>
2271 <Entry type="4" type_name="REG_DWORD">
2272 <Key>Software\Policies\Google\Chrome</Key>
2273 <ValueName>BlockExternalExtensions</ValueName>
2274 <Value>1</Value>
2275 </Entry>
2276 <Entry type="4" type_name="REG_DWORD">
2277 <Key>Software\Policies\Google\Chrome</Key>
2278 <ValueName>BlockThirdPartyCookies</ValueName>
2279 <Value>0</Value>
2280 </Entry>
2281 <Entry type="4" type_name="REG_DWORD">
2282 <Key>Software\Policies\Google\Chrome</Key>
2283 <ValueName>BookmarkBarEnabled</ValueName>
2284 <Value>1</Value>
2285 </Entry>
2286 <Entry type="4" type_name="REG_DWORD">
2287 <Key>Software\Policies\Google\Chrome</Key>
2288 <ValueName>BrowserAddPersonEnabled</ValueName>
2289 <Value>1</Value>
2290 </Entry>
2291 <Entry type="4" type_name="REG_DWORD">
2292 <Key>Software\Policies\Google\Chrome</Key>
2293 <ValueName>BrowserGuestModeEnabled</ValueName>
2294 <Value>1</Value>
2295 </Entry>
2296 <Entry type="4" type_name="REG_DWORD">
2297 <Key>Software\Policies\Google\Chrome</Key>
2298 <ValueName>BrowserGuestModeEnforced</ValueName>
2299 <Value>1</Value>
2300 </Entry>
2301 <Entry type="4" type_name="REG_DWORD">
2302 <Key>Software\Policies\Google\Chrome</Key>
2303 <ValueName>BrowserLabsEnabled</ValueName>
2304 <Value>0</Value>
2305 </Entry>
2306 <Entry type="4" type_name="REG_DWORD">
2307 <Key>Software\Policies\Google\Chrome</Key>
2308 <ValueName>BrowserNetworkTimeQueriesEnabled</ValueName>
2309 <Value>1</Value>
2310 </Entry>
2311 <Entry type="4" type_name="REG_DWORD">
2312 <Key>Software\Policies\Google\Chrome</Key>
2313 <ValueName>BrowserSignin</ValueName>
2314 <Value>2</Value>
2315 </Entry>
2316 <Entry type="1" type_name="REG_SZ">
2317 <Key>Software\Policies\Google\Chrome</Key>
2318 <ValueName>BrowserSwitcherChromePath</ValueName>
2319 <Value>${chrome}</Value>
2320 </Entry>
2321 <Entry type="4" type_name="REG_DWORD">
2322 <Key>Software\Policies\Google\Chrome</Key>
2323 <ValueName>BrowserSwitcherDelay</ValueName>
2324 <Value>10000</Value>
2325 </Entry>
2326 <Entry type="4" type_name="REG_DWORD">
2327 <Key>Software\Policies\Google\Chrome</Key>
2328 <ValueName>BrowserSwitcherEnabled</ValueName>
2329 <Value>1</Value>
2330 </Entry>
2331 <Entry type="1" type_name="REG_SZ">
2332 <Key>Software\Policies\Google\Chrome</Key>
2333 <ValueName>BrowserSwitcherExternalGreylistUrl</ValueName>
2334 <Value>http://example.com/greylist.xml</Value>
2335 </Entry>
2336 <Entry type="1" type_name="REG_SZ">
2337 <Key>Software\Policies\Google\Chrome</Key>
2338 <ValueName>BrowserSwitcherExternalSitelistUrl</ValueName>
2339 <Value>http://example.com/sitelist.xml</Value>
2340 </Entry>
2341 <Entry type="4" type_name="REG_DWORD">
2342 <Key>Software\Policies\Google\Chrome</Key>
2343 <ValueName>BrowserSwitcherKeepLastChromeTab</ValueName>
2344 <Value>0</Value>
2345 </Entry>
2346 <Entry type="4" type_name="REG_DWORD">
2347 <Key>Software\Policies\Google\Chrome</Key>
2348 <ValueName>BrowserSwitcherUseIeSitelist</ValueName>
2349 <Value>1</Value>
2350 </Entry>
2351 <Entry type="1" type_name="REG_SZ">
2352 <Key>Software\Policies\Google\Chrome</Key>
2353 <ValueName>BrowserThemeColor</ValueName>
2354 <Value>#FFFFFF</Value>
2355 </Entry>
2356 <Entry type="1" type_name="REG_SZ">
2357 <Key>Software\Policies\Google\Chrome</Key>
2358 <ValueName>BrowsingDataLifetime</ValueName>
2359 <Value>[{&quot;data_types&quot;: [&quot;browsing_history&quot;], &quot;time_to_live_in_hours&quot;: 24}, {&quot;data_types&quot;: [&quot;password_signin&quot;, &quot;autofill&quot;], &quot;time_to_live_in_hours&quot;: 12}]</Value>
2360 </Entry>
2361 <Entry type="4" type_name="REG_DWORD">
2362 <Key>Software\Policies\Google\Chrome</Key>
2363 <ValueName>BuiltInDnsClientEnabled</ValueName>
2364 <Value>1</Value>
2365 </Entry>
2366 <Entry type="4" type_name="REG_DWORD">
2367 <Key>Software\Policies\Google\Chrome</Key>
2368 <ValueName>CECPQ2Enabled</ValueName>
2369 <Value>1</Value>
2370 </Entry>
2371 <Entry type="4" type_name="REG_DWORD">
2372 <Key>Software\Policies\Google\Chrome</Key>
2373 <ValueName>ChromeCleanupEnabled</ValueName>
2374 <Value>1</Value>
2375 </Entry>
2376 <Entry type="4" type_name="REG_DWORD">
2377 <Key>Software\Policies\Google\Chrome</Key>
2378 <ValueName>ChromeCleanupReportingEnabled</ValueName>
2379 <Value>1</Value>
2380 </Entry>
2381 <Entry type="4" type_name="REG_DWORD">
2382 <Key>Software\Policies\Google\Chrome</Key>
2383 <ValueName>ChromeVariations</ValueName>
2384 <Value>1</Value>
2385 </Entry>
2386 <Entry type="4" type_name="REG_DWORD">
2387 <Key>Software\Policies\Google\Chrome</Key>
2388 <ValueName>ClickToCallEnabled</ValueName>
2389 <Value>1</Value>
2390 </Entry>
2391 <Entry type="4" type_name="REG_DWORD">
2392 <Key>Software\Policies\Google\Chrome</Key>
2393 <ValueName>CloudManagementEnrollmentMandatory</ValueName>
2394 <Value>1</Value>
2395 </Entry>
2396 <Entry type="1" type_name="REG_SZ">
2397 <Key>Software\Policies\Google\Chrome</Key>
2398 <ValueName>CloudManagementEnrollmentToken</ValueName>
2399 <Value>37185d02-e055-11e7-80c1-9a214cf093ae</Value>
2400 </Entry>
2401 <Entry type="4" type_name="REG_DWORD">
2402 <Key>Software\Policies\Google\Chrome</Key>
2403 <ValueName>CloudPolicyOverridesPlatformPolicy</ValueName>
2404 <Value>0</Value>
2405 </Entry>
2406 <Entry type="4" type_name="REG_DWORD">
2407 <Key>Software\Policies\Google\Chrome</Key>
2408 <ValueName>CloudPrintProxyEnabled</ValueName>
2409 <Value>1</Value>
2410 </Entry>
2411 <Entry type="4" type_name="REG_DWORD">
2412 <Key>Software\Policies\Google\Chrome</Key>
2413 <ValueName>CloudPrintSubmitEnabled</ValueName>
2414 <Value>1</Value>
2415 </Entry>
2416 <Entry type="4" type_name="REG_DWORD">
2417 <Key>Software\Policies\Google\Chrome</Key>
2418 <ValueName>CloudUserPolicyMerge</ValueName>
2419 <Value>1</Value>
2420 </Entry>
2421 <Entry type="4" type_name="REG_DWORD">
2422 <Key>Software\Policies\Google\Chrome</Key>
2423 <ValueName>CommandLineFlagSecurityWarningsEnabled</ValueName>
2424 <Value>1</Value>
2425 </Entry>
2426 <Entry type="4" type_name="REG_DWORD">
2427 <Key>Software\Policies\Google\Chrome</Key>
2428 <ValueName>ComponentUpdatesEnabled</ValueName>
2429 <Value>1</Value>
2430 </Entry>
2431 <Entry type="4" type_name="REG_DWORD">
2432 <Key>Software\Policies\Google\Chrome</Key>
2433 <ValueName>DNSInterceptionChecksEnabled</ValueName>
2434 <Value>1</Value>
2435 </Entry>
2436 <Entry type="4" type_name="REG_DWORD">
2437 <Key>Software\Policies\Google\Chrome</Key>
2438 <ValueName>DefaultBrowserSettingEnabled</ValueName>
2439 <Value>1</Value>
2440 </Entry>
2441 <Entry type="4" type_name="REG_DWORD">
2442 <Key>Software\Policies\Google\Chrome</Key>
2443 <ValueName>DefaultCookiesSetting</ValueName>
2444 <Value>1</Value>
2445 </Entry>
2446 <Entry type="4" type_name="REG_DWORD">
2447 <Key>Software\Policies\Google\Chrome</Key>
2448 <ValueName>DefaultFileHandlingGuardSetting</ValueName>
2449 <Value>2</Value>
2450 </Entry>
2451 <Entry type="4" type_name="REG_DWORD">
2452 <Key>Software\Policies\Google\Chrome</Key>
2453 <ValueName>DefaultFileSystemReadGuardSetting</ValueName>
2454 <Value>2</Value>
2455 </Entry>
2456 <Entry type="4" type_name="REG_DWORD">
2457 <Key>Software\Policies\Google\Chrome</Key>
2458 <ValueName>DefaultFileSystemWriteGuardSetting</ValueName>
2459 <Value>2</Value>
2460 </Entry>
2461 <Entry type="4" type_name="REG_DWORD">
2462 <Key>Software\Policies\Google\Chrome</Key>
2463 <ValueName>DefaultGeolocationSetting</ValueName>
2464 <Value>1</Value>
2465 </Entry>
2466 <Entry type="4" type_name="REG_DWORD">
2467 <Key>Software\Policies\Google\Chrome</Key>
2468 <ValueName>DefaultImagesSetting</ValueName>
2469 <Value>1</Value>
2470 </Entry>
2471 <Entry type="4" type_name="REG_DWORD">
2472 <Key>Software\Policies\Google\Chrome</Key>
2473 <ValueName>DefaultInsecureContentSetting</ValueName>
2474 <Value>2</Value>
2475 </Entry>
2476 <Entry type="4" type_name="REG_DWORD">
2477 <Key>Software\Policies\Google\Chrome</Key>
2478 <ValueName>DefaultJavaScriptSetting</ValueName>
2479 <Value>1</Value>
2480 </Entry>
2481 <Entry type="4" type_name="REG_DWORD">
2482 <Key>Software\Policies\Google\Chrome</Key>
2483 <ValueName>DefaultNotificationsSetting</ValueName>
2484 <Value>2</Value>
2485 </Entry>
2486 <Entry type="4" type_name="REG_DWORD">
2487 <Key>Software\Policies\Google\Chrome</Key>
2488 <ValueName>DefaultPopupsSetting</ValueName>
2489 <Value>1</Value>
2490 </Entry>
2491 <Entry type="1" type_name="REG_SZ">
2492 <Key>Software\Policies\Google\Chrome</Key>
2493 <ValueName>DefaultPrinterSelection</ValueName>
2494 <Value>{ &quot;kind&quot;: &quot;cloud&quot;, &quot;idPattern&quot;: &quot;.*public&quot;, &quot;namePattern&quot;: &quot;.*Color&quot; }</Value>
2495 </Entry>
2496 <Entry type="4" type_name="REG_DWORD">
2497 <Key>Software\Policies\Google\Chrome</Key>
2498 <ValueName>DefaultSearchProviderContextMenuAccessAllowed</ValueName>
2499 <Value>1</Value>
2500 </Entry>
2501 <Entry type="4" type_name="REG_DWORD">
2502 <Key>Software\Policies\Google\Chrome</Key>
2503 <ValueName>DefaultSearchProviderEnabled</ValueName>
2504 <Value>1</Value>
2505 </Entry>
2506 <Entry type="1" type_name="REG_SZ">
2507 <Key>Software\Policies\Google\Chrome</Key>
2508 <ValueName>DefaultSearchProviderIconURL</ValueName>
2509 <Value>https://search.my.company/favicon.ico</Value>
2510 </Entry>
2511 <Entry type="1" type_name="REG_SZ">
2512 <Key>Software\Policies\Google\Chrome</Key>
2513 <ValueName>DefaultSearchProviderImageURL</ValueName>
2514 <Value>https://search.my.company/searchbyimage/upload</Value>
2515 </Entry>
2516 <Entry type="1" type_name="REG_SZ">
2517 <Key>Software\Policies\Google\Chrome</Key>
2518 <ValueName>DefaultSearchProviderImageURLPostParams</ValueName>
2519 <Value>content={imageThumbnail},url={imageURL},sbisrc={SearchSource}</Value>
2520 </Entry>
2521 <Entry type="1" type_name="REG_SZ">
2522 <Key>Software\Policies\Google\Chrome</Key>
2523 <ValueName>DefaultSearchProviderKeyword</ValueName>
2524 <Value>mis</Value>
2525 </Entry>
2526 <Entry type="1" type_name="REG_SZ">
2527 <Key>Software\Policies\Google\Chrome</Key>
2528 <ValueName>DefaultSearchProviderName</ValueName>
2529 <Value>My Intranet Search</Value>
2530 </Entry>
2531 <Entry type="1" type_name="REG_SZ">
2532 <Key>Software\Policies\Google\Chrome</Key>
2533 <ValueName>DefaultSearchProviderNewTabURL</ValueName>
2534 <Value>https://search.my.company/newtab</Value>
2535 </Entry>
2536 <Entry type="1" type_name="REG_SZ">
2537 <Key>Software\Policies\Google\Chrome</Key>
2538 <ValueName>DefaultSearchProviderSearchURL</ValueName>
2539 <Value>https://search.my.company/search?q={searchTerms}</Value>
2540 </Entry>
2541 <Entry type="1" type_name="REG_SZ">
2542 <Key>Software\Policies\Google\Chrome</Key>
2543 <ValueName>DefaultSearchProviderSearchURLPostParams</ValueName>
2544 <Value>q={searchTerms},ie=utf-8,oe=utf-8</Value>
2545 </Entry>
2546 <Entry type="1" type_name="REG_SZ">
2547 <Key>Software\Policies\Google\Chrome</Key>
2548 <ValueName>DefaultSearchProviderSuggestURL</ValueName>
2549 <Value>https://search.my.company/suggest?q={searchTerms}</Value>
2550 </Entry>
2551 <Entry type="1" type_name="REG_SZ">
2552 <Key>Software\Policies\Google\Chrome</Key>
2553 <ValueName>DefaultSearchProviderSuggestURLPostParams</ValueName>
2554 <Value>q={searchTerms},ie=utf-8,oe=utf-8</Value>
2555 </Entry>
2556 <Entry type="4" type_name="REG_DWORD">
2557 <Key>Software\Policies\Google\Chrome</Key>
2558 <ValueName>DefaultSensorsSetting</ValueName>
2559 <Value>2</Value>
2560 </Entry>
2561 <Entry type="4" type_name="REG_DWORD">
2562 <Key>Software\Policies\Google\Chrome</Key>
2563 <ValueName>DefaultSerialGuardSetting</ValueName>
2564 <Value>2</Value>
2565 </Entry>
2566 <Entry type="4" type_name="REG_DWORD">
2567 <Key>Software\Policies\Google\Chrome</Key>
2568 <ValueName>DefaultWebBluetoothGuardSetting</ValueName>
2569 <Value>2</Value>
2570 </Entry>
2571 <Entry type="4" type_name="REG_DWORD">
2572 <Key>Software\Policies\Google\Chrome</Key>
2573 <ValueName>DefaultWebUsbGuardSetting</ValueName>
2574 <Value>2</Value>
2575 </Entry>
2576 <Entry type="4" type_name="REG_DWORD">
2577 <Key>Software\Policies\Google\Chrome</Key>
2578 <ValueName>DeveloperToolsAvailability</ValueName>
2579 <Value>2</Value>
2580 </Entry>
2581 <Entry type="4" type_name="REG_DWORD">
2582 <Key>Software\Policies\Google\Chrome</Key>
2583 <ValueName>Disable3DAPIs</ValueName>
2584 <Value>0</Value>
2585 </Entry>
2586 <Entry type="4" type_name="REG_DWORD">
2587 <Key>Software\Policies\Google\Chrome</Key>
2588 <ValueName>DisableAuthNegotiateCnameLookup</ValueName>
2589 <Value>0</Value>
2590 </Entry>
2591 <Entry type="4" type_name="REG_DWORD">
2592 <Key>Software\Policies\Google\Chrome</Key>
2593 <ValueName>DisablePrintPreview</ValueName>
2594 <Value>0</Value>
2595 </Entry>
2596 <Entry type="4" type_name="REG_DWORD">
2597 <Key>Software\Policies\Google\Chrome</Key>
2598 <ValueName>DisableSafeBrowsingProceedAnyway</ValueName>
2599 <Value>1</Value>
2600 </Entry>
2601 <Entry type="4" type_name="REG_DWORD">
2602 <Key>Software\Policies\Google\Chrome</Key>
2603 <ValueName>DisableScreenshots</ValueName>
2604 <Value>1</Value>
2605 </Entry>
2606 <Entry type="1" type_name="REG_SZ">
2607 <Key>Software\Policies\Google\Chrome</Key>
2608 <ValueName>DiskCacheDir</ValueName>
2609 <Value>${user_home}/Chrome_cache</Value>
2610 </Entry>
2611 <Entry type="4" type_name="REG_DWORD">
2612 <Key>Software\Policies\Google\Chrome</Key>
2613 <ValueName>DiskCacheSize</ValueName>
2614 <Value>104857600</Value>
2615 </Entry>
2616 <Entry type="1" type_name="REG_SZ">
2617 <Key>Software\Policies\Google\Chrome</Key>
2618 <ValueName>DnsOverHttpsMode</ValueName>
2619 <Value>off</Value>
2620 </Entry>
2621 <Entry type="1" type_name="REG_SZ">
2622 <Key>Software\Policies\Google\Chrome</Key>
2623 <ValueName>DnsOverHttpsTemplates</ValueName>
2624 <Value>https://dns.example.net/dns-query{?dns}</Value>
2625 </Entry>
2626 <Entry type="1" type_name="REG_SZ">
2627 <Key>Software\Policies\Google\Chrome</Key>
2628 <ValueName>DownloadDirectory</ValueName>
2629 <Value>/home/${user_name}/Downloads</Value>
2630 </Entry>
2631 <Entry type="4" type_name="REG_DWORD">
2632 <Key>Software\Policies\Google\Chrome</Key>
2633 <ValueName>DownloadRestrictions</ValueName>
2634 <Value>2</Value>
2635 </Entry>
2636 <Entry type="4" type_name="REG_DWORD">
2637 <Key>Software\Policies\Google\Chrome</Key>
2638 <ValueName>EditBookmarksEnabled</ValueName>
2639 <Value>0</Value>
2640 </Entry>
2641 <Entry type="4" type_name="REG_DWORD">
2642 <Key>Software\Policies\Google\Chrome</Key>
2643 <ValueName>EnableAuthNegotiatePort</ValueName>
2644 <Value>0</Value>
2645 </Entry>
2646 <Entry type="4" type_name="REG_DWORD">
2647 <Key>Software\Policies\Google\Chrome</Key>
2648 <ValueName>EnableDeprecatedPrivetPrinting</ValueName>
2649 <Value>1</Value>
2650 </Entry>
2651 <Entry type="4" type_name="REG_DWORD">
2652 <Key>Software\Policies\Google\Chrome</Key>
2653 <ValueName>EnableMediaRouter</ValueName>
2654 <Value>1</Value>
2655 </Entry>
2656 <Entry type="4" type_name="REG_DWORD">
2657 <Key>Software\Policies\Google\Chrome</Key>
2658 <ValueName>EnableOnlineRevocationChecks</ValueName>
2659 <Value>0</Value>
2660 </Entry>
2661 <Entry type="4" type_name="REG_DWORD">
2662 <Key>Software\Policies\Google\Chrome</Key>
2663 <ValueName>EnterpriseHardwarePlatformAPIEnabled</ValueName>
2664 <Value>1</Value>
2665 </Entry>
2666 <Entry type="1" type_name="REG_SZ">
2667 <Key>Software\Policies\Google\Chrome</Key>
2668 <ValueName>ExtensionSettings</ValueName>
2669 <Value>{&quot;*&quot;: {&quot;allowed_types&quot;: [&quot;hosted_app&quot;], &quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;blocked_permissions&quot;: [&quot;downloads&quot;, &quot;bookmarks&quot;], &quot;install_sources&quot;: [&quot;https://company-intranet/chromeapps&quot;], &quot;installation_mode&quot;: &quot;blocked&quot;, &quot;runtime_allowed_hosts&quot;: [&quot;*://good.example.com&quot;], &quot;runtime_blocked_hosts&quot;: [&quot;*://*.example.com&quot;]}, &quot;abcdefghijklmnopabcdefghijklmnop&quot;: {&quot;blocked_permissions&quot;: [&quot;history&quot;], &quot;installation_mode&quot;: &quot;allowed&quot;, &quot;minimum_version_required&quot;: &quot;1.0.1&quot;, &quot;toolbar_pin&quot;: &quot;force_pinned&quot;}, &quot;bcdefghijklmnopabcdefghijklmnopa&quot;: {&quot;allowed_permissions&quot;: [&quot;downloads&quot;], &quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;runtime_allowed_hosts&quot;: [&quot;*://good.example.com&quot;], &quot;runtime_blocked_hosts&quot;: [&quot;*://*.example.com&quot;], &quot;update_url&quot;: &quot;https://example.com/update_url&quot;}, &quot;cdefghijklmnopabcdefghijklmnopab&quot;: {&quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;installation_mode&quot;: &quot;blocked&quot;}, &quot;defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd&quot;: {&quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;installation_mode&quot;: &quot;blocked&quot;}, &quot;fghijklmnopabcdefghijklmnopabcde&quot;: {&quot;blocked_install_message&quot;: &quot;Custom removal message.&quot;, &quot;installation_mode&quot;: &quot;removed&quot;}, &quot;ghijklmnopabcdefghijklmnopabcdef&quot;: {&quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;override_update_url&quot;: true, &quot;update_url&quot;: &quot;https://example.com/update_url&quot;}, &quot;update_url:https://www.example.com/update.xml&quot;: {&quot;allowed_permissions&quot;: [&quot;downloads&quot;], &quot;blocked_permissions&quot;: [&quot;wallpaper&quot;], &quot;installation_mode&quot;: &quot;allowed&quot;}}</Value>
2670 </Entry>
2671 <Entry type="4" type_name="REG_DWORD">
2672 <Key>Software\Policies\Google\Chrome</Key>
2673 <ValueName>ExternalProtocolDialogShowAlwaysOpenCheckbox</ValueName>
2674 <Value>1</Value>
2675 </Entry>
2676 <Entry type="4" type_name="REG_DWORD">
2677 <Key>Software\Policies\Google\Chrome</Key>
2678 <ValueName>FetchKeepaliveDurationSecondsOnShutdown</ValueName>
2679 <Value>1</Value>
2680 </Entry>
2681 <Entry type="4" type_name="REG_DWORD">
2682 <Key>Software\Policies\Google\Chrome</Key>
2683 <ValueName>ForceEphemeralProfiles</ValueName>
2684 <Value>1</Value>
2685 </Entry>
2686 <Entry type="4" type_name="REG_DWORD">
2687 <Key>Software\Policies\Google\Chrome</Key>
2688 <ValueName>ForceGoogleSafeSearch</ValueName>
2689 <Value>0</Value>
2690 </Entry>
2691 <Entry type="4" type_name="REG_DWORD">
2692 <Key>Software\Policies\Google\Chrome</Key>
2693 <ValueName>ForceYouTubeRestrict</ValueName>
2694 <Value>0</Value>
2695 </Entry>
2696 <Entry type="4" type_name="REG_DWORD">
2697 <Key>Software\Policies\Google\Chrome</Key>
2698 <ValueName>FullscreenAllowed</ValueName>
2699 <Value>1</Value>
2700 </Entry>
2701 <Entry type="4" type_name="REG_DWORD">
2702 <Key>Software\Policies\Google\Chrome</Key>
2703 <ValueName>GloballyScopeHTTPAuthCacheEnabled</ValueName>
2704 <Value>0</Value>
2705 </Entry>
2706 <Entry type="4" type_name="REG_DWORD">
2707 <Key>Software\Policies\Google\Chrome</Key>
2708 <ValueName>HardwareAccelerationModeEnabled</ValueName>
2709 <Value>1</Value>
2710 </Entry>
2711 <Entry type="4" type_name="REG_DWORD">
2712 <Key>Software\Policies\Google\Chrome</Key>
2713 <ValueName>HeadlessMode</ValueName>
2714 <Value>2</Value>
2715 </Entry>
2716 <Entry type="4" type_name="REG_DWORD">
2717 <Key>Software\Policies\Google\Chrome</Key>
2718 <ValueName>HideWebStoreIcon</ValueName>
2719 <Value>1</Value>
2720 </Entry>
2721 <Entry type="4" type_name="REG_DWORD">
2722 <Key>Software\Policies\Google\Chrome</Key>
2723 <ValueName>HomepageIsNewTabPage</ValueName>
2724 <Value>1</Value>
2725 </Entry>
2726 <Entry type="1" type_name="REG_SZ">
2727 <Key>Software\Policies\Google\Chrome</Key>
2728 <ValueName>HomepageLocation</ValueName>
2729 <Value>https://www.chromium.org</Value>
2730 </Entry>
2731 <Entry type="4" type_name="REG_DWORD">
2732 <Key>Software\Policies\Google\Chrome</Key>
2733 <ValueName>ImportAutofillFormData</ValueName>
2734 <Value>1</Value>
2735 </Entry>
2736 <Entry type="4" type_name="REG_DWORD">
2737 <Key>Software\Policies\Google\Chrome</Key>
2738 <ValueName>ImportBookmarks</ValueName>
2739 <Value>1</Value>
2740 </Entry>
2741 <Entry type="4" type_name="REG_DWORD">
2742 <Key>Software\Policies\Google\Chrome</Key>
2743 <ValueName>ImportHistory</ValueName>
2744 <Value>1</Value>
2745 </Entry>
2746 <Entry type="4" type_name="REG_DWORD">
2747 <Key>Software\Policies\Google\Chrome</Key>
2748 <ValueName>ImportHomepage</ValueName>
2749 <Value>1</Value>
2750 </Entry>
2751 <Entry type="4" type_name="REG_DWORD">
2752 <Key>Software\Policies\Google\Chrome</Key>
2753 <ValueName>ImportSavedPasswords</ValueName>
2754 <Value>1</Value>
2755 </Entry>
2756 <Entry type="4" type_name="REG_DWORD">
2757 <Key>Software\Policies\Google\Chrome</Key>
2758 <ValueName>ImportSearchEngine</ValueName>
2759 <Value>1</Value>
2760 </Entry>
2761 <Entry type="4" type_name="REG_DWORD">
2762 <Key>Software\Policies\Google\Chrome</Key>
2763 <ValueName>IncognitoModeAvailability</ValueName>
2764 <Value>1</Value>
2765 </Entry>
2766 <Entry type="4" type_name="REG_DWORD">
2767 <Key>Software\Policies\Google\Chrome</Key>
2768 <ValueName>InsecureFormsWarningsEnabled</ValueName>
2769 <Value>1</Value>
2770 </Entry>
2771 <Entry type="4" type_name="REG_DWORD">
2772 <Key>Software\Policies\Google\Chrome</Key>
2773 <ValueName>InsecurePrivateNetworkRequestsAllowed</ValueName>
2774 <Value>0</Value>
2775 </Entry>
2776 <Entry type="4" type_name="REG_DWORD">
2777 <Key>Software\Policies\Google\Chrome</Key>
2778 <ValueName>IntensiveWakeUpThrottlingEnabled</ValueName>
2779 <Value>1</Value>
2780 </Entry>
2781 <Entry type="4" type_name="REG_DWORD">
2782 <Key>Software\Policies\Google\Chrome</Key>
2783 <ValueName>IntranetRedirectBehavior</ValueName>
2784 <Value>1</Value>
2785 </Entry>
2786 <Entry type="1" type_name="REG_SZ">
2787 <Key>Software\Policies\Google\Chrome</Key>
2788 <ValueName>IsolateOrigins</ValueName>
2789 <Value>https://example.com/,https://othersite.org/</Value>
2790 </Entry>
2791 <Entry type="1" type_name="REG_SZ">
2792 <Key>Software\Policies\Google\Chrome</Key>
2793 <ValueName>ManagedBookmarks</ValueName>
2794 <Value>[{&quot;toplevel_name&quot;: &quot;My managed bookmarks folder&quot;}, {&quot;name&quot;: &quot;Google&quot;, &quot;url&quot;: &quot;google.com&quot;}, {&quot;name&quot;: &quot;Youtube&quot;, &quot;url&quot;: &quot;youtube.com&quot;}, {&quot;children&quot;: [{&quot;name&quot;: &quot;Chromium&quot;, &quot;url&quot;: &quot;chromium.org&quot;}, {&quot;name&quot;: &quot;Chromium Developers&quot;, &quot;url&quot;: &quot;dev.chromium.org&quot;}], &quot;name&quot;: &quot;Chrome links&quot;}]</Value>
2795 </Entry>
2796 <Entry type="1" type_name="REG_SZ">
2797 <Key>Software\Policies\Google\Chrome</Key>
2798 <ValueName>ManagedConfigurationPerOrigin</ValueName>
2799 <Value>[{&quot;managed_configuration_hash&quot;: &quot;asd891jedasd12ue9h&quot;, &quot;managed_configuration_url&quot;: &quot;https://gstatic.google.com/configuration.json&quot;, &quot;origin&quot;: &quot;https://www.google.com&quot;}, {&quot;managed_configuration_hash&quot;: &quot;djio12easd89u12aws&quot;, &quot;managed_configuration_url&quot;: &quot;https://gstatic.google.com/configuration2.json&quot;, &quot;origin&quot;: &quot;https://www.example.com&quot;}]</Value>
2800 </Entry>
2801 <Entry type="4" type_name="REG_DWORD">
2802 <Key>Software\Policies\Google\Chrome</Key>
2803 <ValueName>MaxConnectionsPerProxy</ValueName>
2804 <Value>32</Value>
2805 </Entry>
2806 <Entry type="4" type_name="REG_DWORD">
2807 <Key>Software\Policies\Google\Chrome</Key>
2808 <ValueName>MaxInvalidationFetchDelay</ValueName>
2809 <Value>10000</Value>
2810 </Entry>
2811 <Entry type="4" type_name="REG_DWORD">
2812 <Key>Software\Policies\Google\Chrome</Key>
2813 <ValueName>MediaRecommendationsEnabled</ValueName>
2814 <Value>1</Value>
2815 </Entry>
2816 <Entry type="4" type_name="REG_DWORD">
2817 <Key>Software\Policies\Google\Chrome</Key>
2818 <ValueName>MediaRouterCastAllowAllIPs</ValueName>
2819 <Value>0</Value>
2820 </Entry>
2821 <Entry type="4" type_name="REG_DWORD">
2822 <Key>Software\Policies\Google\Chrome</Key>
2823 <ValueName>MetricsReportingEnabled</ValueName>
2824 <Value>1</Value>
2825 </Entry>
2826 <Entry type="4" type_name="REG_DWORD">
2827 <Key>Software\Policies\Google\Chrome</Key>
2828 <ValueName>NTPCardsVisible</ValueName>
2829 <Value>1</Value>
2830 </Entry>
2831 <Entry type="4" type_name="REG_DWORD">
2832 <Key>Software\Policies\Google\Chrome</Key>
2833 <ValueName>NTPCustomBackgroundEnabled</ValueName>
2834 <Value>1</Value>
2835 </Entry>
2836 <Entry type="4" type_name="REG_DWORD">
2837 <Key>Software\Policies\Google\Chrome</Key>
2838 <ValueName>NativeMessagingUserLevelHosts</ValueName>
2839 <Value>0</Value>
2840 </Entry>
2841 <Entry type="4" type_name="REG_DWORD">
2842 <Key>Software\Policies\Google\Chrome</Key>
2843 <ValueName>NetworkPredictionOptions</ValueName>
2844 <Value>1</Value>
2845 </Entry>
2846 <Entry type="1" type_name="REG_SZ">
2847 <Key>Software\Policies\Google\Chrome</Key>
2848 <ValueName>NewTabPageLocation</ValueName>
2849 <Value>https://www.chromium.org</Value>
2850 </Entry>
2851 <Entry type="4" type_name="REG_DWORD">
2852 <Key>Software\Policies\Google\Chrome</Key>
2853 <ValueName>PasswordLeakDetectionEnabled</ValueName>
2854 <Value>1</Value>
2855 </Entry>
2856 <Entry type="4" type_name="REG_DWORD">
2857 <Key>Software\Policies\Google\Chrome</Key>
2858 <ValueName>PasswordManagerEnabled</ValueName>
2859 <Value>1</Value>
2860 </Entry>
2861 <Entry type="1" type_name="REG_SZ">
2862 <Key>Software\Policies\Google\Chrome</Key>
2863 <ValueName>PasswordProtectionChangePasswordURL</ValueName>
2864 <Value>https://mydomain.com/change_password.html</Value>
2865 </Entry>
2866 <Entry type="4" type_name="REG_DWORD">
2867 <Key>Software\Policies\Google\Chrome</Key>
2868 <ValueName>PasswordProtectionWarningTrigger</ValueName>
2869 <Value>1</Value>
2870 </Entry>
2871 <Entry type="4" type_name="REG_DWORD">
2872 <Key>Software\Policies\Google\Chrome</Key>
2873 <ValueName>PaymentMethodQueryEnabled</ValueName>
2874 <Value>1</Value>
2875 </Entry>
2876 <Entry type="4" type_name="REG_DWORD">
2877 <Key>Software\Policies\Google\Chrome</Key>
2878 <ValueName>PolicyAtomicGroupsEnabled</ValueName>
2879 <Value>1</Value>
2880 </Entry>
2881 <Entry type="4" type_name="REG_DWORD">
2882 <Key>Software\Policies\Google\Chrome</Key>
2883 <ValueName>PolicyRefreshRate</ValueName>
2884 <Value>3600000</Value>
2885 </Entry>
2886 <Entry type="4" type_name="REG_DWORD">
2887 <Key>Software\Policies\Google\Chrome</Key>
2888 <ValueName>PrintHeaderFooter</ValueName>
2889 <Value>0</Value>
2890 </Entry>
2891 <Entry type="4" type_name="REG_DWORD">
2892 <Key>Software\Policies\Google\Chrome</Key>
2893 <ValueName>PrintPreviewUseSystemDefaultPrinter</ValueName>
2894 <Value>0</Value>
2895 </Entry>
2896 <Entry type="4" type_name="REG_DWORD">
2897 <Key>Software\Policies\Google\Chrome</Key>
2898 <ValueName>PrintRasterizationMode</ValueName>
2899 <Value>1</Value>
2900 </Entry>
2901 <Entry type="1" type_name="REG_SZ">
2902 <Key>Software\Policies\Google\Chrome</Key>
2903 <ValueName>PrintingAllowedBackgroundGraphicsModes</ValueName>
2904 <Value>enabled</Value>
2905 </Entry>
2906 <Entry type="1" type_name="REG_SZ">
2907 <Key>Software\Policies\Google\Chrome</Key>
2908 <ValueName>PrintingBackgroundGraphicsDefault</ValueName>
2909 <Value>enabled</Value>
2910 </Entry>
2911 <Entry type="4" type_name="REG_DWORD">
2912 <Key>Software\Policies\Google\Chrome</Key>
2913 <ValueName>PrintingEnabled</ValueName>
2914 <Value>1</Value>
2915 </Entry>
2916 <Entry type="1" type_name="REG_SZ">
2917 <Key>Software\Policies\Google\Chrome</Key>
2918 <ValueName>PrintingPaperSizeDefault</ValueName>
2919 <Value>{&quot;custom_size&quot;: {&quot;height&quot;: 297000, &quot;width&quot;: 210000}, &quot;name&quot;: &quot;custom&quot;}</Value>
2920 </Entry>
2921 <Entry type="4" type_name="REG_DWORD">
2922 <Key>Software\Policies\Google\Chrome</Key>
2923 <ValueName>ProfilePickerOnStartupAvailability</ValueName>
2924 <Value>0</Value>
2925 </Entry>
2926 <Entry type="4" type_name="REG_DWORD">
2927 <Key>Software\Policies\Google\Chrome</Key>
2928 <ValueName>PromotionalTabsEnabled</ValueName>
2929 <Value>0</Value>
2930 </Entry>
2931 <Entry type="4" type_name="REG_DWORD">
2932 <Key>Software\Policies\Google\Chrome</Key>
2933 <ValueName>PromptForDownloadLocation</ValueName>
2934 <Value>0</Value>
2935 </Entry>
2936 <Entry type="1" type_name="REG_SZ">
2937 <Key>Software\Policies\Google\Chrome</Key>
2938 <ValueName>ProxySettings</ValueName>
2939 <Value>{&quot;ProxyBypassList&quot;: &quot;https://www.example1.com,https://www.example2.com,https://internalsite/&quot;, &quot;ProxyMode&quot;: &quot;direct&quot;, &quot;ProxyPacUrl&quot;: &quot;https://internal.site/example.pac&quot;, &quot;ProxyServer&quot;: &quot;123.123.123.123:8080&quot;, &quot;ProxyServerMode&quot;: 2}</Value>
2940 </Entry>
2941 <Entry type="4" type_name="REG_DWORD">
2942 <Key>Software\Policies\Google\Chrome</Key>
2943 <ValueName>QuicAllowed</ValueName>
2944 <Value>1</Value>
2945 </Entry>
2946 <Entry type="4" type_name="REG_DWORD">
2947 <Key>Software\Policies\Google\Chrome</Key>
2948 <ValueName>RelaunchNotification</ValueName>
2949 <Value>1</Value>
2950 </Entry>
2951 <Entry type="4" type_name="REG_DWORD">
2952 <Key>Software\Policies\Google\Chrome</Key>
2953 <ValueName>RelaunchNotificationPeriod</ValueName>
2954 <Value>604800000</Value>
2955 </Entry>
2956 <Entry type="4" type_name="REG_DWORD">
2957 <Key>Software\Policies\Google\Chrome</Key>
2958 <ValueName>RemoteAccessHostAllowClientPairing</ValueName>
2959 <Value>0</Value>
2960 </Entry>
2961 <Entry type="4" type_name="REG_DWORD">
2962 <Key>Software\Policies\Google\Chrome</Key>
2963 <ValueName>RemoteAccessHostAllowFileTransfer</ValueName>
2964 <Value>0</Value>
2965 </Entry>
2966 <Entry type="4" type_name="REG_DWORD">
2967 <Key>Software\Policies\Google\Chrome</Key>
2968 <ValueName>RemoteAccessHostAllowRelayedConnection</ValueName>
2969 <Value>0</Value>
2970 </Entry>
2971 <Entry type="4" type_name="REG_DWORD">
2972 <Key>Software\Policies\Google\Chrome</Key>
2973 <ValueName>RemoteAccessHostAllowRemoteAccessConnections</ValueName>
2974 <Value>0</Value>
2975 </Entry>
2976 <Entry type="4" type_name="REG_DWORD">
2977 <Key>Software\Policies\Google\Chrome</Key>
2978 <ValueName>RemoteAccessHostAllowUiAccessForRemoteAssistance</ValueName>
2979 <Value>1</Value>
2980 </Entry>
2981 <Entry type="4" type_name="REG_DWORD">
2982 <Key>Software\Policies\Google\Chrome</Key>
2983 <ValueName>RemoteAccessHostFirewallTraversal</ValueName>
2984 <Value>0</Value>
2985 </Entry>
2986 <Entry type="4" type_name="REG_DWORD">
2987 <Key>Software\Policies\Google\Chrome</Key>
2988 <ValueName>RemoteAccessHostMaximumSessionDurationMinutes</ValueName>
2989 <Value>1200</Value>
2990 </Entry>
2991 <Entry type="4" type_name="REG_DWORD">
2992 <Key>Software\Policies\Google\Chrome</Key>
2993 <ValueName>RemoteAccessHostRequireCurtain</ValueName>
2994 <Value>0</Value>
2995 </Entry>
2996 <Entry type="1" type_name="REG_SZ">
2997 <Key>Software\Policies\Google\Chrome</Key>
2998 <ValueName>RemoteAccessHostUdpPortRange</ValueName>
2999 <Value>12400-12409</Value>
3000 </Entry>
3001 <Entry type="4" type_name="REG_DWORD">
3002 <Key>Software\Policies\Google\Chrome</Key>
3003 <ValueName>RendererCodeIntegrityEnabled</ValueName>
3004 <Value>0</Value>
3005 </Entry>
3006 <Entry type="4" type_name="REG_DWORD">
3007 <Key>Software\Policies\Google\Chrome</Key>
3008 <ValueName>RequireOnlineRevocationChecksForLocalAnchors</ValueName>
3009 <Value>0</Value>
3010 </Entry>
3011 <Entry type="4" type_name="REG_DWORD">
3012 <Key>Software\Policies\Google\Chrome</Key>
3013 <ValueName>RestoreOnStartup</ValueName>
3014 <Value>4</Value>
3015 </Entry>
3016 <Entry type="1" type_name="REG_SZ">
3017 <Key>Software\Policies\Google\Chrome</Key>
3018 <ValueName>RestrictSigninToPattern</ValueName>
3019 <Value>.*@example\.com</Value>
3020 </Entry>
3021 <Entry type="1" type_name="REG_SZ">
3022 <Key>Software\Policies\Google\Chrome</Key>
3023 <ValueName>RoamingProfileLocation</ValueName>
3024 <Value>${roaming_app_data}\chrome-profile</Value>
3025 </Entry>
3026 <Entry type="4" type_name="REG_DWORD">
3027 <Key>Software\Policies\Google\Chrome</Key>
3028 <ValueName>RoamingProfileSupportEnabled</ValueName>
3029 <Value>1</Value>
3030 </Entry>
3031 <Entry type="4" type_name="REG_DWORD">
3032 <Key>Software\Policies\Google\Chrome</Key>
3033 <ValueName>SSLErrorOverrideAllowed</ValueName>
3034 <Value>1</Value>
3035 </Entry>
3036 <Entry type="1" type_name="REG_SZ">
3037 <Key>Software\Policies\Google\Chrome</Key>
3038 <ValueName>SSLVersionMin</ValueName>
3039 <Value>tls1</Value>
3040 </Entry>
3041 <Entry type="4" type_name="REG_DWORD">
3042 <Key>Software\Policies\Google\Chrome</Key>
3043 <ValueName>SafeBrowsingExtendedReportingEnabled</ValueName>
3044 <Value>1</Value>
3045 </Entry>
3046 <Entry type="4" type_name="REG_DWORD">
3047 <Key>Software\Policies\Google\Chrome</Key>
3048 <ValueName>SafeBrowsingForTrustedSourcesEnabled</ValueName>
3049 <Value>0</Value>
3050 </Entry>
3051 <Entry type="4" type_name="REG_DWORD">
3052 <Key>Software\Policies\Google\Chrome</Key>
3053 <ValueName>SafeBrowsingProtectionLevel</ValueName>
3054 <Value>2</Value>
3055 </Entry>
3056 <Entry type="4" type_name="REG_DWORD">
3057 <Key>Software\Policies\Google\Chrome</Key>
3058 <ValueName>SafeSitesFilterBehavior</ValueName>
3059 <Value>0</Value>
3060 </Entry>
3061 <Entry type="4" type_name="REG_DWORD">
3062 <Key>Software\Policies\Google\Chrome</Key>
3063 <ValueName>SavingBrowserHistoryDisabled</ValueName>
3064 <Value>1</Value>
3065 </Entry>
3066 <Entry type="4" type_name="REG_DWORD">
3067 <Key>Software\Policies\Google\Chrome</Key>
3068 <ValueName>ScreenCaptureAllowed</ValueName>
3069 <Value>0</Value>
3070 </Entry>
3071 <Entry type="4" type_name="REG_DWORD">
3072 <Key>Software\Policies\Google\Chrome</Key>
3073 <ValueName>ScrollToTextFragmentEnabled</ValueName>
3074 <Value>0</Value>
3075 </Entry>
3076 <Entry type="4" type_name="REG_DWORD">
3077 <Key>Software\Policies\Google\Chrome</Key>
3078 <ValueName>SearchSuggestEnabled</ValueName>
3079 <Value>1</Value>
3080 </Entry>
3081 <Entry type="4" type_name="REG_DWORD">
3082 <Key>Software\Policies\Google\Chrome</Key>
3083 <ValueName>SharedArrayBufferUnrestrictedAccessAllowed</ValueName>
3084 <Value>1</Value>
3085 </Entry>
3086 <Entry type="4" type_name="REG_DWORD">
3087 <Key>Software\Policies\Google\Chrome</Key>
3088 <ValueName>SharedClipboardEnabled</ValueName>
3089 <Value>1</Value>
3090 </Entry>
3091 <Entry type="4" type_name="REG_DWORD">
3092 <Key>Software\Policies\Google\Chrome</Key>
3093 <ValueName>ShowAppsShortcutInBookmarkBar</ValueName>
3094 <Value>0</Value>
3095 </Entry>
3096 <Entry type="4" type_name="REG_DWORD">
3097 <Key>Software\Policies\Google\Chrome</Key>
3098 <ValueName>ShowCastIconInToolbar</ValueName>
3099 <Value>0</Value>
3100 </Entry>
3101 <Entry type="4" type_name="REG_DWORD">
3102 <Key>Software\Policies\Google\Chrome</Key>
3103 <ValueName>ShowFullUrlsInAddressBar</ValueName>
3104 <Value>0</Value>
3105 </Entry>
3106 <Entry type="4" type_name="REG_DWORD">
3107 <Key>Software\Policies\Google\Chrome</Key>
3108 <ValueName>ShowHomeButton</ValueName>
3109 <Value>1</Value>
3110 </Entry>
3111 <Entry type="4" type_name="REG_DWORD">
3112 <Key>Software\Policies\Google\Chrome</Key>
3113 <ValueName>SignedHTTPExchangeEnabled</ValueName>
3114 <Value>1</Value>
3115 </Entry>
3116 <Entry type="4" type_name="REG_DWORD">
3117 <Key>Software\Policies\Google\Chrome</Key>
3118 <ValueName>SigninInterceptionEnabled</ValueName>
3119 <Value>1</Value>
3120 </Entry>
3121 <Entry type="4" type_name="REG_DWORD">
3122 <Key>Software\Policies\Google\Chrome</Key>
3123 <ValueName>SitePerProcess</ValueName>
3124 <Value>1</Value>
3125 </Entry>
3126 <Entry type="4" type_name="REG_DWORD">
3127 <Key>Software\Policies\Google\Chrome</Key>
3128 <ValueName>SpellCheckServiceEnabled</ValueName>
3129 <Value>0</Value>
3130 </Entry>
3131 <Entry type="4" type_name="REG_DWORD">
3132 <Key>Software\Policies\Google\Chrome</Key>
3133 <ValueName>SpellcheckEnabled</ValueName>
3134 <Value>0</Value>
3135 </Entry>
3136 <Entry type="4" type_name="REG_DWORD">
3137 <Key>Software\Policies\Google\Chrome</Key>
3138 <ValueName>SuppressDifferentOriginSubframeDialogs</ValueName>
3139 <Value>1</Value>
3140 </Entry>
3141 <Entry type="4" type_name="REG_DWORD">
3142 <Key>Software\Policies\Google\Chrome</Key>
3143 <ValueName>SuppressUnsupportedOSWarning</ValueName>
3144 <Value>1</Value>
3145 </Entry>
3146 <Entry type="4" type_name="REG_DWORD">
3147 <Key>Software\Policies\Google\Chrome</Key>
3148 <ValueName>SyncDisabled</ValueName>
3149 <Value>1</Value>
3150 </Entry>
3151 <Entry type="4" type_name="REG_DWORD">
3152 <Key>Software\Policies\Google\Chrome</Key>
3153 <ValueName>TargetBlankImpliesNoOpener</ValueName>
3154 <Value>0</Value>
3155 </Entry>
3156 <Entry type="4" type_name="REG_DWORD">
3157 <Key>Software\Policies\Google\Chrome</Key>
3158 <ValueName>TaskManagerEndProcessEnabled</ValueName>
3159 <Value>1</Value>
3160 </Entry>
3161 <Entry type="4" type_name="REG_DWORD">
3162 <Key>Software\Policies\Google\Chrome</Key>
3163 <ValueName>ThirdPartyBlockingEnabled</ValueName>
3164 <Value>0</Value>
3165 </Entry>
3166 <Entry type="4" type_name="REG_DWORD">
3167 <Key>Software\Policies\Google\Chrome</Key>
3168 <ValueName>TotalMemoryLimitMb</ValueName>
3169 <Value>2048</Value>
3170 </Entry>
3171 <Entry type="4" type_name="REG_DWORD">
3172 <Key>Software\Policies\Google\Chrome</Key>
3173 <ValueName>TranslateEnabled</ValueName>
3174 <Value>1</Value>
3175 </Entry>
3176 <Entry type="4" type_name="REG_DWORD">
3177 <Key>Software\Policies\Google\Chrome</Key>
3178 <ValueName>TripleDESEnabled</ValueName>
3179 <Value>0</Value>
3180 </Entry>
3181 <Entry type="4" type_name="REG_DWORD">
3182 <Key>Software\Policies\Google\Chrome</Key>
3183 <ValueName>UrlKeyedAnonymizedDataCollectionEnabled</ValueName>
3184 <Value>1</Value>
3185 </Entry>
3186 <Entry type="4" type_name="REG_DWORD">
3187 <Key>Software\Policies\Google\Chrome</Key>
3188 <ValueName>UserAgentClientHintsEnabled</ValueName>
3189 <Value>1</Value>
3190 </Entry>
3191 <Entry type="1" type_name="REG_SZ">
3192 <Key>Software\Policies\Google\Chrome</Key>
3193 <ValueName>UserDataDir</ValueName>
3194 <Value>${users}/${user_name}/Chrome</Value>
3195 </Entry>
3196 <Entry type="4" type_name="REG_DWORD">
3197 <Key>Software\Policies\Google\Chrome</Key>
3198 <ValueName>UserDataSnapshotRetentionLimit</ValueName>
3199 <Value>3</Value>
3200 </Entry>
3201 <Entry type="4" type_name="REG_DWORD">
3202 <Key>Software\Policies\Google\Chrome</Key>
3203 <ValueName>UserFeedbackAllowed</ValueName>
3204 <Value>1</Value>
3205 </Entry>
3206 <Entry type="4" type_name="REG_DWORD">
3207 <Key>Software\Policies\Google\Chrome</Key>
3208 <ValueName>VideoCaptureAllowed</ValueName>
3209 <Value>0</Value>
3210 </Entry>
3211 <Entry type="4" type_name="REG_DWORD">
3212 <Key>Software\Policies\Google\Chrome</Key>
3213 <ValueName>WPADQuickCheckEnabled</ValueName>
3214 <Value>1</Value>
3215 </Entry>
3216 <Entry type="1" type_name="REG_SZ">
3217 <Key>Software\Policies\Google\Chrome</Key>
3218 <ValueName>WebAppInstallForceList</ValueName>
3219 <Value>[{&quot;create_desktop_shortcut&quot;: true, &quot;default_launch_container&quot;: &quot;window&quot;, &quot;url&quot;: &quot;https://www.google.com/maps&quot;}, {&quot;default_launch_container&quot;: &quot;tab&quot;, &quot;url&quot;: &quot;https://docs.google.com&quot;}, {&quot;default_launch_container&quot;: &quot;window&quot;, &quot;fallback_app_name&quot;: &quot;Editor&quot;, &quot;url&quot;: &quot;https://docs.google.com/editor&quot;}]</Value>
3220 </Entry>
3221 <Entry type="4" type_name="REG_DWORD">
3222 <Key>Software\Policies\Google\Chrome</Key>
3223 <ValueName>WebRtcAllowLegacyTLSProtocols</ValueName>
3224 <Value>0</Value>
3225 </Entry>
3226 <Entry type="4" type_name="REG_DWORD">
3227 <Key>Software\Policies\Google\Chrome</Key>
3228 <ValueName>WebRtcEventLogCollectionAllowed</ValueName>
3229 <Value>1</Value>
3230 </Entry>
3231 <Entry type="1" type_name="REG_SZ">
3232 <Key>Software\Policies\Google\Chrome</Key>
3233 <ValueName>WebRtcIPHandling</ValueName>
3234 <Value>default</Value>
3235 </Entry>
3236 <Entry type="1" type_name="REG_SZ">
3237 <Key>Software\Policies\Google\Chrome</Key>
3238 <ValueName>WebRtcUdpPortRange</ValueName>
3239 <Value>10000-11999</Value>
3240 </Entry>
3241 <Entry type="1" type_name="REG_SZ">
3242 <Key>Software\Policies\Google\Chrome</Key>
3243 <ValueName>WebUsbAllowDevicesForUrls</ValueName>
3244 <Value>[{&quot;devices&quot;: [{&quot;product_id&quot;: 5678, &quot;vendor_id&quot;: 1234}], &quot;urls&quot;: [&quot;https://google.com&quot;]}]</Value>
3245 </Entry>
3246 <Entry type="4" type_name="REG_DWORD">
3247 <Key>Software\Policies\Google\Chrome</Key>
3248 <ValueName>WindowOcclusionEnabled</ValueName>
3249 <Value>1</Value>
3250 </Entry>
3251 <Entry type="1" type_name="REG_SZ">
3252 <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3253 <ValueName>1</ValueName>
3254 <Value>-foreground</Value>
3255 </Entry>
3256 <Entry type="1" type_name="REG_SZ">
3257 <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3258 <ValueName>2</ValueName>
3259 <Value>-new-window</Value>
3260 </Entry>
3261 <Entry type="1" type_name="REG_SZ">
3262 <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3263 <ValueName>3</ValueName>
3264 <Value>${url}</Value>
3265 </Entry>
3266 <Entry type="1" type_name="REG_SZ">
3267 <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3268 <ValueName>4</ValueName>
3269 <Value>-profile</Value>
3270 </Entry>
3271 <Entry type="1" type_name="REG_SZ">
3272 <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3273 <ValueName>5</ValueName>
3274 <Value>%HOME%\browser_profile</Value>
3275 </Entry>
3276 <Entry type="1" type_name="REG_SZ">
3277 <Key>Software\Policies\Google\Chrome\AudioCaptureAllowedUrls</Key>
3278 <ValueName>1</ValueName>
3279 <Value>https://www.example.com/</Value>
3280 </Entry>
3281 <Entry type="1" type_name="REG_SZ">
3282 <Key>Software\Policies\Google\Chrome\AudioCaptureAllowedUrls</Key>
3283 <ValueName>2</ValueName>
3284 <Value>https://[*.]example.edu/</Value>
3285 </Entry>
3286 <Entry type="1" type_name="REG_SZ">
3287 <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3288 <ValueName>1</ValueName>
3289 <Value>example.com</Value>
3290 </Entry>
3291 <Entry type="1" type_name="REG_SZ">
3292 <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3293 <ValueName>2</ValueName>
3294 <Value>https://ssl.server.com</Value>
3295 </Entry>
3296 <Entry type="1" type_name="REG_SZ">
3297 <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3298 <ValueName>3</ValueName>
3299 <Value>hosting.com/good_path</Value>
3300 </Entry>
3301 <Entry type="1" type_name="REG_SZ">
3302 <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3303 <ValueName>4</ValueName>
3304 <Value>https://server:8080/path</Value>
3305 </Entry>
3306 <Entry type="1" type_name="REG_SZ">
3307 <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3308 <ValueName>5</ValueName>
3309 <Value>.exact.hostname.com</Value>
3310 </Entry>
3311 <Entry type="1" type_name="REG_SZ">
3312 <Key>Software\Policies\Google\Chrome\AutoOpenFileTypes</Key>
3313 <ValueName>1</ValueName>
3314 <Value>exe</Value>
3315 </Entry>
3316 <Entry type="1" type_name="REG_SZ">
3317 <Key>Software\Policies\Google\Chrome\AutoOpenFileTypes</Key>
3318 <ValueName>2</ValueName>
3319 <Value>txt</Value>
3320 </Entry>
3321 <Entry type="1" type_name="REG_SZ">
3322 <Key>Software\Policies\Google\Chrome\AutoSelectCertificateForUrls</Key>
3323 <ValueName>1</ValueName>
3324 <Value>{&quot;pattern&quot;:&quot;https://www.example.com&quot;,&quot;filter&quot;:{&quot;ISSUER&quot;:{&quot;CN&quot;:&quot;certificate issuer name&quot;, &quot;L&quot;: &quot;certificate issuer location&quot;, &quot;O&quot;: &quot;certificate issuer org&quot;, &quot;OU&quot;: &quot;certificate issuer org unit&quot;}, &quot;SUBJECT&quot;:{&quot;CN&quot;:&quot;certificate subject name&quot;, &quot;L&quot;: &quot;certificate subject location&quot;, &quot;O&quot;: &quot;certificate subject org&quot;, &quot;OU&quot;: &quot;certificate subject org unit&quot;}}}</Value>
3325 </Entry>
3326 <Entry type="1" type_name="REG_SZ">
3327 <Key>Software\Policies\Google\Chrome\AutoplayAllowlist</Key>
3328 <ValueName>1</ValueName>
3329 <Value>https://www.example.com</Value>
3330 </Entry>
3331 <Entry type="1" type_name="REG_SZ">
3332 <Key>Software\Policies\Google\Chrome\AutoplayAllowlist</Key>
3333 <ValueName>2</ValueName>
3334 <Value>[*.]example.edu</Value>
3335 </Entry>
3336 <Entry type="1" type_name="REG_SZ">
3337 <Key>Software\Policies\Google\Chrome\BrowserSwitcherChromeParameters</Key>
3338 <ValueName>1</ValueName>
3339 <Value>--force-dark-mode</Value>
3340 </Entry>
3341 <Entry type="1" type_name="REG_SZ">
3342 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3343 <ValueName>1</ValueName>
3344 <Value>ie.com</Value>
3345 </Entry>
3346 <Entry type="1" type_name="REG_SZ">
3347 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3348 <ValueName>2</ValueName>
3349 <Value>!open-in-chrome.ie.com</Value>
3350 </Entry>
3351 <Entry type="1" type_name="REG_SZ">
3352 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3353 <ValueName>3</ValueName>
3354 <Value>foobar.com/ie-only/</Value>
3355 </Entry>
3356 <Entry type="1" type_name="REG_SZ">
3357 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3358 <ValueName>1</ValueName>
3359 <Value>ie.com</Value>
3360 </Entry>
3361 <Entry type="1" type_name="REG_SZ">
3362 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3363 <ValueName>2</ValueName>
3364 <Value>!open-in-chrome.ie.com</Value>
3365 </Entry>
3366 <Entry type="1" type_name="REG_SZ">
3367 <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3368 <ValueName>3</ValueName>
3369 <Value>foobar.com/ie-only/</Value>
3370 </Entry>
3371 <Entry type="1" type_name="REG_SZ">
3372 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas</Key>
3373 <ValueName>1</ValueName>
3374 <Value>sha256/AAAAAAAAAAAAAAAAAAAAAA==</Value>
3375 </Entry>
3376 <Entry type="1" type_name="REG_SZ">
3377 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas</Key>
3378 <ValueName>2</ValueName>
3379 <Value>sha256//////////////////////w==</Value>
3380 </Entry>
3381 <Entry type="1" type_name="REG_SZ">
3382 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForLegacyCas</Key>
3383 <ValueName>1</ValueName>
3384 <Value>sha256/AAAAAAAAAAAAAAAAAAAAAA==</Value>
3385 </Entry>
3386 <Entry type="1" type_name="REG_SZ">
3387 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForLegacyCas</Key>
3388 <ValueName>2</ValueName>
3389 <Value>sha256//////////////////////w==</Value>
3390 </Entry>
3391 <Entry type="1" type_name="REG_SZ">
3392 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls</Key>
3393 <ValueName>1</ValueName>
3394 <Value>example.com</Value>
3395 </Entry>
3396 <Entry type="1" type_name="REG_SZ">
3397 <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls</Key>
3398 <ValueName>2</ValueName>
3399 <Value>.example.com</Value>
3400 </Entry>
3401 <Entry type="1" type_name="REG_SZ">
3402 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3403 <ValueName>1</ValueName>
3404 <Value>browsing_history</Value>
3405 </Entry>
3406 <Entry type="1" type_name="REG_SZ">
3407 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3408 <ValueName>2</ValueName>
3409 <Value>download_history</Value>
3410 </Entry>
3411 <Entry type="1" type_name="REG_SZ">
3412 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3413 <ValueName>3</ValueName>
3414 <Value>cookies_and_other_site_data</Value>
3415 </Entry>
3416 <Entry type="1" type_name="REG_SZ">
3417 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3418 <ValueName>4</ValueName>
3419 <Value>cached_images_and_files</Value>
3420 </Entry>
3421 <Entry type="1" type_name="REG_SZ">
3422 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3423 <ValueName>5</ValueName>
3424 <Value>password_signin</Value>
3425 </Entry>
3426 <Entry type="1" type_name="REG_SZ">
3427 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3428 <ValueName>6</ValueName>
3429 <Value>autofill</Value>
3430 </Entry>
3431 <Entry type="1" type_name="REG_SZ">
3432 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3433 <ValueName>7</ValueName>
3434 <Value>site_settings</Value>
3435 </Entry>
3436 <Entry type="1" type_name="REG_SZ">
3437 <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3438 <ValueName>8</ValueName>
3439 <Value>hosted_app_data</Value>
3440 </Entry>
3441 <Entry type="1" type_name="REG_SZ">
3442 <Key>Software\Policies\Google\Chrome\CookiesAllowedForUrls</Key>
3443 <ValueName>1</ValueName>
3444 <Value>https://www.example.com</Value>
3445 </Entry>
3446 <Entry type="1" type_name="REG_SZ">
3447 <Key>Software\Policies\Google\Chrome\CookiesAllowedForUrls</Key>
3448 <ValueName>2</ValueName>
3449 <Value>[*.]example.edu</Value>
3450 </Entry>
3451 <Entry type="1" type_name="REG_SZ">
3452 <Key>Software\Policies\Google\Chrome\CookiesBlockedForUrls</Key>
3453 <ValueName>1</ValueName>
3454 <Value>https://www.example.com</Value>
3455 </Entry>
3456 <Entry type="1" type_name="REG_SZ">
3457 <Key>Software\Policies\Google\Chrome\CookiesBlockedForUrls</Key>
3458 <ValueName>2</ValueName>
3459 <Value>[*.]example.edu</Value>
3460 </Entry>
3461 <Entry type="1" type_name="REG_SZ">
3462 <Key>Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls</Key>
3463 <ValueName>1</ValueName>
3464 <Value>https://www.example.com</Value>
3465 </Entry>
3466 <Entry type="1" type_name="REG_SZ">
3467 <Key>Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls</Key>
3468 <ValueName>2</ValueName>
3469 <Value>[*.]example.edu</Value>
3470 </Entry>
3471 <Entry type="1" type_name="REG_SZ">
3472 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs</Key>
3473 <ValueName>1</ValueName>
3474 <Value>https://search.my.company/suggest#q={searchTerms}</Value>
3475 </Entry>
3476 <Entry type="1" type_name="REG_SZ">
3477 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs</Key>
3478 <ValueName>2</ValueName>
3479 <Value>https://search.my.company/suggest/search#q={searchTerms}</Value>
3480 </Entry>
3481 <Entry type="1" type_name="REG_SZ">
3482 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3483 <ValueName>1</ValueName>
3484 <Value>UTF-8</Value>
3485 </Entry>
3486 <Entry type="1" type_name="REG_SZ">
3487 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3488 <ValueName>2</ValueName>
3489 <Value>UTF-16</Value>
3490 </Entry>
3491 <Entry type="1" type_name="REG_SZ">
3492 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3493 <ValueName>3</ValueName>
3494 <Value>GB2312</Value>
3495 </Entry>
3496 <Entry type="1" type_name="REG_SZ">
3497 <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3498 <ValueName>4</ValueName>
3499 <Value>ISO-8859-1</Value>
3500 </Entry>
3501 <Entry type="1" type_name="REG_SZ">
3502 <Key>Software\Policies\Google\Chrome\EnableExperimentalPolicies</Key>
3503 <ValueName>1</ValueName>
3504 <Value>ExtensionInstallAllowlist</Value>
3505 </Entry>
3506 <Entry type="1" type_name="REG_SZ">
3507 <Key>Software\Policies\Google\Chrome\EnableExperimentalPolicies</Key>
3508 <ValueName>2</ValueName>
3509 <Value>ExtensionInstallBlocklist</Value>
3510 </Entry>
3511 <Entry type="1" type_name="REG_SZ">
3512 <Key>Software\Policies\Google\Chrome\ExplicitlyAllowedNetworkPorts</Key>
3513 <ValueName>1</ValueName>
3514 <Value>10080</Value>
3515 </Entry>
3516 <Entry type="1" type_name="REG_SZ">
3517 <Key>Software\Policies\Google\Chrome\ExtensionAllowedTypes</Key>
3518 <ValueName>1</ValueName>
3519 <Value>hosted_app</Value>
3520 </Entry>
3521 <Entry type="1" type_name="REG_SZ">
3522 <Key>Software\Policies\Google\Chrome\ExtensionInstallAllowlist</Key>
3523 <ValueName>1</ValueName>
3524 <Value>extension_id1</Value>
3525 </Entry>
3526 <Entry type="1" type_name="REG_SZ">
3527 <Key>Software\Policies\Google\Chrome\ExtensionInstallAllowlist</Key>
3528 <ValueName>2</ValueName>
3529 <Value>extension_id2</Value>
3530 </Entry>
3531 <Entry type="1" type_name="REG_SZ">
3532 <Key>Software\Policies\Google\Chrome\ExtensionInstallBlocklist</Key>
3533 <ValueName>1</ValueName>
3534 <Value>extension_id1</Value>
3535 </Entry>
3536 <Entry type="1" type_name="REG_SZ">
3537 <Key>Software\Policies\Google\Chrome\ExtensionInstallBlocklist</Key>
3538 <ValueName>2</ValueName>
3539 <Value>extension_id2</Value>
3540 </Entry>
3541 <Entry type="1" type_name="REG_SZ">
3542 <Key>Software\Policies\Google\Chrome\ExtensionInstallForcelist</Key>
3543 <ValueName>1</ValueName>
3544 <Value>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx</Value>
3545 </Entry>
3546 <Entry type="1" type_name="REG_SZ">
3547 <Key>Software\Policies\Google\Chrome\ExtensionInstallForcelist</Key>
3548 <ValueName>2</ValueName>
3549 <Value>abcdefghijklmnopabcdefghijklmnop</Value>
3550 </Entry>
3551 <Entry type="1" type_name="REG_SZ">
3552 <Key>Software\Policies\Google\Chrome\ExtensionInstallSources</Key>
3553 <ValueName>1</ValueName>
3554 <Value>https://corp.mycompany.com/*</Value>
3555 </Entry>
3556 <Entry type="1" type_name="REG_SZ">
3557 <Key>Software\Policies\Google\Chrome\FileHandlingAllowedForUrls</Key>
3558 <ValueName>1</ValueName>
3559 <Value>https://www.example.com</Value>
3560 </Entry>
3561 <Entry type="1" type_name="REG_SZ">
3562 <Key>Software\Policies\Google\Chrome\FileHandlingAllowedForUrls</Key>
3563 <ValueName>2</ValueName>
3564 <Value>[*.]example.edu</Value>
3565 </Entry>
3566 <Entry type="1" type_name="REG_SZ">
3567 <Key>Software\Policies\Google\Chrome\FileHandlingBlockedForUrls</Key>
3568 <ValueName>1</ValueName>
3569 <Value>https://www.example.com</Value>
3570 </Entry>
3571 <Entry type="1" type_name="REG_SZ">
3572 <Key>Software\Policies\Google\Chrome\FileHandlingBlockedForUrls</Key>
3573 <ValueName>2</ValueName>
3574 <Value>[*.]example.edu</Value>
3575 </Entry>
3576 <Entry type="1" type_name="REG_SZ">
3577 <Key>Software\Policies\Google\Chrome\FileSystemReadAskForUrls</Key>
3578 <ValueName>1</ValueName>
3579 <Value>https://www.example.com</Value>
3580 </Entry>
3581 <Entry type="1" type_name="REG_SZ">
3582 <Key>Software\Policies\Google\Chrome\FileSystemReadAskForUrls</Key>
3583 <ValueName>2</ValueName>
3584 <Value>[*.]example.edu</Value>
3585 </Entry>
3586 <Entry type="1" type_name="REG_SZ">
3587 <Key>Software\Policies\Google\Chrome\FileSystemReadBlockedForUrls</Key>
3588 <ValueName>1</ValueName>
3589 <Value>https://www.example.com</Value>
3590 </Entry>
3591 <Entry type="1" type_name="REG_SZ">
3592 <Key>Software\Policies\Google\Chrome\FileSystemReadBlockedForUrls</Key>
3593 <ValueName>2</ValueName>
3594 <Value>[*.]example.edu</Value>
3595 </Entry>
3596 <Entry type="1" type_name="REG_SZ">
3597 <Key>Software\Policies\Google\Chrome\FileSystemWriteAskForUrls</Key>
3598 <ValueName>1</ValueName>
3599 <Value>https://www.example.com</Value>
3600 </Entry>
3601 <Entry type="1" type_name="REG_SZ">
3602 <Key>Software\Policies\Google\Chrome\FileSystemWriteAskForUrls</Key>
3603 <ValueName>2</ValueName>
3604 <Value>[*.]example.edu</Value>
3605 </Entry>
3606 <Entry type="1" type_name="REG_SZ">
3607 <Key>Software\Policies\Google\Chrome\FileSystemWriteBlockedForUrls</Key>
3608 <ValueName>1</ValueName>
3609 <Value>https://www.example.com</Value>
3610 </Entry>
3611 <Entry type="1" type_name="REG_SZ">
3612 <Key>Software\Policies\Google\Chrome\FileSystemWriteBlockedForUrls</Key>
3613 <ValueName>2</ValueName>
3614 <Value>[*.]example.edu</Value>
3615 </Entry>
3616 <Entry type="1" type_name="REG_SZ">
3617 <Key>Software\Policies\Google\Chrome\ForcedLanguages</Key>
3618 <ValueName>1</ValueName>
3619 <Value>en-US</Value>
3620 </Entry>
3621 <Entry type="1" type_name="REG_SZ">
3622 <Key>Software\Policies\Google\Chrome\HSTSPolicyBypassList</Key>
3623 <ValueName>1</ValueName>
3624 <Value>meet</Value>
3625 </Entry>
3626 <Entry type="1" type_name="REG_SZ">
3627 <Key>Software\Policies\Google\Chrome\ImagesAllowedForUrls</Key>
3628 <ValueName>1</ValueName>
3629 <Value>https://www.example.com</Value>
3630 </Entry>
3631 <Entry type="1" type_name="REG_SZ">
3632 <Key>Software\Policies\Google\Chrome\ImagesAllowedForUrls</Key>
3633 <ValueName>2</ValueName>
3634 <Value>[*.]example.edu</Value>
3635 </Entry>
3636 <Entry type="1" type_name="REG_SZ">
3637 <Key>Software\Policies\Google\Chrome\ImagesBlockedForUrls</Key>
3638 <ValueName>1</ValueName>
3639 <Value>https://www.example.com</Value>
3640 </Entry>
3641 <Entry type="1" type_name="REG_SZ">
3642 <Key>Software\Policies\Google\Chrome\ImagesBlockedForUrls</Key>
3643 <ValueName>2</ValueName>
3644 <Value>[*.]example.edu</Value>
3645 </Entry>
3646 <Entry type="1" type_name="REG_SZ">
3647 <Key>Software\Policies\Google\Chrome\InsecureContentAllowedForUrls</Key>
3648 <ValueName>1</ValueName>
3649 <Value>https://www.example.com</Value>
3650 </Entry>
3651 <Entry type="1" type_name="REG_SZ">
3652 <Key>Software\Policies\Google\Chrome\InsecureContentAllowedForUrls</Key>
3653 <ValueName>2</ValueName>
3654 <Value>[*.]example.edu</Value>
3655 </Entry>
3656 <Entry type="1" type_name="REG_SZ">
3657 <Key>Software\Policies\Google\Chrome\InsecureContentBlockedForUrls</Key>
3658 <ValueName>1</ValueName>
3659 <Value>https://www.example.com</Value>
3660 </Entry>
3661 <Entry type="1" type_name="REG_SZ">
3662 <Key>Software\Policies\Google\Chrome\InsecureContentBlockedForUrls</Key>
3663 <ValueName>2</ValueName>
3664 <Value>[*.]example.edu</Value>
3665 </Entry>
3666 <Entry type="1" type_name="REG_SZ">
3667 <Key>Software\Policies\Google\Chrome\InsecurePrivateNetworkRequestsAllowedForUrls</Key>
3668 <ValueName>1</ValueName>
3669 <Value>http://www.example.com:8080</Value>
3670 </Entry>
3671 <Entry type="1" type_name="REG_SZ">
3672 <Key>Software\Policies\Google\Chrome\InsecurePrivateNetworkRequestsAllowedForUrls</Key>
3673 <ValueName>2</ValueName>
3674 <Value>[*.]example.edu</Value>
3675 </Entry>
3676 <Entry type="1" type_name="REG_SZ">
3677 <Key>Software\Policies\Google\Chrome\JavaScriptAllowedForUrls</Key>
3678 <ValueName>1</ValueName>
3679 <Value>https://www.example.com</Value>
3680 </Entry>
3681 <Entry type="1" type_name="REG_SZ">
3682 <Key>Software\Policies\Google\Chrome\JavaScriptAllowedForUrls</Key>
3683 <ValueName>2</ValueName>
3684 <Value>[*.]example.edu</Value>
3685 </Entry>
3686 <Entry type="1" type_name="REG_SZ">
3687 <Key>Software\Policies\Google\Chrome\JavaScriptBlockedForUrls</Key>
3688 <ValueName>1</ValueName>
3689 <Value>https://www.example.com</Value>
3690 </Entry>
3691 <Entry type="1" type_name="REG_SZ">
3692 <Key>Software\Policies\Google\Chrome\JavaScriptBlockedForUrls</Key>
3693 <ValueName>2</ValueName>
3694 <Value>[*.]example.edu</Value>
3695 </Entry>
3696 <Entry type="1" type_name="REG_SZ">
3697 <Key>Software\Policies\Google\Chrome\LegacySameSiteCookieBehaviorEnabledForDomainList</Key>
3698 <ValueName>1</ValueName>
3699 <Value>www.example.com</Value>
3700 </Entry>
3701 <Entry type="1" type_name="REG_SZ">
3702 <Key>Software\Policies\Google\Chrome\LegacySameSiteCookieBehaviorEnabledForDomainList</Key>
3703 <ValueName>2</ValueName>
3704 <Value>[*.]example.edu</Value>
3705 </Entry>
3706 <Entry type="1" type_name="REG_SZ">
3707 <Key>Software\Policies\Google\Chrome\LookalikeWarningAllowlistDomains</Key>
3708 <ValueName>1</ValueName>
3709 <Value>foo.example.com</Value>
3710 </Entry>
3711 <Entry type="1" type_name="REG_SZ">
3712 <Key>Software\Policies\Google\Chrome\LookalikeWarningAllowlistDomains</Key>
3713 <ValueName>2</ValueName>
3714 <Value>example.org</Value>
3715 </Entry>
3716 <Entry type="1" type_name="REG_SZ">
3717 <Key>Software\Policies\Google\Chrome\NativeMessagingAllowlist</Key>
3718 <ValueName>1</ValueName>
3719 <Value>com.native.messaging.host.name1</Value>
3720 </Entry>
3721 <Entry type="1" type_name="REG_SZ">
3722 <Key>Software\Policies\Google\Chrome\NativeMessagingAllowlist</Key>
3723 <ValueName>2</ValueName>
3724 <Value>com.native.messaging.host.name2</Value>
3725 </Entry>
3726 <Entry type="1" type_name="REG_SZ">
3727 <Key>Software\Policies\Google\Chrome\NativeMessagingBlocklist</Key>
3728 <ValueName>1</ValueName>
3729 <Value>com.native.messaging.host.name1</Value>
3730 </Entry>
3731 <Entry type="1" type_name="REG_SZ">
3732 <Key>Software\Policies\Google\Chrome\NativeMessagingBlocklist</Key>
3733 <ValueName>2</ValueName>
3734 <Value>com.native.messaging.host.name2</Value>
3735 </Entry>
3736 <Entry type="1" type_name="REG_SZ">
3737 <Key>Software\Policies\Google\Chrome\NotificationsAllowedForUrls</Key>
3738 <ValueName>1</ValueName>
3739 <Value>https://www.example.com</Value>
3740 </Entry>
3741 <Entry type="1" type_name="REG_SZ">
3742 <Key>Software\Policies\Google\Chrome\NotificationsAllowedForUrls</Key>
3743 <ValueName>2</ValueName>
3744 <Value>[*.]example.edu</Value>
3745 </Entry>
3746 <Entry type="1" type_name="REG_SZ">
3747 <Key>Software\Policies\Google\Chrome\NotificationsBlockedForUrls</Key>
3748 <ValueName>1</ValueName>
3749 <Value>https://www.example.com</Value>
3750 </Entry>
3751 <Entry type="1" type_name="REG_SZ">
3752 <Key>Software\Policies\Google\Chrome\NotificationsBlockedForUrls</Key>
3753 <ValueName>2</ValueName>
3754 <Value>[*.]example.edu</Value>
3755 </Entry>
3756 <Entry type="1" type_name="REG_SZ">
3757 <Key>Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin</Key>
3758 <ValueName>1</ValueName>
3759 <Value>http://testserver.example.com/</Value>
3760 </Entry>
3761 <Entry type="1" type_name="REG_SZ">
3762 <Key>Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin</Key>
3763 <ValueName>2</ValueName>
3764 <Value>*.example.org</Value>
3765 </Entry>
3766 <Entry type="1" type_name="REG_SZ">
3767 <Key>Software\Policies\Google\Chrome\PasswordProtectionLoginURLs</Key>
3768 <ValueName>1</ValueName>
3769 <Value>https://mydomain.com/login.html</Value>
3770 </Entry>
3771 <Entry type="1" type_name="REG_SZ">
3772 <Key>Software\Policies\Google\Chrome\PasswordProtectionLoginURLs</Key>
3773 <ValueName>2</ValueName>
3774 <Value>https://login.mydomain.com</Value>
3775 </Entry>
3776 <Entry type="1" type_name="REG_SZ">
3777 <Key>Software\Policies\Google\Chrome\PolicyDictionaryMultipleSourceMergeList</Key>
3778 <ValueName>1</ValueName>
3779 <Value>ExtensionSettings</Value>
3780 </Entry>
3781 <Entry type="1" type_name="REG_SZ">
3782 <Key>Software\Policies\Google\Chrome\PolicyListMultipleSourceMergeList</Key>
3783 <ValueName>1</ValueName>
3784 <Value>ExtensionInstallAllowlist</Value>
3785 </Entry>
3786 <Entry type="1" type_name="REG_SZ">
3787 <Key>Software\Policies\Google\Chrome\PolicyListMultipleSourceMergeList</Key>
3788 <ValueName>2</ValueName>
3789 <Value>ExtensionInstallBlocklist</Value>
3790 </Entry>
3791 <Entry type="1" type_name="REG_SZ">
3792 <Key>Software\Policies\Google\Chrome\PopupsAllowedForUrls</Key>
3793 <ValueName>1</ValueName>
3794 <Value>https://www.example.com</Value>
3795 </Entry>
3796 <Entry type="1" type_name="REG_SZ">
3797 <Key>Software\Policies\Google\Chrome\PopupsAllowedForUrls</Key>
3798 <ValueName>2</ValueName>
3799 <Value>[*.]example.edu</Value>
3800 </Entry>
3801 <Entry type="1" type_name="REG_SZ">
3802 <Key>Software\Policies\Google\Chrome\PopupsBlockedForUrls</Key>
3803 <ValueName>1</ValueName>
3804 <Value>https://www.example.com</Value>
3805 </Entry>
3806 <Entry type="1" type_name="REG_SZ">
3807 <Key>Software\Policies\Google\Chrome\PopupsBlockedForUrls</Key>
3808 <ValueName>2</ValueName>
3809 <Value>[*.]example.edu</Value>
3810 </Entry>
3811 <Entry type="1" type_name="REG_SZ">
3812 <Key>Software\Policies\Google\Chrome\PrinterTypeDenyList</Key>
3813 <ValueName>1</ValueName>
3814 <Value>cloud</Value>
3815 </Entry>
3816 <Entry type="1" type_name="REG_SZ">
3817 <Key>Software\Policies\Google\Chrome\PrinterTypeDenyList</Key>
3818 <ValueName>2</ValueName>
3819 <Value>privet</Value>
3820 </Entry>
3821 <Entry type="1" type_name="REG_SZ">
3822 <Key>Software\Policies\Google\Chrome\RemoteAccessHostClientDomainList</Key>
3823 <ValueName>1</ValueName>
3824 <Value>my-awesome-domain.com</Value>
3825 </Entry>
3826 <Entry type="1" type_name="REG_SZ">
3827 <Key>Software\Policies\Google\Chrome\RemoteAccessHostClientDomainList</Key>
3828 <ValueName>2</ValueName>
3829 <Value>my-auxiliary-domain.com</Value>
3830 </Entry>
3831 <Entry type="1" type_name="REG_SZ">
3832 <Key>Software\Policies\Google\Chrome\RemoteAccessHostDomainList</Key>
3833 <ValueName>1</ValueName>
3834 <Value>my-awesome-domain.com</Value>
3835 </Entry>
3836 <Entry type="1" type_name="REG_SZ">
3837 <Key>Software\Policies\Google\Chrome\RemoteAccessHostDomainList</Key>
3838 <ValueName>2</ValueName>
3839 <Value>my-auxiliary-domain.com</Value>
3840 </Entry>
3841 <Entry type="1" type_name="REG_SZ">
3842 <Key>Software\Policies\Google\Chrome\RestoreOnStartupURLs</Key>
3843 <ValueName>1</ValueName>
3844 <Value>https://example.com</Value>
3845 </Entry>
3846 <Entry type="1" type_name="REG_SZ">
3847 <Key>Software\Policies\Google\Chrome\RestoreOnStartupURLs</Key>
3848 <ValueName>2</ValueName>
3849 <Value>https://www.chromium.org</Value>
3850 </Entry>
3851 <Entry type="1" type_name="REG_SZ">
3852 <Key>Software\Policies\Google\Chrome\SSLErrorOverrideAllowedForOrigins</Key>
3853 <ValueName>1</ValueName>
3854 <Value>https://www.example.com</Value>
3855 </Entry>
3856 <Entry type="1" type_name="REG_SZ">
3857 <Key>Software\Policies\Google\Chrome\SSLErrorOverrideAllowedForOrigins</Key>
3858 <ValueName>2</ValueName>
3859 <Value>[*.]example.edu</Value>
3860 </Entry>
3861 <Entry type="1" type_name="REG_SZ">
3862 <Key>Software\Policies\Google\Chrome\SafeBrowsingAllowlistDomains</Key>
3863 <ValueName>1</ValueName>
3864 <Value>mydomain.com</Value>
3865 </Entry>
3866 <Entry type="1" type_name="REG_SZ">
3867 <Key>Software\Policies\Google\Chrome\SafeBrowsingAllowlistDomains</Key>
3868 <ValueName>2</ValueName>
3869 <Value>myuniversity.edu</Value>
3870 </Entry>
3871 <Entry type="1" type_name="REG_SZ">
3872 <Key>Software\Policies\Google\Chrome\SecurityKeyPermitAttestation</Key>
3873 <ValueName>1</ValueName>
3874 <Value>https://example.com</Value>
3875 </Entry>
3876 <Entry type="1" type_name="REG_SZ">
3877 <Key>Software\Policies\Google\Chrome\SensorsAllowedForUrls</Key>
3878 <ValueName>1</ValueName>
3879 <Value>https://www.example.com</Value>
3880 </Entry>
3881 <Entry type="1" type_name="REG_SZ">
3882 <Key>Software\Policies\Google\Chrome\SensorsAllowedForUrls</Key>
3883 <ValueName>2</ValueName>
3884 <Value>[*.]example.edu</Value>
3885 </Entry>
3886 <Entry type="1" type_name="REG_SZ">
3887 <Key>Software\Policies\Google\Chrome\SensorsBlockedForUrls</Key>
3888 <ValueName>1</ValueName>
3889 <Value>https://www.example.com</Value>
3890 </Entry>
3891 <Entry type="1" type_name="REG_SZ">
3892 <Key>Software\Policies\Google\Chrome\SensorsBlockedForUrls</Key>
3893 <ValueName>2</ValueName>
3894 <Value>[*.]example.edu</Value>
3895 </Entry>
3896 <Entry type="1" type_name="REG_SZ">
3897 <Key>Software\Policies\Google\Chrome\SerialAskForUrls</Key>
3898 <ValueName>1</ValueName>
3899 <Value>https://www.example.com</Value>
3900 </Entry>
3901 <Entry type="1" type_name="REG_SZ">
3902 <Key>Software\Policies\Google\Chrome\SerialAskForUrls</Key>
3903 <ValueName>2</ValueName>
3904 <Value>[*.]example.edu</Value>
3905 </Entry>
3906 <Entry type="1" type_name="REG_SZ">
3907 <Key>Software\Policies\Google\Chrome\SerialBlockedForUrls</Key>
3908 <ValueName>1</ValueName>
3909 <Value>https://www.example.com</Value>
3910 </Entry>
3911 <Entry type="1" type_name="REG_SZ">
3912 <Key>Software\Policies\Google\Chrome\SerialBlockedForUrls</Key>
3913 <ValueName>2</ValueName>
3914 <Value>[*.]example.edu</Value>
3915 </Entry>
3916 <Entry type="1" type_name="REG_SZ">
3917 <Key>Software\Policies\Google\Chrome\SpellcheckLanguage</Key>
3918 <ValueName>1</ValueName>
3919 <Value>fr</Value>
3920 </Entry>
3921 <Entry type="1" type_name="REG_SZ">
3922 <Key>Software\Policies\Google\Chrome\SpellcheckLanguage</Key>
3923 <ValueName>2</ValueName>
3924 <Value>es</Value>
3925 </Entry>
3926 <Entry type="1" type_name="REG_SZ">
3927 <Key>Software\Policies\Google\Chrome\SpellcheckLanguageBlocklist</Key>
3928 <ValueName>1</ValueName>
3929 <Value>fr</Value>
3930 </Entry>
3931 <Entry type="1" type_name="REG_SZ">
3932 <Key>Software\Policies\Google\Chrome\SpellcheckLanguageBlocklist</Key>
3933 <ValueName>2</ValueName>
3934 <Value>es</Value>
3935 </Entry>
3936 <Entry type="1" type_name="REG_SZ">
3937 <Key>Software\Policies\Google\Chrome\SyncTypesListDisabled</Key>
3938 <ValueName>1</ValueName>
3939 <Value>bookmarks</Value>
3940 </Entry>
3941 <Entry type="1" type_name="REG_SZ">
3942 <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3943 <ValueName>1</ValueName>
3944 <Value>example.com</Value>
3945 </Entry>
3946 <Entry type="1" type_name="REG_SZ">
3947 <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3948 <ValueName>2</ValueName>
3949 <Value>https://ssl.server.com</Value>
3950 </Entry>
3951 <Entry type="1" type_name="REG_SZ">
3952 <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3953 <ValueName>3</ValueName>
3954 <Value>hosting.com/good_path</Value>
3955 </Entry>
3956 <Entry type="1" type_name="REG_SZ">
3957 <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3958 <ValueName>4</ValueName>
3959 <Value>https://server:8080/path</Value>
3960 </Entry>
3961 <Entry type="1" type_name="REG_SZ">
3962 <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3963 <ValueName>5</ValueName>
3964 <Value>.exact.hostname.com</Value>
3965 </Entry>
3966 <Entry type="1" type_name="REG_SZ">
3967 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3968 <ValueName>1</ValueName>
3969 <Value>example.com</Value>
3970 </Entry>
3971 <Entry type="1" type_name="REG_SZ">
3972 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3973 <ValueName>2</ValueName>
3974 <Value>https://ssl.server.com</Value>
3975 </Entry>
3976 <Entry type="1" type_name="REG_SZ">
3977 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3978 <ValueName>3</ValueName>
3979 <Value>hosting.com/bad_path</Value>
3980 </Entry>
3981 <Entry type="1" type_name="REG_SZ">
3982 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3983 <ValueName>4</ValueName>
3984 <Value>https://server:8080/path</Value>
3985 </Entry>
3986 <Entry type="1" type_name="REG_SZ">
3987 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3988 <ValueName>5</ValueName>
3989 <Value>.exact.hostname.com</Value>
3990 </Entry>
3991 <Entry type="1" type_name="REG_SZ">
3992 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3993 <ValueName>6</ValueName>
3994 <Value>file://*</Value>
3995 </Entry>
3996 <Entry type="1" type_name="REG_SZ">
3997 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3998 <ValueName>7</ValueName>
3999 <Value>custom_scheme:*</Value>
4000 </Entry>
4001 <Entry type="1" type_name="REG_SZ">
4002 <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
4003 <ValueName>8</ValueName>
4004 <Value>*</Value>
4005 </Entry>
4006 <Entry type="1" type_name="REG_SZ">
4007 <Key>Software\Policies\Google\Chrome\VideoCaptureAllowedUrls</Key>
4008 <ValueName>1</ValueName>
4009 <Value>https://www.example.com/</Value>
4010 </Entry>
4011 <Entry type="1" type_name="REG_SZ">
4012 <Key>Software\Policies\Google\Chrome\VideoCaptureAllowedUrls</Key>
4013 <ValueName>2</ValueName>
4014 <Value>https://[*.]example.edu/</Value>
4015 </Entry>
4016 <Entry type="1" type_name="REG_SZ">
4017 <Key>Software\Policies\Google\Chrome\WebRtcLocalIpsAllowedUrls</Key>
4018 <ValueName>1</ValueName>
4019 <Value>https://www.example.com</Value>
4020 </Entry>
4021 <Entry type="1" type_name="REG_SZ">
4022 <Key>Software\Policies\Google\Chrome\WebRtcLocalIpsAllowedUrls</Key>
4023 <ValueName>2</ValueName>
4024 <Value>*example.com*</Value>
4025 </Entry>
4026 <Entry type="1" type_name="REG_SZ">
4027 <Key>Software\Policies\Google\Chrome\WebUsbAskForUrls</Key>
4028 <ValueName>1</ValueName>
4029 <Value>https://www.example.com</Value>
4030 </Entry>
4031 <Entry type="1" type_name="REG_SZ">
4032 <Key>Software\Policies\Google\Chrome\WebUsbAskForUrls</Key>
4033 <ValueName>2</ValueName>
4034 <Value>[*.]example.edu</Value>
4035 </Entry>
4036 <Entry type="1" type_name="REG_SZ">
4037 <Key>Software\Policies\Google\Chrome\WebUsbBlockedForUrls</Key>
4038 <ValueName>1</ValueName>
4039 <Value>https://www.example.com</Value>
4040 </Entry>
4041 <Entry type="1" type_name="REG_SZ">
4042 <Key>Software\Policies\Google\Chrome\WebUsbBlockedForUrls</Key>
4043 <ValueName>2</ValueName>
4044 <Value>[*.]example.edu</Value>
4045 </Entry>
4046 <Entry type="4" type_name="REG_DWORD">
4047 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4048 <ValueName>AlternateErrorPagesEnabled</ValueName>
4049 <Value>1</Value>
4050 </Entry>
4051 <Entry type="1" type_name="REG_SZ">
4052 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4053 <ValueName>ApplicationLocaleValue</ValueName>
4054 <Value>en</Value>
4055 </Entry>
4056 <Entry type="4" type_name="REG_DWORD">
4057 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4058 <ValueName>AutofillAddressEnabled</ValueName>
4059 <Value>0</Value>
4060 </Entry>
4061 <Entry type="4" type_name="REG_DWORD">
4062 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4063 <ValueName>AutofillCreditCardEnabled</ValueName>
4064 <Value>0</Value>
4065 </Entry>
4066 <Entry type="4" type_name="REG_DWORD">
4067 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4068 <ValueName>BackgroundModeEnabled</ValueName>
4069 <Value>1</Value>
4070 </Entry>
4071 <Entry type="4" type_name="REG_DWORD">
4072 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4073 <ValueName>BlockThirdPartyCookies</ValueName>
4074 <Value>0</Value>
4075 </Entry>
4076 <Entry type="4" type_name="REG_DWORD">
4077 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4078 <ValueName>BookmarkBarEnabled</ValueName>
4079 <Value>1</Value>
4080 </Entry>
4081 <Entry type="1" type_name="REG_SZ">
4082 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4083 <ValueName>DefaultDownloadDirectory</ValueName>
4084 <Value>/home/${user_name}/Downloads</Value>
4085 </Entry>
4086 <Entry type="1" type_name="REG_SZ">
4087 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4088 <ValueName>DownloadDirectory</ValueName>
4089 <Value>/home/${user_name}/Downloads</Value>
4090 </Entry>
4091 <Entry type="4" type_name="REG_DWORD">
4092 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4093 <ValueName>DownloadRestrictions</ValueName>
4094 <Value>2</Value>
4095 </Entry>
4096 <Entry type="4" type_name="REG_DWORD">
4097 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4098 <ValueName>HomepageIsNewTabPage</ValueName>
4099 <Value>1</Value>
4100 </Entry>
4101 <Entry type="1" type_name="REG_SZ">
4102 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4103 <ValueName>HomepageLocation</ValueName>
4104 <Value>https://www.chromium.org</Value>
4105 </Entry>
4106 <Entry type="4" type_name="REG_DWORD">
4107 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4108 <ValueName>ImportAutofillFormData</ValueName>
4109 <Value>1</Value>
4110 </Entry>
4111 <Entry type="4" type_name="REG_DWORD">
4112 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4113 <ValueName>ImportBookmarks</ValueName>
4114 <Value>1</Value>
4115 </Entry>
4116 <Entry type="4" type_name="REG_DWORD">
4117 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4118 <ValueName>ImportHistory</ValueName>
4119 <Value>1</Value>
4120 </Entry>
4121 <Entry type="4" type_name="REG_DWORD">
4122 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4123 <ValueName>ImportSavedPasswords</ValueName>
4124 <Value>1</Value>
4125 </Entry>
4126 <Entry type="4" type_name="REG_DWORD">
4127 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4128 <ValueName>ImportSearchEngine</ValueName>
4129 <Value>1</Value>
4130 </Entry>
4131 <Entry type="4" type_name="REG_DWORD">
4132 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4133 <ValueName>MetricsReportingEnabled</ValueName>
4134 <Value>1</Value>
4135 </Entry>
4136 <Entry type="4" type_name="REG_DWORD">
4137 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4138 <ValueName>NetworkPredictionOptions</ValueName>
4139 <Value>1</Value>
4140 </Entry>
4141 <Entry type="4" type_name="REG_DWORD">
4142 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4143 <ValueName>PasswordLeakDetectionEnabled</ValueName>
4144 <Value>1</Value>
4145 </Entry>
4146 <Entry type="4" type_name="REG_DWORD">
4147 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4148 <ValueName>PasswordManagerEnabled</ValueName>
4149 <Value>1</Value>
4150 </Entry>
4151 <Entry type="4" type_name="REG_DWORD">
4152 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4153 <ValueName>PrintHeaderFooter</ValueName>
4154 <Value>0</Value>
4155 </Entry>
4156 <Entry type="4" type_name="REG_DWORD">
4157 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4158 <ValueName>PrintPreviewUseSystemDefaultPrinter</ValueName>
4159 <Value>0</Value>
4160 </Entry>
4161 <Entry type="1" type_name="REG_SZ">
4162 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4163 <ValueName>RegisteredProtocolHandlers</ValueName>
4164 <Value>[{&quot;default&quot;: true, &quot;protocol&quot;: &quot;mailto&quot;, &quot;url&quot;: &quot;https://mail.google.com/mail/?extsrc=mailto&amp;url=%s&quot;}]</Value>
4165 </Entry>
4166 <Entry type="4" type_name="REG_DWORD">
4167 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4168 <ValueName>RestoreOnStartup</ValueName>
4169 <Value>4</Value>
4170 </Entry>
4171 <Entry type="4" type_name="REG_DWORD">
4172 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4173 <ValueName>SafeBrowsingForTrustedSourcesEnabled</ValueName>
4174 <Value>0</Value>
4175 </Entry>
4176 <Entry type="4" type_name="REG_DWORD">
4177 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4178 <ValueName>SafeBrowsingProtectionLevel</ValueName>
4179 <Value>2</Value>
4180 </Entry>
4181 <Entry type="4" type_name="REG_DWORD">
4182 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4183 <ValueName>SearchSuggestEnabled</ValueName>
4184 <Value>1</Value>
4185 </Entry>
4186 <Entry type="4" type_name="REG_DWORD">
4187 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4188 <ValueName>ShowFullUrlsInAddressBar</ValueName>
4189 <Value>0</Value>
4190 </Entry>
4191 <Entry type="4" type_name="REG_DWORD">
4192 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4193 <ValueName>ShowHomeButton</ValueName>
4194 <Value>1</Value>
4195 </Entry>
4196 <Entry type="4" type_name="REG_DWORD">
4197 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4198 <ValueName>SpellCheckServiceEnabled</ValueName>
4199 <Value>0</Value>
4200 </Entry>
4201 <Entry type="4" type_name="REG_DWORD">
4202 <Key>Software\Policies\Google\Chrome\Recommended</Key>
4203 <ValueName>TranslateEnabled</ValueName>
4204 <Value>1</Value>
4205 </Entry>
4206 <Entry type="1" type_name="REG_SZ">
4207 <Key>Software\Policies\Google\Chrome\Recommended\RestoreOnStartupURLs</Key>
4208 <ValueName>1</ValueName>
4209 <Value>https://example.com</Value>
4210 </Entry>
4211 <Entry type="1" type_name="REG_SZ">
4212 <Key>Software\Policies\Google\Chrome\Recommended\RestoreOnStartupURLs</Key>
4213 <ValueName>2</ValueName>
4214 <Value>https://www.chromium.org</Value>
4215 </Entry>
4216 </PolFile>
4217 """
4218
4219 chromium_json_expected_managed = \
4220 b"""
4221 {
4222 "FileSystemWriteAskForUrls": [
4223 "https://www.example.com",
4224 "[*.]example.edu"
4225 ],
4226 "InsecureContentBlockedForUrls": [
4227 "https://www.example.com",
4228 "[*.]example.edu"
4229 ],
4230 "DefaultSearchProviderImageURLPostParams": "content={imageThumbnail},url={imageURL},sbisrc={SearchSource}",
4231 "BrowserAddPersonEnabled": true,
4232 "DefaultSearchProviderImageURL": "https://search.my.company/searchbyimage/upload",
4233 "ShowHomeButton": true,
4234 "ClearBrowsingDataOnExitList": [
4235 "browsing_history",
4236 "download_history",
4237 "cookies_and_other_site_data",
4238 "cached_images_and_files",
4239 "password_signin",
4240 "autofill",
4241 "site_settings",
4242 "hosted_app_data"
4243 ],
4244 "JavaScriptAllowedForUrls": [
4245 "https://www.example.com",
4246 "[*.]example.edu"
4247 ],
4248 "AmbientAuthenticationInPrivateModesEnabled": 0,
4249 "AllowFileSelectionDialogs": true,
4250 "PrintingAllowedBackgroundGraphicsModes": "enabled",
4251 "DnsOverHttpsTemplates": "https://dns.example.net/dns-query{?dns}",
4252 "ComponentUpdatesEnabled": true,
4253 "RemoteAccessHostAllowRemoteAccessConnections": false,
4254 "WindowOcclusionEnabled": true,
4255 "PrintPreviewUseSystemDefaultPrinter": false,
4256 "AutoLaunchProtocolsFromOrigins": [
4257 {
4258 "allowed_origins": [
4259 "example.com",
4260 "http://www.example.com:8080"
4261 ],
4262 "protocol": "spotify"
4263 },
4264 {
4265 "allowed_origins": [
4266 "https://example.com",
4267 "https://.mail.example.com"
4268 ],
4269 "protocol": "teams"
4270 },
4271 {
4272 "allowed_origins": [
4273 "*"
4274 ],
4275 "protocol": "outlook"
4276 }
4277 ],
4278 "ManagedConfigurationPerOrigin": [
4279 {
4280 "origin": "https://www.google.com",
4281 "managed_configuration_hash": "asd891jedasd12ue9h",
4282 "managed_configuration_url": "https://gstatic.google.com/configuration.json"
4283 },
4284 {
4285 "origin": "https://www.example.com",
4286 "managed_configuration_hash": "djio12easd89u12aws",
4287 "managed_configuration_url": "https://gstatic.google.com/configuration2.json"
4288 }
4289 ],
4290 "SyncTypesListDisabled": [
4291 "bookmarks"
4292 ],
4293 "SecurityKeyPermitAttestation": [
4294 "https://example.com"
4295 ],
4296 "DefaultSearchProviderSearchURL": "https://search.my.company/search?q={searchTerms}",
4297 "MetricsReportingEnabled": true,
4298 "MaxInvalidationFetchDelay": 10000,
4299 "AudioProcessHighPriorityEnabled": true,
4300 "ExtensionInstallForcelist": [
4301 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx",
4302 "abcdefghijklmnopabcdefghijklmnop"
4303 ],
4304 "ExternalProtocolDialogShowAlwaysOpenCheckbox": true,
4305 "CookiesBlockedForUrls": [
4306 "https://www.example.com",
4307 "[*.]example.edu"
4308 ],
4309 "BrowserSwitcherExternalSitelistUrl": "http://example.com/sitelist.xml",
4310 "AudioCaptureAllowedUrls": [
4311 "https://www.example.com/",
4312 "https://[*.]example.edu/"
4313 ],
4314 "NTPCustomBackgroundEnabled": true,
4315 "BlockExternalExtensions": true,
4316 "BrowserSwitcherChromeParameters": [
4317 "--force-dark-mode"
4318 ],
4319 "SafeSitesFilterBehavior": 0,
4320 "EnableOnlineRevocationChecks": false,
4321 "ImagesBlockedForUrls": [
4322 "https://www.example.com",
4323 "[*.]example.edu"
4324 ],
4325 "InsecureFormsWarningsEnabled": true,
4326 "RelaunchNotificationPeriod": 604800000,
4327 "TotalMemoryLimitMb": 2048,
4328 "CloudManagementEnrollmentMandatory": true,
4329 "ClickToCallEnabled": true,
4330 "AppCacheForceEnabled": false,
4331 "UrlKeyedAnonymizedDataCollectionEnabled": true,
4332 "FullscreenAllowed": true,
4333 "AuthSchemes": "basic,digest,ntlm,negotiate",
4334 "PasswordLeakDetectionEnabled": true,
4335 "AuthServerAllowlist": "*.example.com,example.com",
4336 "AllowSyncXHRInPageDismissal": false,
4337 "PasswordProtectionChangePasswordURL": "https://mydomain.com/change_password.html",
4338 "MaxConnectionsPerProxy": 32,
4339 "RemoteAccessHostMaximumSessionDurationMinutes": 1200,
4340 "RemoteAccessHostAllowFileTransfer": false,
4341 "PrintRasterizationMode": 1,
4342 "CertificateTransparencyEnforcementDisabledForLegacyCas": [
4343 "sha256/AAAAAAAAAAAAAAAAAAAAAA==",
4344 "sha256//////////////////////w=="
4345 ],
4346 "DefaultWebBluetoothGuardSetting": 2,
4347 "AutoplayAllowed": true,
4348 "BrowserSwitcherUrlList": [
4349 "ie.com",
4350 "!open-in-chrome.ie.com",
4351 "foobar.com/ie-only/"
4352 ],
4353 "CertificateTransparencyEnforcementDisabledForUrls": [
4354 "example.com",
4355 ".example.com"
4356 ],
4357 "SpellcheckLanguageBlocklist": [
4358 "fr",
4359 "es"
4360 ],
4361 "PrintHeaderFooter": false,
4362 "ShowAppsShortcutInBookmarkBar": false,
4363 "SerialAskForUrls": [
4364 "https://www.example.com",
4365 "[*.]example.edu"
4366 ],
4367 "ImagesAllowedForUrls": [
4368 "https://www.example.com",
4369 "[*.]example.edu"
4370 ],
4371 "ProfilePickerOnStartupAvailability": 0,
4372 "CommandLineFlagSecurityWarningsEnabled": true,
4373 "QuicAllowed": true,
4374 "IntensiveWakeUpThrottlingEnabled": true,
4375 "WPADQuickCheckEnabled": true,
4376 "SensorsAllowedForUrls": [
4377 "https://www.example.com",
4378 "[*.]example.edu"
4379 ],
4380 "NTPCardsVisible": true,
4381 "DefaultSearchProviderAlternateURLs": [
4382 "https://search.my.company/suggest#q={searchTerms}",
4383 "https://search.my.company/suggest/search#q={searchTerms}"
4384 ],
4385 "DisableSafeBrowsingProceedAnyway": true,
4386 "DefaultFileSystemWriteGuardSetting": 2,
4387 "DefaultSearchProviderSuggestURL": "https://search.my.company/suggest?q={searchTerms}",
4388 "SSLErrorOverrideAllowed": true,
4389 "CloudPrintProxyEnabled": true,
4390 "BrowserSwitcherUrlGreylist": [
4391 "ie.com",
4392 "!open-in-chrome.ie.com",
4393 "foobar.com/ie-only/"
4394 ],
4395 "BrowserNetworkTimeQueriesEnabled": true,
4396 "WebUsbAllowDevicesForUrls": [
4397 {
4398 "urls": [
4399 "https://google.com"
4400 ],
4401 "devices": [
4402 {
4403 "vendor_id": 1234,
4404 "product_id": 5678
4405 }
4406 ]
4407 }
4408 ],
4409 "TaskManagerEndProcessEnabled": true,
4410 "SuppressDifferentOriginSubframeDialogs": true,
4411 "UserDataDir": "${users}/${user_name}/Chrome",
4412 "CookiesAllowedForUrls": [
4413 "https://www.example.com",
4414 "[*.]example.edu"
4415 ],
4416 "SuppressUnsupportedOSWarning": true,
4417 "RequireOnlineRevocationChecksForLocalAnchors": false,
4418 "BrowsingDataLifetime": [
4419 {
4420 "data_types": [
4421 "browsing_history"
4422 ],
4423 "time_to_live_in_hours": 24
4424 },
4425 {
4426 "data_types": [
4427 "password_signin",
4428 "autofill"
4429 ],
4430 "time_to_live_in_hours": 12
4431 }
4432 ],
4433 "FileHandlingBlockedForUrls": [
4434 "https://www.example.com",
4435 "[*.]example.edu"
4436 ],
4437 "AudioCaptureAllowed": false,
4438 "PromotionalTabsEnabled": false,
4439 "ShowFullUrlsInAddressBar": false,
4440 "EnableMediaRouter": true,
4441 "BrowserSwitcherDelay": 10000,
4442 "AllowDinosaurEasterEgg": false,
4443 "ImportSearchEngine": true,
4444 "PrintingBackgroundGraphicsDefault": "enabled",
4445 "TripleDESEnabled": false,
4446 "AutoplayAllowlist": [
4447 "https://www.example.com",
4448 "[*.]example.edu"
4449 ],
4450 "RemoteAccessHostUdpPortRange": "12400-12409",
4451 "DefaultSearchProviderIconURL": "https://search.my.company/favicon.ico",
4452 "BrowserSwitcherChromePath": "${chrome}",
4453 "InsecureContentAllowedForUrls": [
4454 "https://www.example.com",
4455 "[*.]example.edu"
4456 ],
4457 "DefaultSearchProviderSearchURLPostParams": "q={searchTerms},ie=utf-8,oe=utf-8",
4458 "ForceGoogleSafeSearch": false,
4459 "UserFeedbackAllowed": true,
4460 "ForceYouTubeRestrict": 0,
4461 "ApplicationLocaleValue": "en",
4462 "RoamingProfileSupportEnabled": true,
4463 "AlternativeBrowserPath": "${ie}",
4464 "AlternativeBrowserParameters": [
4465 "-foreground",
4466 "-new-window",
4467 "${url}",
4468 "-profile",
4469 "%HOME%\\\\browser_profile"
4470 ],
4471 "AdvancedProtectionAllowed": true,
4472 "EditBookmarksEnabled": false,
4473 "DefaultPrinterSelection": "{ \\"kind\\": \\"cloud\\", \\"idPattern\\": \\".*public\\", \\"namePattern\\": \\".*Color\\" }",
4474 "SSLVersionMin": "tls1",
4475 "SharedArrayBufferUnrestrictedAccessAllowed": true,
4476 "DefaultSerialGuardSetting": 2,
4477 "DefaultPopupsSetting": 1,
4478 "IntranetRedirectBehavior": 1,
4479 "RendererCodeIntegrityEnabled": false,
4480 "BrowserGuestModeEnforced": true,
4481 "HSTSPolicyBypassList": [
4482 "meet"
4483 ],
4484 "DefaultWebUsbGuardSetting": 2,
4485 "CECPQ2Enabled": true,
4486 "RemoteAccessHostDomainList": [
4487 "my-awesome-domain.com",
4488 "my-auxiliary-domain.com"
4489 ],
4490 "URLBlocklist": [
4491 "example.com",
4492 "https://ssl.server.com",
4493 "hosting.com/bad_path",
4494 "https://server:8080/path",
4495 ".exact.hostname.com",
4496 "file://*",
4497 "custom_scheme:*",
4498 "*"
4499 ],
4500 "IsolateOrigins": "https://example.com/,https://othersite.org/",
4501 "ExtensionAllowedTypes": [
4502 "hosted_app"
4503 ],
4504 "NativeMessagingBlocklist": [
4505 "com.native.messaging.host.name1",
4506 "com.native.messaging.host.name2"
4507 ],
4508 "ExtensionSettings": {
4509 "abcdefghijklmnopabcdefghijklmnop": {
4510 "blocked_permissions": [
4511 "history"
4512 ],
4513 "minimum_version_required": "1.0.1",
4514 "toolbar_pin": "force_pinned",
4515 "installation_mode": "allowed"
4516 },
4517 "bcdefghijklmnopabcdefghijklmnopa": {
4518 "runtime_blocked_hosts": [
4519 "*://*.example.com"
4520 ],
4521 "allowed_permissions": [
4522 "downloads"
4523 ],
4524 "update_url": "https://example.com/update_url",
4525 "runtime_allowed_hosts": [
4526 "*://good.example.com"
4527 ],
4528 "installation_mode": "force_installed"
4529 },
4530 "update_url:https://www.example.com/update.xml": {
4531 "allowed_permissions": [
4532 "downloads"
4533 ],
4534 "blocked_permissions": [
4535 "wallpaper"
4536 ],
4537 "installation_mode": "allowed"
4538 },
4539 "cdefghijklmnopabcdefghijklmnopab": {
4540 "blocked_install_message": "Custom error message.",
4541 "installation_mode": "blocked"
4542 },
4543 "*": {
4544 "blocked_permissions": [
4545 "downloads",
4546 "bookmarks"
4547 ],
4548 "installation_mode": "blocked",
4549 "runtime_blocked_hosts": [
4550 "*://*.example.com"
4551 ],
4552 "blocked_install_message": "Custom error message.",
4553 "allowed_types": [
4554 "hosted_app"
4555 ],
4556 "runtime_allowed_hosts": [
4557 "*://good.example.com"
4558 ],
4559 "install_sources": [
4560 "https://company-intranet/chromeapps"
4561 ]
4562 },
4563 "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {
4564 "blocked_install_message": "Custom error message.",
4565 "installation_mode": "blocked"
4566 },
4567 "fghijklmnopabcdefghijklmnopabcde": {
4568 "blocked_install_message": "Custom removal message.",
4569 "installation_mode": "removed"
4570 },
4571 "ghijklmnopabcdefghijklmnopabcdef": {
4572 "update_url": "https://example.com/update_url",
4573 "override_update_url": true,
4574 "installation_mode": "force_installed"
4575 }
4576 },
4577 "FileSystemReadAskForUrls": [
4578 "https://www.example.com",
4579 "[*.]example.edu"
4580 ],
4581 "SpellCheckServiceEnabled": false,
4582 "ExtensionInstallSources": [
4583 "https://corp.mycompany.com/*"
4584 ],
4585 "PrinterTypeDenyList": [
4586 "cloud",
4587 "privet"
4588 ],
4589 "SharedClipboardEnabled": true,
4590 "BlockThirdPartyCookies": false,
4591 "MediaRouterCastAllowAllIPs": false,
4592 "DnsOverHttpsMode": "off",
4593 "SyncDisabled": true,
4594 "LookalikeWarningAllowlistDomains": [
4595 "foo.example.com",
4596 "example.org"
4597 ],
4598 "UserDataSnapshotRetentionLimit": 3,
4599 "SafeBrowsingProtectionLevel": 2,
4600 "ScrollToTextFragmentEnabled": false,
4601 "ImportBookmarks": true,
4602 "DefaultBrowserSettingEnabled": true,
4603 "DefaultSearchProviderEnabled": true,
4604 "AdditionalDnsQueryTypesEnabled": true,
4605 "PolicyRefreshRate": 3600000,
4606 "PrintingPaperSizeDefault": {
4607 "custom_size": {
4608 "width": 210000,
4609 "height": 297000
4610 },
4611 "name": "custom"
4612 },
4613 "RestoreOnStartup": 4,
4614 "PasswordProtectionWarningTrigger": 1,
4615 "ChromeCleanupEnabled": true,
4616 "AbusiveExperienceInterventionEnforce": true,
4617 "BasicAuthOverHttpEnabled": false,
4618 "EnableAuthNegotiatePort": false,
4619 "DefaultGeolocationSetting": 1,
4620 "PolicyDictionaryMultipleSourceMergeList": [
4621 "ExtensionSettings"
4622 ],
4623 "AllowedDomainsForApps": "managedchrome.com,example.com",
4624 "DisableAuthNegotiateCnameLookup": false,
4625 "IncognitoModeAvailability": 1,
4626 "ChromeVariations": 1,
4627 "DefaultSearchProviderNewTabURL": "https://search.my.company/newtab",
4628 "SavingBrowserHistoryDisabled": true,
4629 "SpellcheckEnabled": false,
4630 "FileSystemWriteBlockedForUrls": [
4631 "https://www.example.com",
4632 "[*.]example.edu"
4633 ],
4634 "BuiltInDnsClientEnabled": true,
4635 "SSLErrorOverrideAllowedForOrigins": [
4636 "https://www.example.com",
4637 "[*.]example.edu"
4638 ],
4639 "WebRtcIPHandling": "default",
4640 "DefaultNotificationsSetting": 2,
4641 "PopupsAllowedForUrls": [
4642 "https://www.example.com",
4643 "[*.]example.edu"
4644 ],
4645 "TranslateEnabled": true,
4646 "DefaultSearchProviderEncodings": [
4647 "UTF-8",
4648 "UTF-16",
4649 "GB2312",
4650 "ISO-8859-1"
4651 ],
4652 "DownloadRestrictions": 2,
4653 "PromptForDownloadLocation": false,
4654 "DisablePrintPreview": false,
4655 "NetworkPredictionOptions": 1,
4656 "FileSystemReadBlockedForUrls": [
4657 "https://www.example.com",
4658 "[*.]example.edu"
4659 ],
4660 "AutoOpenFileTypes": [
4661 "exe",
4662 "txt"
4663 ],
4664 "DownloadDirectory": "/home/${user_name}/Downloads",
4665 "ImportHomepage": true,
4666 "GloballyScopeHTTPAuthCacheEnabled": false,
4667 "CloudManagementEnrollmentToken": "37185d02-e055-11e7-80c1-9a214cf093ae",
4668 "ThirdPartyBlockingEnabled": false,
4669 "AdsSettingForIntrusiveAdsSites": 1,
4670 "FetchKeepaliveDurationSecondsOnShutdown": 1,
4671 "BookmarkBarEnabled": true,
4672 "DisableScreenshots": true,
4673 "AccessibilityImageLabelsEnabled": false,
4674 "RemoteAccessHostAllowUiAccessForRemoteAssistance": true,
4675 "PopupsBlockedForUrls": [
4676 "https://www.example.com",
4677 "[*.]example.edu"
4678 ],
4679 "DefaultFileSystemReadGuardSetting": 2,
4680 "BrowserSignin": 2,
4681 "WebRtcAllowLegacyTLSProtocols": false,
4682 "PasswordManagerEnabled": true,
4683 "SafeBrowsingExtendedReportingEnabled": true,
4684 "CloudPolicyOverridesPlatformPolicy": false,
4685 "InsecurePrivateNetworkRequestsAllowedForUrls": [
4686 "http://www.example.com:8080",
4687 "[*.]example.edu"
4688 ],
4689 "RelaunchNotification": 1,
4690 "AlwaysOpenPdfExternally": true,
4691 "DefaultFileHandlingGuardSetting": 2,
4692 "ForceEphemeralProfiles": true,
4693 "PasswordProtectionLoginURLs": [
4694 "https://mydomain.com/login.html",
4695 "https://login.mydomain.com"
4696 ],
4697 "BrowserSwitcherExternalGreylistUrl": "http://example.com/greylist.xml",
4698 "BrowserGuestModeEnabled": true,
4699 "MediaRecommendationsEnabled": true,
4700 "WebRtcLocalIpsAllowedUrls": [
4701 "https://www.example.com",
4702 "*example.com*"
4703 ],
4704 "DeveloperToolsAvailability": 2,
4705 "DNSInterceptionChecksEnabled": true,
4706 "DefaultSearchProviderContextMenuAccessAllowed": true,
4707 "RemoteAccessHostRequireCurtain": false,
4708 "PaymentMethodQueryEnabled": true,
4709 "HomepageLocation": "https://www.chromium.org",
4710 "WebUsbAskForUrls": [
4711 "https://www.example.com",
4712 "[*.]example.edu"
4713 ],
4714 "RemoteAccessHostAllowClientPairing": false,
4715 "ProxySettings": {
4716 "ProxyMode": "direct",
4717 "ProxyPacUrl": "https://internal.site/example.pac",
4718 "ProxyServer": "123.123.123.123:8080",
4719 "ProxyServerMode": 2,
4720 "ProxyBypassList": "https://www.example1.com,https://www.example2.com,https://internalsite/"
4721 },
4722 "AutofillCreditCardEnabled": false,
4723 "FileHandlingAllowedForUrls": [
4724 "https://www.example.com",
4725 "[*.]example.edu"
4726 ],
4727 "ChromeCleanupReportingEnabled": true,
4728 "AlternateErrorPagesEnabled": true,
4729 "WebRtcEventLogCollectionAllowed": true,
4730 "AutoSelectCertificateForUrls": [
4731 "{\\"pattern\\":\\"https://www.example.com\\",\\"filter\\":{\\"ISSUER\\":{\\"CN\\":\\"certificate issuer name\\", \\"L\\": \\"certificate issuer location\\", \\"O\\": \\"certificate issuer org\\", \\"OU\\": \\"certificate issuer org unit\\"}, \\"SUBJECT\\":{\\"CN\\":\\"certificate subject name\\", \\"L\\": \\"certificate subject location\\", \\"O\\": \\"certificate subject org\\", \\"OU\\": \\"certificate subject org unit\\"}}}"
4732 ],
4733 "PolicyListMultipleSourceMergeList": [
4734 "ExtensionInstallAllowlist",
4735 "ExtensionInstallBlocklist"
4736 ],
4737 "CertificateTransparencyEnforcementDisabledForCas": [
4738 "sha256/AAAAAAAAAAAAAAAAAAAAAA==",
4739 "sha256//////////////////////w=="
4740 ],
4741 "CookiesSessionOnlyForUrls": [
4742 "https://www.example.com",
4743 "[*.]example.edu"
4744 ],
4745 "SitePerProcess": true,
4746 "RemoteAccessHostFirewallTraversal": false,
4747 "DefaultSearchProviderSuggestURLPostParams": "q={searchTerms},ie=utf-8,oe=utf-8",
4748 "BackgroundModeEnabled": true,
4749 "DefaultJavaScriptSetting": 1,
4750 "ForcedLanguages": [
4751 "en-US"
4752 ],
4753 "ManagedBookmarks": [
4754 {
4755 "toplevel_name": "My managed bookmarks folder"
4756 },
4757 {
4758 "url": "google.com",
4759 "name": "Google"
4760 },
4761 {
4762 "url": "youtube.com",
4763 "name": "Youtube"
4764 },
4765 {
4766 "children": [
4767 {
4768 "url": "chromium.org",
4769 "name": "Chromium"
4770 },
4771 {
4772 "url": "dev.chromium.org",
4773 "name": "Chromium Developers"
4774 }
4775 ],
4776 "name": "Chrome links"
4777 }
4778 ],
4779 "Disable3DAPIs": false,
4780 "CloudPrintSubmitEnabled": true,
4781 "DefaultCookiesSetting": 1,
4782 "ExtensionInstallBlocklist": [
4783 "extension_id1",
4784 "extension_id2"
4785 ],
4786 "URLAllowlist": [
4787 "example.com",
4788 "https://ssl.server.com",
4789 "hosting.com/good_path",
4790 "https://server:8080/path",
4791 ".exact.hostname.com"
4792 ],
4793 "ExplicitlyAllowedNetworkPorts": [
4794 "10080"
4795 ],
4796 "HomepageIsNewTabPage": true,
4797 "SensorsBlockedForUrls": [
4798 "https://www.example.com",
4799 "[*.]example.edu"
4800 ],
4801 "BrowserLabsEnabled": false,
4802 "NotificationsAllowedForUrls": [
4803 "https://www.example.com",
4804 "[*.]example.edu"
4805 ],
4806 "NativeMessagingUserLevelHosts": false,
4807 "AuthNegotiateDelegateAllowlist": "foobar.example.com",
4808 "CloudUserPolicyMerge": true,
4809 "OverrideSecurityRestrictionsOnInsecureOrigin": [
4810 "http://testserver.example.com/",
4811 "*.example.org"
4812 ],
4813 "HideWebStoreIcon": true,
4814 "SafeBrowsingForTrustedSourcesEnabled": false,
4815 "NewTabPageLocation": "https://www.chromium.org",
4816 "DiskCacheSize": 104857600,
4817 "BrowserSwitcherUseIeSitelist": true,
4818 "WebRtcUdpPortRange": "10000-11999",
4819 "EnterpriseHardwarePlatformAPIEnabled": true,
4820 "AutoOpenAllowedForURLs": [
4821 "example.com",
4822 "https://ssl.server.com",
4823 "hosting.com/good_path",
4824 "https://server:8080/path",
4825 ".exact.hostname.com"
4826 ],
4827 "NativeMessagingAllowlist": [
4828 "com.native.messaging.host.name1",
4829 "com.native.messaging.host.name2"
4830 ],
4831 "DefaultSearchProviderName": "My Intranet Search",
4832 "JavaScriptBlockedForUrls": [
4833 "https://www.example.com",
4834 "[*.]example.edu"
4835 ],
4836 "EnableExperimentalPolicies": [
4837 "ExtensionInstallAllowlist",
4838 "ExtensionInstallBlocklist"
4839 ],
4840 "SafeBrowsingAllowlistDomains": [
4841 "mydomain.com",
4842 "myuniversity.edu"
4843 ],
4844 "AutofillAddressEnabled": false,
4845 "AllowCrossOriginAuthPrompt": false,
4846 "SpellcheckLanguage": [
4847 "fr",
4848 "es"
4849 ],
4850 "VideoCaptureAllowed": false,
4851 "ScreenCaptureAllowed": false,
4852 "VideoCaptureAllowedUrls": [
4853 "https://www.example.com/",
4854 "https://[*.]example.edu/"
4855 ],
4856 "ImportHistory": true,
4857 "ShowCastIconInToolbar": false,
4858 "RestoreOnStartupURLs": [
4859 "https://example.com",
4860 "https://www.chromium.org"
4861 ],
4862 "LegacySameSiteCookieBehaviorEnabledForDomainList": [
4863 "www.example.com",
4864 "[*.]example.edu"
4865 ],
4866 "PrintingEnabled": true,
4867 "ImportSavedPasswords": true,
4868 "EnableDeprecatedPrivetPrinting": true,
4869 "InsecurePrivateNetworkRequestsAllowed": false,
4870 "HeadlessMode": 2,
4871 "PolicyAtomicGroupsEnabled": true,
4872 "HardwareAccelerationModeEnabled": true,
4873 "AllowDeletingBrowserHistory": true,
4874 "DefaultSearchProviderKeyword": "mis",
4875 "ExtensionInstallAllowlist": [
4876 "extension_id1",
4877 "extension_id2"
4878 ],
4879 "WebAppInstallForceList": [
4880 {
4881 "url": "https://www.google.com/maps",
4882 "create_desktop_shortcut": true,
4883 "default_launch_container": "window"
4884 },
4885 {
4886 "url": "https://docs.google.com",
4887 "default_launch_container": "tab"
4888 },
4889 {
4890 "url": "https://docs.google.com/editor",
4891 "fallback_app_name": "Editor",
4892 "default_launch_container": "window"
4893 }
4894 ],
4895 "DiskCacheDir": "${user_home}/Chrome_cache",
4896 "SignedHTTPExchangeEnabled": true,
4897 "SearchSuggestEnabled": true,
4898 "BrowserThemeColor": "#FFFFFF",
4899 "RestrictSigninToPattern": ".*@example\\\\.com",
4900 "DefaultInsecureContentSetting": 2,
4901 "DefaultSensorsSetting": 2,
4902 "AudioSandboxEnabled": true,
4903 "RemoteAccessHostAllowRelayedConnection": false,
4904 "RoamingProfileLocation": "${roaming_app_data}\\\\chrome-profile",
4905 "UserAgentClientHintsEnabled": true,
4906 "TargetBlankImpliesNoOpener": false,
4907 "BrowserSwitcherKeepLastChromeTab": false,
4908 "RemoteAccessHostClientDomainList": [
4909 "my-awesome-domain.com",
4910 "my-auxiliary-domain.com"
4911 ],
4912 "NotificationsBlockedForUrls": [
4913 "https://www.example.com",
4914 "[*.]example.edu"
4915 ],
4916 "SerialBlockedForUrls": [
4917 "https://www.example.com",
4918 "[*.]example.edu"
4919 ],
4920 "DefaultImagesSetting": 1,
4921 "SigninInterceptionEnabled": true,
4922 "WebUsbBlockedForUrls": [
4923 "https://www.example.com",
4924 "[*.]example.edu"
4925 ],
4926 "ImportAutofillFormData": true,
4927 "BrowserSwitcherEnabled": true
4928 }
4929 """
4930
4931 chromium_json_expected_recommended = \
4932 b"""
4933 {
4934 "BackgroundModeEnabled": true,
4935 "RestoreOnStartup": 4,
4936 "RegisteredProtocolHandlers": [
4937 {
4938 "default": true,
4939 "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s",
4940 "protocol": "mailto"
4941 }
4942 ],
4943 "ShowHomeButton": true,
4944 "PrintHeaderFooter": false,
4945 "SafeBrowsingForTrustedSourcesEnabled": false,
4946 "ShowFullUrlsInAddressBar": false,
4947 "MetricsReportingEnabled": true,
4948 "SpellCheckServiceEnabled": false,
4949 "ImportSearchEngine": true,
4950 "DownloadRestrictions": 2,
4951 "NetworkPredictionOptions": 1,
4952 "DownloadDirectory": "/home/${user_name}/Downloads",
4953 "TranslateEnabled": true,
4954 "AutofillAddressEnabled": false,
4955 "BookmarkBarEnabled": true,
4956 "PrintPreviewUseSystemDefaultPrinter": false,
4957 "ApplicationLocaleValue": "en",
4958 "ImportHistory": true,
4959 "RestoreOnStartupURLs": [
4960 "https://example.com",
4961 "https://www.chromium.org"
4962 ],
4963 "PasswordManagerEnabled": true,
4964 "ImportSavedPasswords": true,
4965 "DefaultDownloadDirectory": "/home/${user_name}/Downloads",
4966 "PasswordLeakDetectionEnabled": true,
4967 "SearchSuggestEnabled": true,
4968 "AlternateErrorPagesEnabled": true,
4969 "HomepageIsNewTabPage": true,
4970 "ImportAutofillFormData": true,
4971 "BlockThirdPartyCookies": false,
4972 "AutofillCreditCardEnabled": false,
4973 "HomepageLocation": "https://www.chromium.org",
4974 "SafeBrowsingProtectionLevel": 2,
4975 "ImportBookmarks": true
4976 }
4977 """
4978
4979 firewalld_reg_pol = \
4980 br"""
4981 <?xml version="1.0" encoding="utf-8"?>
4982 <PolFile num_entries="6" signature="PReg" version="1">
4983 <Entry type="4" type_name="REG_DWORD">
4984 <Key>Software\Policies\Samba\Unix Settings\Firewalld</Key>
4985 <ValueName>Zones</ValueName>
4986 <Value>1</Value>
4987 </Entry>
4988 <Entry type="4" type_name="REG_DWORD">
4989 <Key>Software\Policies\Samba\Unix Settings\Firewalld</Key>
4990 <ValueName>Rules</ValueName>
4991 <Value>1</Value>
4992 </Entry>
4993 <Entry type="1" type_name="REG_SZ">
4994 <Key>Software\Policies\Samba\Unix Settings\Firewalld\Rules</Key>
4995 <ValueName>Rules</ValueName>
4996 <Value>{&quot;work&quot;: [{&quot;rule&quot;: {&quot;family&quot;: &quot;ipv4&quot;}, &quot;source address&quot;: &quot;172.25.1.7&quot;, &quot;service name&quot;: &quot;ftp&quot;, &quot;reject&quot;: {}}]}</Value>
4997 </Entry>
4998 <Entry type="1" type_name="REG_SZ">
4999 <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
5000 <ValueName>**delvals.</ValueName>
5001 <Value> </Value>
5002 </Entry>
5003 <Entry type="1" type_name="REG_SZ">
5004 <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
5005 <ValueName>work</ValueName>
5006 <Value>work</Value>
5007 </Entry>
5008 <Entry type="1" type_name="REG_SZ">
5009 <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
5010 <ValueName>home</ValueName>
5011 <Value>home</Value>
5012 </Entry>
5013 </PolFile>
5014 """
5015
5016 def days2rel_nttime(val):
5017 seconds = 60
5018 minutes = 60
5019 hours = 24
5020 sam_add = 10000000
5021 return -(val * seconds * minutes * hours * sam_add)
5022
5023 def gpupdate(lp, arg):
5024 gpupdate = lp.get('gpo update command')
5025 gpupdate.append(arg)
5026
5027 p = Popen(gpupdate, stdout=PIPE, stderr=PIPE)
5028 stdoutdata, stderrdata = p.communicate()
5029 print(stderrdata)
5030 return p.returncode
5031
5032 def gpupdate_force(lp):
5033 return gpupdate(lp, '--force')
5034
5035 def gpupdate_unapply(lp):
5036 return gpupdate(lp, '--unapply')
5037
5038 def rsop(lp):
5039 return gpupdate(lp, '--rsop')
5040
5041 def stage_file(path, data):
5042 dirname = os.path.dirname(path)
5043 if not os.path.exists(dirname):
5044 try:
5045 os.makedirs(dirname)
5046 except OSError as e:
5047 if not (e.errno == errno.EEXIST and os.path.isdir(dirname)):
5048 return False
5049 if os.path.exists(path):
5050 os.rename(path, '%s.bak' % path)
5051 with NamedTemporaryFile(delete=False, dir=os.path.dirname(path)) as f:
5052 f.write(get_bytes(data))
5053 os.rename(f.name, path)
5054 os.chmod(path, 0o644)
5055 return True
5056
5057 def unstage_file(path):
5058 backup = '%s.bak' % path
5059 if os.path.exists(backup):
5060 os.rename(backup, path)
5061 elif os.path.exists(path):
5062 os.remove(path)
5063
5064 class GPOTests(tests.TestCase):
5065 def setUp(self):
5066 super(GPOTests, self).setUp()
5067 self.server = os.environ["SERVER"]
5068 self.dc_account = self.server.upper() + '$'
5069 self.lp = s3param.get_context()
5070 self.lp.load_default()
5071 self.creds = self.insta_creds(template=self.get_credentials())
5072
5073 def tearDown(self):
5074 super(GPOTests, self).tearDown()
5075
5076 def test_gpo_list(self):
5077 global poldir, dspath
5078 gpos = get_gpo_list(self.server, self.creds, self.lp,
5079 self.creds.get_username())
5080 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5081 names = ['Local Policy', guid]
5082 file_sys_paths = [None, '%s\\%s' % (poldir, guid)]
5083 ds_paths = [None, 'CN=%s,%s' % (guid, dspath)]
5084 for i in range(0, len(gpos)):
5085 self.assertEqual(gpos[i].name, names[i],
5086 'The gpo name did not match expected name %s' % gpos[i].name)
5087 self.assertEqual(gpos[i].file_sys_path, file_sys_paths[i],
5088 'file_sys_path did not match expected %s' % gpos[i].file_sys_path)
5089 self.assertEqual(gpos[i].ds_path, ds_paths[i],
5090 'ds_path did not match expected %s' % gpos[i].ds_path)
5091
5092 def test_gpt_version(self):
5093 global gpt_data
5094 local_path = self.lp.cache_path('gpo_cache')
5095 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5096 gpo_path = os.path.join(local_path, policies, guid)
5097 old_vers = gpo.gpo_get_sysvol_gpt_version(gpo_path)[1]
5098
5099 with open(os.path.join(gpo_path, 'GPT.INI'), 'w') as gpt:
5100 gpt.write(gpt_data % 42)
5101 self.assertEqual(gpo.gpo_get_sysvol_gpt_version(gpo_path)[1], 42,
5102 'gpo_get_sysvol_gpt_version() did not return the expected version')
5103
5104 with open(os.path.join(gpo_path, 'GPT.INI'), 'w') as gpt:
5105 gpt.write(gpt_data % old_vers)
5106 self.assertEqual(gpo.gpo_get_sysvol_gpt_version(gpo_path)[1], old_vers,
5107 'gpo_get_sysvol_gpt_version() did not return the expected version')
5108
5109 def test_check_refresh_gpo_list(self):
5110 cache = self.lp.cache_path('gpo_cache')
5111 gpos = get_gpo_list(self.server, self.creds, self.lp,
5112 self.creds.get_username())
5113 check_refresh_gpo_list(self.server, self.lp, self.creds, gpos)
5114
5115 self.assertTrue(os.path.exists(cache),
5116 'GPO cache %s was not created' % cache)
5117
5118 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5119 gpt_ini = os.path.join(cache, policies,
5120 guid, 'GPT.INI')
5121 self.assertTrue(os.path.exists(gpt_ini),
5122 'GPT.INI was not cached for %s' % guid)
5123
5124 def test_check_refresh_gpo_list_malicious_paths(self):
5125 # the path cannot contain ..
5126 path = '/usr/local/samba/var/locks/sysvol/../../../../../../root/'
5127 self.assertRaises(OSError, check_safe_path, path)
5128
5129 self.assertEqual(check_safe_path('/etc/passwd'), 'etc/passwd')
5130 self.assertEqual(check_safe_path('\\\\etc/\\passwd'), 'etc/passwd')
5131
5132 # there should be no backslashes used to delineate paths
5133 before = 'sysvol/' + realm + '\\Policies/' \
5134 '{31B2F340-016D-11D2-945F-00C04FB984F9}\\GPT.INI'
5135 after = realm + '/Policies/' \
5136 '{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI'
5137 result = check_safe_path(before)
5138 self.assertEqual(result, after, 'check_safe_path() didn\'t'
5139 ' correctly convert \\ to /')
5140
5141 def test_check_safe_path_typesafe_name(self):
5142 path = '\\\\toady.suse.de\\SysVol\\toady.suse.de\\Policies\\' \
5143 '{31B2F340-016D-11D2-945F-00C04FB984F9}\\GPT.INI'
5144 expected_path = 'toady.suse.de/Policies/' \
5145 '{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI'
5146
5147 result = check_safe_path(path)
5148 self.assertEqual(result, expected_path,
5149 'check_safe_path unable to detect variable case sysvol components')
5150
5151 def test_gpt_ext_register(self):
5152 this_path = os.path.dirname(os.path.realpath(__file__))
5153 samba_path = os.path.realpath(os.path.join(this_path, '../../../'))
5154 ext_path = os.path.join(samba_path, 'python/samba/gp/gp_sec_ext.py')
5155 ext_guid = '{827D319E-6EAC-11D2-A4EA-00C04F79F83A}'
5156 ret = register_gp_extension(ext_guid, 'gp_access_ext', ext_path,
5157 smb_conf=self.lp.configfile,
5158 machine=True, user=False)
5159 self.assertTrue(ret, 'Failed to register a gp ext')
5160 gp_exts = list_gp_extensions(self.lp.configfile)
5161 self.assertTrue(ext_guid in gp_exts.keys(),
5162 'Failed to list gp exts')
5163 self.assertEqual(gp_exts[ext_guid]['DllName'], ext_path,
5164 'Failed to list gp exts')
5165
5166 unregister_gp_extension(ext_guid)
5167 gp_exts = list_gp_extensions(self.lp.configfile)
5168 self.assertTrue(ext_guid not in gp_exts.keys(),
5169 'Failed to unregister gp exts')
5170
5171 self.assertTrue(check_guid(ext_guid), 'Failed to parse valid guid')
5172 self.assertFalse(check_guid('AAAAAABBBBBBBCCC'), 'Parsed invalid guid')
5173
5174 lp, parser = parse_gpext_conf(self.lp.configfile)
5175 self.assertTrue(lp and parser, 'parse_gpext_conf() invalid return')
5176 parser.add_section('test_section')
5177 parser.set('test_section', 'test_var', ext_guid)
5178 atomic_write_conf(lp, parser)
5179
5180 lp, parser = parse_gpext_conf(self.lp.configfile)
5181 self.assertTrue('test_section' in parser.sections(),
5182 'test_section not found in gpext.conf')
5183 self.assertEqual(parser.get('test_section', 'test_var'), ext_guid,
5184 'Failed to find test variable in gpext.conf')
5185 parser.remove_section('test_section')
5186 atomic_write_conf(lp, parser)
5187
5188 def test_gp_log_get_applied(self):
5189 local_path = self.lp.get('path', 'sysvol')
5190 guids = ['{31B2F340-016D-11D2-945F-00C04FB984F9}',
5191 '{6AC1786C-016F-11D2-945F-00C04FB984F9}']
5192 gpofile = '%s/' + realm + '/Policies/%s/MACHINE/Microsoft/' \
5193 'Windows NT/SecEdit/GptTmpl.inf'
5194 stage = '[System Access]\nMinimumPasswordAge = 998\n'
5195 cache_dir = self.lp.get('cache directory')
5196 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5197 for guid in guids:
5198 gpttmpl = gpofile % (local_path, guid)
5199 ret = stage_file(gpttmpl, stage)
5200 self.assertTrue(ret, 'Could not create the target %s' % gpttmpl)
5201
5202 ret = gpupdate_force(self.lp)
5203 self.assertEqual(ret, 0, 'gpupdate force failed')
5204
5205 gp_db = store.get_gplog(self.dc_account)
5206
5207 applied_guids = gp_db.get_applied_guids()
5208 self.assertEqual(len(applied_guids), 2, 'The guids were not found')
5209 self.assertIn(guids[0], applied_guids,
5210 '%s not in applied guids' % guids[0])
5211 self.assertIn(guids[1], applied_guids,
5212 '%s not in applied guids' % guids[1])
5213
5214 applied_settings = gp_db.get_applied_settings(applied_guids)
5215 for policy in applied_settings:
5216 self.assertIn('System Access', policy[1],
5217 'System Access policies not set')
5218 self.assertIn('minPwdAge', policy[1]['System Access'],
5219 'minPwdAge policy not set')
5220 if policy[0] == guids[0]:
5221 self.assertEqual(int(policy[1]['System Access']['minPwdAge']),
5222 days2rel_nttime(1),
5223 'minPwdAge policy not set')
5224 elif policy[0] == guids[1]:
5225 self.assertEqual(int(policy[1]['System Access']['minPwdAge']),
5226 days2rel_nttime(998),
5227 'minPwdAge policy not set')
5228
5229 gpos = get_gpo_list(self.server, self.creds, self.lp,
5230 self.dc_account)
5231 del_gpos = get_deleted_gpos_list(gp_db, gpos[:-1])
5232 self.assertEqual(len(del_gpos), 1, 'Returned delete gpos is incorrect')
5233 self.assertEqual(guids[-1], del_gpos[0][0],
5234 'GUID for delete gpo is incorrect')
5235 self.assertIn('System Access', del_gpos[0][1],
5236 'System Access policies not set for removal')
5237 self.assertIn('minPwdAge', del_gpos[0][1]['System Access'],
5238 'minPwdAge policy not set for removal')
5239
5240 for guid in guids:
5241 gpttmpl = gpofile % (local_path, guid)
5242 unstage_file(gpttmpl)
5243
5244 ret = gpupdate_unapply(self.lp)
5245 self.assertEqual(ret, 0, 'gpupdate unapply failed')
5246
5247 def test_process_group_policy(self):
5248 local_path = self.lp.cache_path('gpo_cache')
5249 guids = ['{31B2F340-016D-11D2-945F-00C04FB984F9}',
5250 '{6AC1786C-016F-11D2-945F-00C04FB984F9}']
5251 gpofile = '%s/' + policies + '/%s/MACHINE/MICROSOFT/' \
5252 'WINDOWS NT/SECEDIT/GPTTMPL.INF'
5253 cache_dir = self.lp.get('cache directory')
5254 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5255
5256 machine_creds = Credentials()
5257 machine_creds.guess(self.lp)
5258 machine_creds.set_machine_account()
5259
5260 # Initialize the group policy extension
5261 ext = gp_krb_ext(self.lp, machine_creds,
5262 machine_creds.get_username(), store)
5263
5264 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5265 machine_creds.get_username())
5266
5267 # Include MaxClockSkew to ensure we don't fail on a key we ignore
5268 stage = '[Kerberos Policy]\nMaxTicketAge = %d\nMaxClockSkew = 5'
5269 opts = [100, 200]
5270 for i in range(0, 2):
5271 gpttmpl = gpofile % (local_path, guids[i])
5272 ret = stage_file(gpttmpl, stage % opts[i])
5273 self.assertTrue(ret, 'Could not create the target %s' % gpttmpl)
5274
5275 # Process all gpos
5276 ext.process_group_policy([], gpos)
5277
5278 ret = store.get_int('kdc:user_ticket_lifetime')
5279 self.assertEqual(ret, opts[1], 'Higher priority policy was not set')
5280
5281 # Remove policy
5282 gp_db = store.get_gplog(machine_creds.get_username())
5283 del_gpos = get_deleted_gpos_list(gp_db, [])
5284 ext.process_group_policy(del_gpos, [])
5285
5286 ret = store.get_int('kdc:user_ticket_lifetime')
5287 self.assertEqual(ret, None, 'MaxTicketAge should not have applied')
5288
5289 # Process just the first gpo
5290 ext.process_group_policy([], gpos[:-1])
5291
5292 ret = store.get_int('kdc:user_ticket_lifetime')
5293 self.assertEqual(ret, opts[0], 'Lower priority policy was not set')
5294
5295 # Remove policy
5296 ext.process_group_policy(del_gpos, [])
5297
5298 for guid in guids:
5299 gpttmpl = gpofile % (local_path, guid)
5300 unstage_file(gpttmpl)
5301
5302 def test_gp_scripts(self):
5303 local_path = self.lp.cache_path('gpo_cache')
5304 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5305 reg_pol = os.path.join(local_path, policies, guid,
5306 'MACHINE/REGISTRY.POL')
5307 cache_dir = self.lp.get('cache directory')
5308 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5309
5310 machine_creds = Credentials()
5311 machine_creds.guess(self.lp)
5312 machine_creds.set_machine_account()
5313
5314 # Initialize the group policy extension
5315 ext = gp_scripts_ext(self.lp, machine_creds,
5316 machine_creds.get_username(), store)
5317
5318 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5319 machine_creds.get_username())
5320
5321 reg_key = b'Software\\Policies\\Samba\\Unix Settings'
5322 sections = { b'%s\\Daily Scripts' % reg_key : '.cron.daily',
5323 b'%s\\Monthly Scripts' % reg_key : '.cron.monthly',
5324 b'%s\\Weekly Scripts' % reg_key : '.cron.weekly',
5325 b'%s\\Hourly Scripts' % reg_key : '.cron.hourly' }
5326 for keyname in sections.keys():
5327 # Stage the Registry.pol file with test data
5328 stage = preg.file()
5329 e = preg.entry()
5330 e.keyname = keyname
5331 e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5332 e.type = 1
5333 e.data = b'echo hello world'
5334 stage.num_entries = 1
5335 stage.entries = [e]
5336 ret = stage_file(reg_pol, ndr_pack(stage))
5337 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5338
5339 # Process all gpos, with temp output directory
5340 with TemporaryDirectory(sections[keyname]) as dname:
5341 ext.process_group_policy([], gpos, dname)
5342 scripts = os.listdir(dname)
5343 self.assertEqual(len(scripts), 1,
5344 'The %s script was not created' % keyname.decode())
5345 out, _ = Popen([os.path.join(dname, scripts[0])], stdout=PIPE).communicate()
5346 self.assertIn(b'hello world', out,
5347 '%s script execution failed' % keyname.decode())
5348
5349 # Check that a call to gpupdate --rsop also succeeds
5350 ret = rsop(self.lp)
5351 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5352
5353 # Remove policy
5354 gp_db = store.get_gplog(machine_creds.get_username())
5355 del_gpos = get_deleted_gpos_list(gp_db, [])
5356 ext.process_group_policy(del_gpos, [])
5357 self.assertEqual(len(os.listdir(dname)), 0,
5358 'Unapply failed to cleanup scripts')
5359
5360 # Unstage the Registry.pol file
5361 unstage_file(reg_pol)
5362
5363 def test_gp_sudoers(self):
5364 local_path = self.lp.cache_path('gpo_cache')
5365 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5366 reg_pol = os.path.join(local_path, policies, guid,
5367 'MACHINE/REGISTRY.POL')
5368 cache_dir = self.lp.get('cache directory')
5369 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5370
5371 machine_creds = Credentials()
5372 machine_creds.guess(self.lp)
5373 machine_creds.set_machine_account()
5374
5375 # Initialize the group policy extension
5376 ext = gp_sudoers_ext(self.lp, machine_creds,
5377 machine_creds.get_username(), store)
5378
5379 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5380 machine_creds.get_username())
5381
5382 # Stage the Registry.pol file with test data
5383 stage = preg.file()
5384 e = preg.entry()
5385 e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5386 e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5387 e.type = 1
5388 e.data = b'fakeu ALL=(ALL) NOPASSWD: ALL'
5389 stage.num_entries = 1
5390 stage.entries = [e]
5391 ret = stage_file(reg_pol, ndr_pack(stage))
5392 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5393
5394 # Process all gpos, with temp output directory
5395 with TemporaryDirectory() as dname:
5396 ext.process_group_policy([], gpos, dname)
5397 sudoers = os.listdir(dname)
5398 self.assertEqual(len(sudoers), 1, 'The sudoer file was not created')
5399 self.assertIn(e.data,
5400 open(os.path.join(dname, sudoers[0]), 'r').read(),
5401 'The sudoers entry was not applied')
5402
5403 # Check that a call to gpupdate --rsop also succeeds
5404 ret = rsop(self.lp)
5405 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5406
5407 # Remove policy
5408 gp_db = store.get_gplog(machine_creds.get_username())
5409 del_gpos = get_deleted_gpos_list(gp_db, [])
5410 ext.process_group_policy(del_gpos, [])
5411 self.assertEqual(len(os.listdir(dname)), 0,
5412 'Unapply failed to cleanup scripts')
5413
5414 # Unstage the Registry.pol file
5415 unstage_file(reg_pol)
5416
5417 def test_vgp_sudoers(self):
5418 local_path = self.lp.cache_path('gpo_cache')
5419 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5420 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5421 'VGP/VTLA/SUDO/SUDOERSCONFIGURATION/MANIFEST.XML')
5422 cache_dir = self.lp.get('cache directory')
5423 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5424
5425 machine_creds = Credentials()
5426 machine_creds.guess(self.lp)
5427 machine_creds.set_machine_account()
5428
5429 # Initialize the group policy extension
5430 ext = vgp_sudoers_ext(self.lp, machine_creds,
5431 machine_creds.get_username(), store)
5432
5433 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5434 machine_creds.get_username())
5435
5436 # Stage the manifest.xml file with test data
5437 stage = etree.Element('vgppolicy')
5438 policysetting = etree.Element('policysetting')
5439 stage.append(policysetting)
5440 version = etree.Element('version')
5441 version.text = '1'
5442 policysetting.append(version)
5443 data = etree.Element('data')
5444 sudoers_entry = etree.Element('sudoers_entry')
5445 command = etree.Element('command')
5446 command.text = 'ALL'
5447 sudoers_entry.append(command)
5448 user = etree.Element('user')
5449 user.text = 'ALL'
5450 sudoers_entry.append(user)
5451 principal_list = etree.Element('listelement')
5452 principal = etree.Element('principal')
5453 principal.text = 'fakeu'
5454 principal.attrib['type'] = 'user'
5455 group = etree.Element('principal')
5456 group.text = 'fakeg'
5457 group.attrib['type'] = 'group'
5458 principal_list.append(principal)
5459 principal_list.append(group)
5460 sudoers_entry.append(principal_list)
5461 data.append(sudoers_entry)
5462 # Ensure an empty principal doesn't cause a crash
5463 sudoers_entry = etree.SubElement(data, 'sudoers_entry')
5464 command = etree.SubElement(sudoers_entry, 'command')
5465 command.text = 'ALL'
5466 user = etree.SubElement(sudoers_entry, 'user')
5467 user.text = 'ALL'
5468 # Ensure having dispersed principals still works
5469 sudoers_entry = etree.SubElement(data, 'sudoers_entry')
5470 command = etree.SubElement(sudoers_entry, 'command')
5471 command.text = 'ALL'
5472 user = etree.SubElement(sudoers_entry, 'user')
5473 user.text = 'ALL'
5474 listelement = etree.SubElement(sudoers_entry, 'listelement')
5475 principal = etree.SubElement(listelement, 'principal')
5476 principal.text = 'fakeu2'
5477 principal.attrib['type'] = 'user'
5478 listelement = etree.SubElement(sudoers_entry, 'listelement')
5479 group = etree.SubElement(listelement, 'principal')
5480 group.text = 'fakeg2'
5481 group.attrib['type'] = 'group'
5482 policysetting.append(data)
5483 ret = stage_file(manifest, etree.tostring(stage))
5484 self.assertTrue(ret, 'Could not create the target %s' % manifest)
5485
5486 # Process all gpos, with temp output directory
5487 data = 'fakeu,fakeg% ALL=(ALL) NOPASSWD: ALL'
5488 data2 = 'fakeu2,fakeg2% ALL=(ALL) NOPASSWD: ALL'
5489 data_no_principal = 'ALL ALL=(ALL) NOPASSWD: ALL'
5490 with TemporaryDirectory() as dname:
5491 ext.process_group_policy([], gpos, dname)
5492 sudoers = os.listdir(dname)
5493 self.assertEqual(len(sudoers), 3, 'The sudoer file was not created')
5494 output = open(os.path.join(dname, sudoers[0]), 'r').read() + \
5495 open(os.path.join(dname, sudoers[1]), 'r').read() + \
5496 open(os.path.join(dname, sudoers[2]), 'r').read()
5497 self.assertIn(data, output,
5498 'The sudoers entry was not applied')
5499 self.assertIn(data2, output,
5500 'The sudoers entry was not applied')
5501 self.assertIn(data_no_principal, output,
5502 'The sudoers entry was not applied')
5503
5504 # Check that a call to gpupdate --rsop also succeeds
5505 ret = rsop(self.lp)
5506 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5507
5508 # Remove policy
5509 gp_db = store.get_gplog(machine_creds.get_username())
5510 del_gpos = get_deleted_gpos_list(gp_db, [])
5511 ext.process_group_policy(del_gpos, [])
5512 self.assertEqual(len(os.listdir(dname)), 0,
5513 'Unapply failed to cleanup scripts')
5514
5515 # Unstage the Registry.pol file
5516 unstage_file(manifest)
5517
5518 def test_gp_inf_ext_utf(self):
5519 cache_dir = self.lp.get('cache directory')
5520 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5521
5522 machine_creds = Credentials()
5523 machine_creds.guess(self.lp)
5524 machine_creds.set_machine_account()
5525
5526 ext = gp_inf_ext(self.lp, machine_creds,
5527 machine_creds.get_username(), store)
5528 test_data = '[Kerberos Policy]\nMaxTicketAge = 99\n'
5529
5530 with NamedTemporaryFile() as f:
5531 with codecs.open(f.name, 'w', 'utf-16') as w:
5532 w.write(test_data)
5533 try:
5534 inf_conf = ext.read(f.name)
5535 except UnicodeDecodeError:
5536 self.fail('Failed to parse utf-16')
5537 self.assertIn('Kerberos Policy', inf_conf.keys(),
5538 'Kerberos Policy was not read from the file')
5539 self.assertEqual(inf_conf.get('Kerberos Policy', 'MaxTicketAge'),
5540 '99', 'MaxTicketAge was not read from the file')
5541
5542 with NamedTemporaryFile() as f:
5543 with codecs.open(f.name, 'w', 'utf-8') as w:
5544 w.write(test_data)
5545 inf_conf = ext.read(f.name)
5546 self.assertIn('Kerberos Policy', inf_conf.keys(),
5547 'Kerberos Policy was not read from the file')
5548 self.assertEqual(inf_conf.get('Kerberos Policy', 'MaxTicketAge'),
5549 '99', 'MaxTicketAge was not read from the file')
5550
5551 def test_rsop(self):
5552 cache_dir = self.lp.get('cache directory')
5553 local_path = self.lp.cache_path('gpo_cache')
5554 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5555
5556 machine_creds = Credentials()
5557 machine_creds.guess(self.lp)
5558 machine_creds.set_machine_account()
5559
5560 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5561 machine_creds.get_username())
5562
5563 gp_extensions = []
5564 gp_extensions.append(gp_krb_ext)
5565 gp_extensions.append(gp_scripts_ext)
5566 gp_extensions.append(gp_sudoers_ext)
5567 gp_extensions.append(gp_smb_conf_ext)
5568 gp_extensions.append(gp_msgs_ext)
5569
5570 # Create registry stage data
5571 reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
5572 reg_stage = preg.file()
5573 e = preg.entry()
5574 e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Daily Scripts'
5575 e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5576 e.type = 1
5577 e.data = b'echo hello world'
5578 e2 = preg.entry()
5579 e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5580 e2.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5581 e2.type = 1
5582 e2.data = b'fakeu ALL=(ALL) NOPASSWD: ALL'
5583 e3 = preg.entry()
5584 e3.keyname = 'Software\\Policies\\Samba\\smb_conf\\apply group policies'
5585 e3.type = 4
5586 e3.data = 1
5587 e3.valuename = 'apply group policies'
5588 e4 = preg.entry()
5589 e4.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5590 e4.valuename = b'issue'
5591 e4.type = 1
5592 e4.data = b'Welcome to \\s \\r \\l'
5593 reg_stage.num_entries = 4
5594 reg_stage.entries = [e, e2, e3, e4]
5595
5596 # Create krb stage date
5597 gpofile = os.path.join(local_path, policies, '%s/MACHINE/MICROSOFT/' \
5598 'WINDOWS NT/SECEDIT/GPTTMPL.INF')
5599 krb_stage = '[Kerberos Policy]\nMaxTicketAge = 99\n' \
5600 '[System Access]\nMinimumPasswordAge = 998\n'
5601
5602 for g in [g for g in gpos if g.file_sys_path]:
5603 ret = stage_file(gpofile % g.name, krb_stage)
5604 self.assertTrue(ret, 'Could not create the target %s' %
5605 (gpofile % g.name))
5606 ret = stage_file(reg_pol % g.name, ndr_pack(reg_stage))
5607 self.assertTrue(ret, 'Could not create the target %s' %
5608 (reg_pol % g.name))
5609 for ext in gp_extensions:
5610 ext = ext(self.lp, machine_creds,
5611 machine_creds.get_username(), store)
5612 ret = ext.rsop(g)
5613 self.assertEqual(len(ret.keys()), 1,
5614 'A single policy should have been displayed')
5615
5616 # Check the Security Extension
5617 if type(ext) == gp_krb_ext:
5618 self.assertIn('Kerberos Policy', ret.keys(),
5619 'Kerberos Policy not found')
5620 self.assertIn('MaxTicketAge', ret['Kerberos Policy'],
5621 'MaxTicketAge setting not found')
5622 self.assertEqual(ret['Kerberos Policy']['MaxTicketAge'], '99',
5623 'MaxTicketAge was not set to 99')
5624 # Check the Scripts Extension
5625 elif type(ext) == gp_scripts_ext:
5626 self.assertIn('Daily Scripts', ret.keys(),
5627 'Daily Scripts not found')
5628 self.assertIn('echo hello world', ret['Daily Scripts'],
5629 'Daily script was not created')
5630 # Check the Sudoers Extension
5631 elif type(ext) == gp_sudoers_ext:
5632 self.assertIn('Sudo Rights', ret.keys(),
5633 'Sudoers not found')
5634 self.assertIn('fakeu ALL=(ALL) NOPASSWD: ALL',
5635 ret['Sudo Rights'],
5636 'Sudoers policy not created')
5637 # Check the smb.conf Extension
5638 elif type(ext) == gp_smb_conf_ext:
5639 self.assertIn('smb.conf', ret.keys(),
5640 'apply group policies was not applied')
5641 self.assertIn(e3.valuename, ret['smb.conf'],
5642 'apply group policies was not applied')
5643 self.assertEqual(ret['smb.conf'][e3.valuename], e3.data,
5644 'apply group policies was not set')
5645 # Check the Messages Extension
5646 elif type(ext) == gp_msgs_ext:
5647 self.assertIn('/etc/issue', ret,
5648 'Login Prompt Message not applied')
5649 self.assertEqual(ret['/etc/issue'], e4.data,
5650 'Login Prompt Message not set')
5651
5652 # Check that a call to gpupdate --rsop also succeeds
5653 ret = rsop(self.lp)
5654 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5655
5656 unstage_file(gpofile % g.name)
5657 unstage_file(reg_pol % g.name)
5658
5659 def test_gp_unapply(self):
5660 cache_dir = self.lp.get('cache directory')
5661 local_path = self.lp.cache_path('gpo_cache')
5662 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5663 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5664
5665 machine_creds = Credentials()
5666 machine_creds.guess(self.lp)
5667 machine_creds.set_machine_account()
5668
5669 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5670 machine_creds.get_username())
5671
5672 gp_extensions = []
5673 gp_extensions.append(gp_krb_ext)
5674 gp_extensions.append(gp_scripts_ext)
5675 gp_extensions.append(gp_sudoers_ext)
5676
5677 # Create registry stage data
5678 reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
5679 reg_stage = preg.file()
5680 e = preg.entry()
5681 e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Daily Scripts'
5682 e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5683 e.type = 1
5684 e.data = b'echo hello world'
5685 e2 = preg.entry()
5686 e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5687 e2.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5688 e2.type = 1
5689 e2.data = b'fakeu ALL=(ALL) NOPASSWD: ALL'
5690 reg_stage.num_entries = 2
5691 reg_stage.entries = [e, e2]
5692
5693 # Create krb stage date
5694 gpofile = os.path.join(local_path, policies, '%s/MACHINE/MICROSOFT/' \
5695 'WINDOWS NT/SECEDIT/GPTTMPL.INF')
5696 krb_stage = '[Kerberos Policy]\nMaxTicketAge = 99\n'
5697
5698 ret = stage_file(gpofile % guid, krb_stage)
5699 self.assertTrue(ret, 'Could not create the target %s' %
5700 (gpofile % guid))
5701 ret = stage_file(reg_pol % guid, ndr_pack(reg_stage))
5702 self.assertTrue(ret, 'Could not create the target %s' %
5703 (reg_pol % guid))
5704
5705 # Process all gpos, with temp output directory
5706 remove = []
5707 with TemporaryDirectory() as dname:
5708 for ext in gp_extensions:
5709 ext = ext(self.lp, machine_creds,
5710 machine_creds.get_username(), store)
5711 if type(ext) == gp_krb_ext:
5712 ext.process_group_policy([], gpos)
5713 ret = store.get_int('kdc:user_ticket_lifetime')
5714 self.assertEqual(ret, 99, 'Kerberos policy was not set')
5715 elif type(ext) in [gp_scripts_ext, gp_sudoers_ext]:
5716 ext.process_group_policy([], gpos, dname)
5717 gp_db = store.get_gplog(machine_creds.get_username())
5718 applied_settings = gp_db.get_applied_settings([guid])
5719 for _, fname in applied_settings[-1][-1][str(ext)].items():
5720 fname = fname.split(':')[-1]
5721 self.assertIn(dname, fname,
5722 'Test file not created in tmp dir')
5723 self.assertTrue(os.path.exists(fname),
5724 'Test file not created')
5725 remove.append(fname)
5726
5727 # Unapply policy, and ensure policies are removed
5728 gpupdate_unapply(self.lp)
5729
5730 for fname in remove:
5731 self.assertFalse(os.path.exists(fname),
5732 'Unapply did not remove test file')
5733 ret = store.get_int('kdc:user_ticket_lifetime')
5734 self.assertNotEqual(ret, 99, 'Kerberos policy was not unapplied')
5735
5736 unstage_file(gpofile % guid)
5737 unstage_file(reg_pol % guid)
5738
5739 def test_smb_conf_ext(self):
5740 local_path = self.lp.cache_path('gpo_cache')
5741 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5742 reg_pol = os.path.join(local_path, policies, guid,
5743 'MACHINE/REGISTRY.POL')
5744 cache_dir = self.lp.get('cache directory')
5745 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5746
5747 machine_creds = Credentials()
5748 machine_creds.guess(self.lp)
5749 machine_creds.set_machine_account()
5750
5751 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5752 machine_creds.get_username())
5753
5754 entries = []
5755 e = preg.entry()
5756 e.keyname = 'Software\\Policies\\Samba\\smb_conf\\template homedir'
5757 e.type = 1
5758 e.data = '/home/samba/%D/%U'
5759 e.valuename = 'template homedir'
5760 entries.append(e)
5761 e = preg.entry()
5762 e.keyname = 'Software\\Policies\\Samba\\smb_conf\\apply group policies'
5763 e.type = 4
5764 e.data = 1
5765 e.valuename = 'apply group policies'
5766 entries.append(e)
5767 e = preg.entry()
5768 e.keyname = 'Software\\Policies\\Samba\\smb_conf\\ldap timeout'
5769 e.type = 4
5770 e.data = 9999
5771 e.valuename = 'ldap timeout'
5772 entries.append(e)
5773 stage = preg.file()
5774 stage.num_entries = len(entries)
5775 stage.entries = entries
5776
5777 ret = stage_file(reg_pol, ndr_pack(stage))
5778 self.assertTrue(ret, 'Failed to create the Registry.pol file')
5779
5780 with NamedTemporaryFile(suffix='_smb.conf') as f:
5781 copyfile(self.lp.configfile, f.name)
5782 lp = LoadParm(f.name)
5783
5784 # Initialize the group policy extension
5785 ext = gp_smb_conf_ext(lp, machine_creds,
5786 machine_creds.get_username(), store)
5787 ext.process_group_policy([], gpos)
5788 lp = LoadParm(f.name)
5789
5790 template_homedir = lp.get('template homedir')
5791 self.assertEqual(template_homedir, '/home/samba/%D/%U',
5792 'template homedir was not applied')
5793 apply_group_policies = lp.get('apply group policies')
5794 self.assertTrue(apply_group_policies,
5795 'apply group policies was not applied')
5796 ldap_timeout = lp.get('ldap timeout')
5797 self.assertEqual(ldap_timeout, 9999, 'ldap timeout was not applied')
5798
5799 # Check that a call to gpupdate --rsop also succeeds
5800 ret = rsop(self.lp)
5801 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5802
5803 # Remove policy
5804 gp_db = store.get_gplog(machine_creds.get_username())
5805 del_gpos = get_deleted_gpos_list(gp_db, [])
5806 ext.process_group_policy(del_gpos, [])
5807
5808 lp = LoadParm(f.name)
5809
5810 template_homedir = lp.get('template homedir')
5811 self.assertEqual(template_homedir, self.lp.get('template homedir'),
5812 'template homedir was not unapplied')
5813 apply_group_policies = lp.get('apply group policies')
5814 self.assertEqual(apply_group_policies, self.lp.get('apply group policies'),
5815 'apply group policies was not unapplied')
5816 ldap_timeout = lp.get('ldap timeout')
5817 self.assertEqual(ldap_timeout, self.lp.get('ldap timeout'),
5818 'ldap timeout was not unapplied')
5819
5820 # Unstage the Registry.pol file
5821 unstage_file(reg_pol)
5822
5823 def test_gp_motd(self):
5824 local_path = self.lp.cache_path('gpo_cache')
5825 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5826 reg_pol = os.path.join(local_path, policies, guid,
5827 'MACHINE/REGISTRY.POL')
5828 cache_dir = self.lp.get('cache directory')
5829 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5830
5831 machine_creds = Credentials()
5832 machine_creds.guess(self.lp)
5833 machine_creds.set_machine_account()
5834
5835 # Initialize the group policy extension
5836 ext = gp_msgs_ext(self.lp, machine_creds,
5837 machine_creds.get_username(), store)
5838
5839 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5840 machine_creds.get_username())
5841
5842 # Stage the Registry.pol file with test data
5843 stage = preg.file()
5844 e1 = preg.entry()
5845 e1.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5846 e1.valuename = b'motd'
5847 e1.type = 1
5848 e1.data = b'Have a lot of fun!'
5849 stage.num_entries = 2
5850 e2 = preg.entry()
5851 e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5852 e2.valuename = b'issue'
5853 e2.type = 1
5854 e2.data = b'Welcome to \\s \\r \\l'
5855 stage.entries = [e1, e2]
5856 ret = stage_file(reg_pol, ndr_pack(stage))
5857 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5858
5859 # Process all gpos, with temp output directory
5860 with TemporaryDirectory() as dname:
5861 ext.process_group_policy([], gpos, dname)
5862 motd_file = os.path.join(dname, 'motd')
5863 self.assertTrue(os.path.exists(motd_file),
5864 'Message of the day file not created')
5865 data = open(motd_file, 'r').read()
5866 self.assertEqual(data, e1.data, 'Message of the day not applied')
5867 issue_file = os.path.join(dname, 'issue')
5868 self.assertTrue(os.path.exists(issue_file),
5869 'Login Prompt Message file not created')
5870 data = open(issue_file, 'r').read()
5871 self.assertEqual(data, e2.data, 'Login Prompt Message not applied')
5872
5873 # Check that a call to gpupdate --rsop also succeeds
5874 ret = rsop(self.lp)
5875 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5876
5877 # Unapply policy, and ensure the test files are removed
5878 gp_db = store.get_gplog(machine_creds.get_username())
5879 del_gpos = get_deleted_gpos_list(gp_db, [])
5880 ext.process_group_policy(del_gpos, [], dname)
5881 data = open(motd_file, 'r').read()
5882 self.assertFalse(data, 'Message of the day file not removed')
5883 data = open(issue_file, 'r').read()
5884 self.assertFalse(data, 'Login Prompt Message file not removed')
5885
5886 # Unstage the Registry.pol file
5887 unstage_file(reg_pol)
5888
5889 def test_vgp_symlink(self):
5890 local_path = self.lp.cache_path('gpo_cache')
5891 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5892 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5893 'VGP/VTLA/UNIX/SYMLINK/MANIFEST.XML')
5894 cache_dir = self.lp.get('cache directory')
5895 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5896
5897 machine_creds = Credentials()
5898 machine_creds.guess(self.lp)
5899 machine_creds.set_machine_account()
5900
5901 # Initialize the group policy extension
5902 ext = vgp_symlink_ext(self.lp, machine_creds,
5903 machine_creds.get_username(), store)
5904
5905 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5906 machine_creds.get_username())
5907
5908 with TemporaryDirectory() as dname:
5909 test_source = os.path.join(dname, 'test.source')
5910 test_target = os.path.join(dname, 'test.target')
5911
5912 # Stage the manifest.xml file with test data
5913 stage = etree.Element('vgppolicy')
5914 policysetting = etree.Element('policysetting')
5915 stage.append(policysetting)
5916 version = etree.Element('version')
5917 version.text = '1'
5918 policysetting.append(version)
5919 data = etree.Element('data')
5920 file_properties = etree.Element('file_properties')
5921 source = etree.Element('source')
5922 source.text = test_source
5923 file_properties.append(source)
5924 target = etree.Element('target')
5925 target.text = test_target
5926 file_properties.append(target)
5927 data.append(file_properties)
5928 policysetting.append(data)
5929 ret = stage_file(manifest, etree.tostring(stage))
5930 self.assertTrue(ret, 'Could not create the target %s' % manifest)
5931
5932 # Create test source
5933 test_source_data = 'hello world!'
5934 with open(test_source, 'w') as w:
5935 w.write(test_source_data)
5936
5937 # Process all gpos, with temp output directory
5938 ext.process_group_policy([], gpos)
5939 self.assertTrue(os.path.exists(test_target),
5940 'The test symlink was not created')
5941 self.assertTrue(os.path.islink(test_target),
5942 'The test file is not a symlink')
5943 self.assertIn(test_source_data, open(test_target, 'r').read(),
5944 'Reading from symlink does not produce source data')
5945
5946 # Unapply the policy, ensure removal
5947 gp_db = store.get_gplog(machine_creds.get_username())
5948 del_gpos = get_deleted_gpos_list(gp_db, [])
5949 ext.process_group_policy(del_gpos, [])
5950 self.assertFalse(os.path.exists(test_target),
5951 'The test symlink was not delete')
5952
5953 # Verify RSOP
5954 ret = ext.rsop([g for g in gpos if g.name == guid][0])
5955 self.assertIn('ln -s %s %s' % (test_source, test_target),
5956 list(ret.values())[0])
5957
5958 # Check that a call to gpupdate --rsop also succeeds
5959 ret = rsop(self.lp)
5960 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
5961
5962 # Unstage the manifest.xml file
5963 unstage_file(manifest)
5964
5965 def test_vgp_files(self):
5966 local_path = self.lp.cache_path('gpo_cache')
5967 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5968 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5969 'VGP/VTLA/UNIX/FILES/MANIFEST.XML')
5970 source_file = os.path.join(os.path.dirname(manifest), 'TEST.SOURCE')
5971 source_data = '#!/bin/sh\necho hello world'
5972 ret = stage_file(source_file, source_data)
5973 self.assertTrue(ret, 'Could not create the target %s' % source_file)
5974 cache_dir = self.lp.get('cache directory')
5975 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5976
5977 machine_creds = Credentials()
5978 machine_creds.guess(self.lp)
5979 machine_creds.set_machine_account()
5980
5981 # Initialize the group policy extension
5982 ext = vgp_files_ext(self.lp, machine_creds,
5983 machine_creds.get_username(), store)
5984
5985 gpos = get_gpo_list(self.server, machine_creds, self.lp,
5986 machine_creds.get_username())
5987
5988 # Stage the manifest.xml file with test data
5989 with TemporaryDirectory() as dname:
5990 stage = etree.Element('vgppolicy')
5991 policysetting = etree.Element('policysetting')
5992 stage.append(policysetting)
5993 version = etree.Element('version')
5994 version.text = '1'
5995 policysetting.append(version)
5996 data = etree.Element('data')
5997 file_properties = etree.SubElement(data, 'file_properties')
5998 source = etree.SubElement(file_properties, 'source')
5999 source.text = os.path.basename(source_file).lower()
6000 target = etree.SubElement(file_properties, 'target')
6001 target.text = os.path.join(dname, 'test.target')
6002 user = etree.SubElement(file_properties, 'user')
6003 user.text = pwd.getpwuid(os.getuid()).pw_name
6004 group = etree.SubElement(file_properties, 'group')
6005 group.text = grp.getgrgid(os.getgid()).gr_name
6006 # Request permissions of 755
6007 permissions = etree.SubElement(file_properties, 'permissions')
6008 permissions.set('type', 'user')
6009 etree.SubElement(permissions, 'read')
6010 etree.SubElement(permissions, 'write')
6011 etree.SubElement(permissions, 'execute')
6012 permissions = etree.SubElement(file_properties, 'permissions')
6013 permissions.set('type', 'group')
6014 etree.SubElement(permissions, 'read')
6015 etree.SubElement(permissions, 'execute')
6016 permissions = etree.SubElement(file_properties, 'permissions')
6017 permissions.set('type', 'other')
6018 etree.SubElement(permissions, 'read')
6019 etree.SubElement(permissions, 'execute')
6020 policysetting.append(data)
6021 ret = stage_file(manifest, etree.tostring(stage))
6022 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6023
6024 # Process all gpos, with temp output directory
6025 ext.process_group_policy([], gpos)
6026 self.assertTrue(os.path.exists(target.text),
6027 'The target file does not exist')
6028 self.assertEqual(os.stat(target.text).st_mode & 0o777, 0o755,
6029 'The target file permissions are incorrect')
6030 self.assertEqual(open(target.text).read(), source_data,
6031 'The target file contents are incorrect')
6032
6033 # Remove policy
6034 gp_db = store.get_gplog(machine_creds.get_username())
6035 del_gpos = get_deleted_gpos_list(gp_db, [])
6036 ext.process_group_policy(del_gpos, [])
6037 self.assertFalse(os.path.exists(target.text),
6038 'The target file was not removed')
6039
6040 # Test rsop
6041 g = [g for g in gpos if g.name == guid][0]
6042 ret = ext.rsop(g)
6043 self.assertIn(target.text, list(ret.values())[0][0],
6044 'The target file was not listed by rsop')
6045 self.assertIn('-rwxr-xr-x', list(ret.values())[0][0],
6046 'The target permissions were not listed by rsop')
6047
6048 # Check that a call to gpupdate --rsop also succeeds
6049 ret = rsop(self.lp)
6050 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6051
6052 # Unstage the manifest and source files
6053 unstage_file(manifest)
6054 unstage_file(source_file)
6055
6056 def test_vgp_openssh(self):
6057 local_path = self.lp.cache_path('gpo_cache')
6058 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6059 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6060 'VGP/VTLA/SSHCFG/SSHD/MANIFEST.XML')
6061 cache_dir = self.lp.get('cache directory')
6062 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6063
6064 machine_creds = Credentials()
6065 machine_creds.guess(self.lp)
6066 machine_creds.set_machine_account()
6067
6068 # Initialize the group policy extension
6069 ext = vgp_openssh_ext(self.lp, machine_creds,
6070 machine_creds.get_username(), store)
6071
6072 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6073 machine_creds.get_username())
6074
6075 # Stage the manifest.xml file with test data
6076 stage = etree.Element('vgppolicy')
6077 policysetting = etree.Element('policysetting')
6078 stage.append(policysetting)
6079 version = etree.Element('version')
6080 version.text = '1'
6081 policysetting.append(version)
6082 data = etree.Element('data')
6083 configfile = etree.Element('configfile')
6084 configsection = etree.Element('configsection')
6085 sectionname = etree.Element('sectionname')
6086 configsection.append(sectionname)
6087 kvpair = etree.Element('keyvaluepair')
6088 key = etree.Element('key')
6089 key.text = 'AddressFamily'
6090 kvpair.append(key)
6091 value = etree.Element('value')
6092 value.text = 'inet6'
6093 kvpair.append(value)
6094 configsection.append(kvpair)
6095 configfile.append(configsection)
6096 data.append(configfile)
6097 policysetting.append(data)
6098 ret = stage_file(manifest, etree.tostring(stage))
6099 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6100
6101 # Process all gpos, with temp output directory
6102 data = 'AddressFamily inet6'
6103 with TemporaryDirectory() as dname:
6104 ext.process_group_policy([], gpos, dname)
6105 conf = os.listdir(dname)
6106 self.assertEqual(len(conf), 1, 'The conf file was not created')
6107 gp_cfg = os.path.join(dname, conf[0])
6108 self.assertIn(data, open(gp_cfg, 'r').read(),
6109 'The sshd_config entry was not applied')
6110
6111 # Check that a call to gpupdate --rsop also succeeds
6112 ret = rsop(self.lp)
6113 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6114
6115 # Remove policy
6116 gp_db = store.get_gplog(machine_creds.get_username())
6117 del_gpos = get_deleted_gpos_list(gp_db, [])
6118 ext.process_group_policy(del_gpos, [], dname)
6119 self.assertFalse(os.path.exists(gp_cfg),
6120 'Unapply failed to cleanup config')
6121
6122 # Unstage the Registry.pol file
6123 unstage_file(manifest)
6124
6125 def test_vgp_startup_scripts(self):
6126 local_path = self.lp.cache_path('gpo_cache')
6127 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6128 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6129 'VGP/VTLA/UNIX/SCRIPTS/STARTUP/MANIFEST.XML')
6130 test_script = os.path.join(os.path.dirname(manifest), 'TEST.SH')
6131 test_data = '#!/bin/sh\necho $@ hello world'
6132 ret = stage_file(test_script, test_data)
6133 self.assertTrue(ret, 'Could not create the target %s' % test_script)
6134 cache_dir = self.lp.get('cache directory')
6135 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6136
6137 machine_creds = Credentials()
6138 machine_creds.guess(self.lp)
6139 machine_creds.set_machine_account()
6140
6141 # Initialize the group policy extension
6142 ext = vgp_startup_scripts_ext(self.lp, machine_creds,
6143 machine_creds.get_username(), store)
6144
6145 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6146 machine_creds.get_username())
6147
6148 # Stage the manifest.xml file with test data
6149 stage = etree.Element('vgppolicy')
6150 policysetting = etree.SubElement(stage, 'policysetting')
6151 version = etree.SubElement(policysetting, 'version')
6152 version.text = '1'
6153 data = etree.SubElement(policysetting, 'data')
6154 listelement = etree.SubElement(data, 'listelement')
6155 script = etree.SubElement(listelement, 'script')
6156 script.text = os.path.basename(test_script).lower()
6157 parameters = etree.SubElement(listelement, 'parameters')
6158 parameters.text = '-n'
6159 hash = etree.SubElement(listelement, 'hash')
6160 hash.text = \
6161 hashlib.md5(open(test_script, 'rb').read()).hexdigest().upper()
6162 run_as = etree.SubElement(listelement, 'run_as')
6163 run_as.text = 'root'
6164 ret = stage_file(manifest, etree.tostring(stage))
6165 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6166
6167 # Process all gpos, with temp output directory
6168 with TemporaryDirectory() as dname:
6169 ext.process_group_policy([], gpos, dname)
6170 files = os.listdir(dname)
6171 self.assertEqual(len(files), 1,
6172 'The target script was not created')
6173 entry = '@reboot %s %s %s' % (run_as.text, test_script,
6174 parameters.text)
6175 self.assertIn(entry,
6176 open(os.path.join(dname, files[0]), 'r').read(),
6177 'The test entry was not found')
6178
6179 # Remove policy
6180 gp_db = store.get_gplog(machine_creds.get_username())
6181 del_gpos = get_deleted_gpos_list(gp_db, [])
6182 ext.process_group_policy(del_gpos, [])
6183 files = os.listdir(dname)
6184 self.assertEqual(len(files), 0,
6185 'The target script was not removed')
6186
6187 # Test rsop
6188 g = [g for g in gpos if g.name == guid][0]
6189 ret = ext.rsop(g)
6190 self.assertIn(entry, list(ret.values())[0][0],
6191 'The target entry was not listed by rsop')
6192
6193 # Check that a call to gpupdate --rsop also succeeds
6194 ret = rsop(self.lp)
6195 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6196
6197 # Unstage the manifest.xml and script files
6198 unstage_file(manifest)
6199
6200 # Stage the manifest.xml file for run once scripts
6201 etree.SubElement(listelement, 'run_once')
6202 run_as.text = pwd.getpwuid(os.getuid()).pw_name
6203 ret = stage_file(manifest, etree.tostring(stage))
6204 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6205
6206 # Process all gpos, with temp output directory
6207 # A run once script will be executed immediately,
6208 # instead of creating a cron job
6209 with TemporaryDirectory() as dname:
6210 test_file = '%s/TESTING.txt' % dname
6211 test_data = '#!/bin/sh\ntouch %s' % test_file
6212 ret = stage_file(test_script, test_data)
6213 self.assertTrue(ret, 'Could not create the target %s' % test_script)
6214
6215 ext.process_group_policy([], gpos, dname)
6216 files = os.listdir(dname)
6217 self.assertEqual(len(files), 1,
6218 'The test file was not created')
6219 self.assertEqual(files[0], os.path.basename(test_file),
6220 'The test file was not created')
6221
6222 # Unlink the test file and ensure that processing
6223 # policy again does not recreate it.
6224 os.unlink(test_file)
6225 ext.process_group_policy([], gpos, dname)
6226 files = os.listdir(dname)
6227 self.assertEqual(len(files), 0,
6228 'The test file should not have been created')
6229
6230 # Remove policy
6231 gp_db = store.get_gplog(machine_creds.get_username())
6232 del_gpos = get_deleted_gpos_list(gp_db, [])
6233 ext.process_group_policy(del_gpos, [])
6234
6235 # Test rsop
6236 entry = 'Run once as: %s `%s %s`' % (run_as.text, test_script,
6237 parameters.text)
6238 g = [g for g in gpos if g.name == guid][0]
6239 ret = ext.rsop(g)
6240 self.assertIn(entry, list(ret.values())[0][0],
6241 'The target entry was not listed by rsop')
6242
6243 # Check that a call to gpupdate --rsop also succeeds
6244 ret = rsop(self.lp)
6245 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6246
6247 # Unstage the manifest.xml and script files
6248 unstage_file(manifest)
6249
6250 # Stage the manifest.xml file for a script without parameters
6251 stage = etree.Element('vgppolicy')
6252 policysetting = etree.SubElement(stage, 'policysetting')
6253 version = etree.SubElement(policysetting, 'version')
6254 version.text = '1'
6255 data = etree.SubElement(policysetting, 'data')
6256 listelement = etree.SubElement(data, 'listelement')
6257 script = etree.SubElement(listelement, 'script')
6258 script.text = os.path.basename(test_script).lower()
6259 hash = etree.SubElement(listelement, 'hash')
6260 hash.text = \
6261 hashlib.md5(open(test_script, 'rb').read()).hexdigest().upper()
6262 run_as = etree.SubElement(listelement, 'run_as')
6263 run_as.text = 'root'
6264 ret = stage_file(manifest, etree.tostring(stage))
6265 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6266
6267 # Process all gpos, with temp output directory
6268 with TemporaryDirectory() as dname:
6269 try:
6270 ext.process_group_policy([], gpos, dname)
6271 except Exception as e:
6272 self.fail(str(e))
6273 files = os.listdir(dname)
6274 self.assertEqual(len(files), 1,
6275 'The target script was not created')
6276 entry = '@reboot %s %s' % (run_as.text, test_script)
6277 self.assertIn(entry,
6278 open(os.path.join(dname, files[0]), 'r').read(),
6279 'The test entry was not found')
6280
6281 # Remove policy
6282 gp_db = store.get_gplog(machine_creds.get_username())
6283 del_gpos = get_deleted_gpos_list(gp_db, [])
6284 ext.process_group_policy(del_gpos, [])
6285 files = os.listdir(dname)
6286 self.assertEqual(len(files), 0,
6287 'The target script was not removed')
6288
6289 # Test rsop
6290 g = [g for g in gpos if g.name == guid][0]
6291 ret = ext.rsop(g)
6292 self.assertIn(entry, list(ret.values())[0][0],
6293 'The target entry was not listed by rsop')
6294
6295 # Check that a call to gpupdate --rsop also succeeds
6296 ret = rsop(self.lp)
6297 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6298
6299 # Unstage the manifest.xml and script files
6300 unstage_file(manifest)
6301 unstage_file(test_script)
6302
6303 def test_vgp_motd(self):
6304 local_path = self.lp.cache_path('gpo_cache')
6305 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6306 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6307 'VGP/VTLA/UNIX/MOTD/MANIFEST.XML')
6308 cache_dir = self.lp.get('cache directory')
6309 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6310
6311 machine_creds = Credentials()
6312 machine_creds.guess(self.lp)
6313 machine_creds.set_machine_account()
6314
6315 # Initialize the group policy extension
6316 ext = vgp_motd_ext(self.lp, machine_creds,
6317 machine_creds.get_username(), store)
6318
6319 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6320 machine_creds.get_username())
6321
6322 # Stage the manifest.xml file with test data
6323 stage = etree.Element('vgppolicy')
6324 policysetting = etree.SubElement(stage, 'policysetting')
6325 version = etree.SubElement(policysetting, 'version')
6326 version.text = '1'
6327 data = etree.SubElement(policysetting, 'data')
6328 filename = etree.SubElement(data, 'filename')
6329 filename.text = 'motd'
6330 text = etree.SubElement(data, 'text')
6331 text.text = 'This is the message of the day'
6332 ret = stage_file(manifest, etree.tostring(stage))
6333 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6334
6335 # Process all gpos, with temp output directory
6336 with NamedTemporaryFile() as f:
6337 ext.process_group_policy([], gpos, f.name)
6338 self.assertEqual(open(f.name, 'r').read(), text.text,
6339 'The motd was not applied')
6340
6341 # Check that a call to gpupdate --rsop also succeeds
6342 ret = rsop(self.lp)
6343 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6344
6345 # Remove policy
6346 gp_db = store.get_gplog(machine_creds.get_username())
6347 del_gpos = get_deleted_gpos_list(gp_db, [])
6348 ext.process_group_policy(del_gpos, [], f.name)
6349 self.assertNotEqual(open(f.name, 'r').read(), text.text,
6350 'The motd was not unapplied')
6351
6352 # Unstage the Registry.pol file
6353 unstage_file(manifest)
6354
6355 def test_vgp_issue(self):
6356 local_path = self.lp.cache_path('gpo_cache')
6357 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6358 manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6359 'VGP/VTLA/UNIX/ISSUE/MANIFEST.XML')
6360 cache_dir = self.lp.get('cache directory')
6361 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6362
6363 machine_creds = Credentials()
6364 machine_creds.guess(self.lp)
6365 machine_creds.set_machine_account()
6366
6367 # Initialize the group policy extension
6368 ext = vgp_issue_ext(self.lp, machine_creds,
6369 machine_creds.get_username(), store)
6370
6371 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6372 machine_creds.get_username())
6373
6374 # Stage the manifest.xml file with test data
6375 stage = etree.Element('vgppolicy')
6376 policysetting = etree.SubElement(stage, 'policysetting')
6377 version = etree.SubElement(policysetting, 'version')
6378 version.text = '1'
6379 data = etree.SubElement(policysetting, 'data')
6380 filename = etree.SubElement(data, 'filename')
6381 filename.text = 'issue'
6382 text = etree.SubElement(data, 'text')
6383 text.text = 'Welcome to Samba!'
6384 ret = stage_file(manifest, etree.tostring(stage))
6385 self.assertTrue(ret, 'Could not create the target %s' % manifest)
6386
6387 # Process all gpos, with temp output directory
6388 with NamedTemporaryFile() as f:
6389 ext.process_group_policy([], gpos, f.name)
6390 self.assertEqual(open(f.name, 'r').read(), text.text,
6391 'The issue was not applied')
6392
6393 # Check that a call to gpupdate --rsop also succeeds
6394 ret = rsop(self.lp)
6395 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6396
6397 # Remove policy
6398 gp_db = store.get_gplog(machine_creds.get_username())
6399 del_gpos = get_deleted_gpos_list(gp_db, [])
6400 ext.process_group_policy(del_gpos, [], f.name)
6401 self.assertNotEqual(open(f.name, 'r').read(), text.text,
6402 'The issue was not unapplied')
6403
6404 # Unstage the manifest.xml file
6405 unstage_file(manifest)
6406
6407 def test_vgp_access(self):
6408 local_path = self.lp.cache_path('gpo_cache')
6409 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6410 allow = os.path.join(local_path, policies, guid, 'MACHINE',
6411 'VGP/VTLA/VAS/HOSTACCESSCONTROL/ALLOW/MANIFEST.XML')
6412 deny = os.path.join(local_path, policies, guid, 'MACHINE',
6413 'VGP/VTLA/VAS/HOSTACCESSCONTROL/DENY/MANIFEST.XML')
6414 cache_dir = self.lp.get('cache directory')
6415 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6416
6417 machine_creds = Credentials()
6418 machine_creds.guess(self.lp)
6419 machine_creds.set_machine_account()
6420
6421 # Initialize the group policy extension
6422 winbind_sep = self.lp.get('winbind separator')
6423 self.addCleanup(self.lp.set, 'winbind separator', winbind_sep)
6424 self.lp.set('winbind separator', '+')
6425 ext = vgp_access_ext(self.lp, machine_creds,
6426 machine_creds.get_username(), store)
6427
6428 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6429 machine_creds.get_username())
6430
6431 # Stage the manifest.xml allow file
6432 stage = etree.Element('vgppolicy')
6433 policysetting = etree.SubElement(stage, 'policysetting')
6434 version = etree.SubElement(policysetting, 'version')
6435 version.text = '2'
6436 apply_mode = etree.SubElement(policysetting, 'apply_mode')
6437 apply_mode.text = 'merge'
6438 data = etree.SubElement(policysetting, 'data')
6439 # Add an allowed user
6440 listelement = etree.SubElement(data, 'listelement')
6441 otype = etree.SubElement(listelement, 'type')
6442 otype.text = 'USER'
6443 entry = etree.SubElement(listelement, 'entry')
6444 entry.text = 'goodguy@%s' % realm
6445 adobject = etree.SubElement(listelement, 'adobject')
6446 name = etree.SubElement(adobject, 'name')
6447 name.text = 'goodguy'
6448 domain = etree.SubElement(adobject, 'domain')
6449 domain.text = realm
6450 otype = etree.SubElement(adobject, 'type')
6451 otype.text = 'user'
6452 # Add an allowed group
6453 groupattr = etree.SubElement(data, 'groupattr')
6454 groupattr.text = 'samAccountName'
6455 listelement = etree.SubElement(data, 'listelement')
6456 otype = etree.SubElement(listelement, 'type')
6457 otype.text = 'GROUP'
6458 entry = etree.SubElement(listelement, 'entry')
6459 entry.text = '%s\\goodguys' % realm
6460 dn = etree.SubElement(listelement, 'dn')
6461 dn.text = 'CN=goodguys,CN=Users,%s' % base_dn
6462 adobject = etree.SubElement(listelement, 'adobject')
6463 name = etree.SubElement(adobject, 'name')
6464 name.text = 'goodguys'
6465 domain = etree.SubElement(adobject, 'domain')
6466 domain.text = realm
6467 otype = etree.SubElement(adobject, 'type')
6468 otype.text = 'group'
6469 ret = stage_file(allow, etree.tostring(stage))
6470 self.assertTrue(ret, 'Could not create the target %s' % allow)
6471
6472 # Stage the manifest.xml deny file
6473 stage = etree.Element('vgppolicy')
6474 policysetting = etree.SubElement(stage, 'policysetting')
6475 version = etree.SubElement(policysetting, 'version')
6476 version.text = '2'
6477 apply_mode = etree.SubElement(policysetting, 'apply_mode')
6478 apply_mode.text = 'merge'
6479 data = etree.SubElement(policysetting, 'data')
6480 # Add a denied user
6481 listelement = etree.SubElement(data, 'listelement')
6482 otype = etree.SubElement(listelement, 'type')
6483 otype.text = 'USER'
6484 entry = etree.SubElement(listelement, 'entry')
6485 entry.text = 'badguy@%s' % realm
6486 adobject = etree.SubElement(listelement, 'adobject')
6487 name = etree.SubElement(adobject, 'name')
6488 name.text = 'badguy'
6489 domain = etree.SubElement(adobject, 'domain')
6490 domain.text = realm
6491 otype = etree.SubElement(adobject, 'type')
6492 otype.text = 'user'
6493 # Add a denied group
6494 groupattr = etree.SubElement(data, 'groupattr')
6495 groupattr.text = 'samAccountName'
6496 listelement = etree.SubElement(data, 'listelement')
6497 otype = etree.SubElement(listelement, 'type')
6498 otype.text = 'GROUP'
6499 entry = etree.SubElement(listelement, 'entry')
6500 entry.text = '%s\\badguys' % realm
6501 dn = etree.SubElement(listelement, 'dn')
6502 dn.text = 'CN=badguys,CN=Users,%s' % base_dn
6503 adobject = etree.SubElement(listelement, 'adobject')
6504 name = etree.SubElement(adobject, 'name')
6505 name.text = 'badguys'
6506 domain = etree.SubElement(adobject, 'domain')
6507 domain.text = realm
6508 otype = etree.SubElement(adobject, 'type')
6509 otype.text = 'group'
6510 ret = stage_file(deny, etree.tostring(stage))
6511 self.assertTrue(ret, 'Could not create the target %s' % deny)
6512
6513 # Process all gpos, with temp output directory
6514 with TemporaryDirectory() as dname:
6515 ext.process_group_policy([], gpos, dname)
6516 conf = os.listdir(dname)
6517 # There will be 2 files, the policy file and the deny file
6518 self.assertEqual(len(conf), 2, 'The conf file was not created')
6519 # Ignore the DENY_ALL conf file
6520 gp_cfg = os.path.join(dname,
6521 [c for c in conf if '_gp_DENY_ALL.conf' not in c][0])
6522
6523 # Check the access config for the correct access.conf entries
6524 print('Config file %s found' % gp_cfg)
6525 data = open(gp_cfg, 'r').read()
6526 self.assertIn('+:%s+goodguy:ALL' % realm, data)
6527 self.assertIn('+:%s+goodguys:ALL' % realm, data)
6528 self.assertIn('-:%s+badguy:ALL' % realm, data)
6529 self.assertIn('-:%s+badguys:ALL' % realm, data)
6530
6531 # Check that a call to gpupdate --rsop also succeeds
6532 ret = rsop(self.lp)
6533 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6534
6535 # Remove policy
6536 gp_db = store.get_gplog(machine_creds.get_username())
6537 del_gpos = get_deleted_gpos_list(gp_db, [])
6538 ext.process_group_policy(del_gpos, [], dname)
6539 self.assertFalse(os.path.exists(gp_cfg),
6540 'Unapply failed to cleanup config')
6541
6542 # Unstage the manifest.pol files
6543 unstage_file(allow)
6544 unstage_file(deny)
6545
6546 def test_gnome_settings(self):
6547 local_path = self.lp.cache_path('gpo_cache')
6548 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6549 reg_pol = os.path.join(local_path, policies, guid,
6550 'MACHINE/REGISTRY.POL')
6551 cache_dir = self.lp.get('cache directory')
6552 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6553
6554 machine_creds = Credentials()
6555 machine_creds.guess(self.lp)
6556 machine_creds.set_machine_account()
6557
6558 # Initialize the group policy extension
6559 ext = gp_gnome_settings_ext(self.lp, machine_creds,
6560 machine_creds.get_username(), store)
6561
6562 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6563 machine_creds.get_username())
6564
6565 # Stage the Registry.pol file with test data
6566 parser = GPPolParser()
6567 parser.load_xml(etree.fromstring(gnome_test_reg_pol.strip()))
6568 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6569 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6570
6571 with TemporaryDirectory() as dname:
6572 ext.process_group_policy([], gpos, dname)
6573
6574 local_db = os.path.join(dname, 'etc/dconf/db/local.d')
6575 self.assertTrue(os.path.isdir(local_db),
6576 'Local db dir not created')
6577 def db_check(name, data, count=1):
6578 db = glob(os.path.join(local_db, '*-%s' % name))
6579 self.assertEqual(len(db), count, '%s not created' % name)
6580 file_contents = ConfigParser()
6581 file_contents.read(db)
6582 for key in data.keys():
6583 self.assertTrue(file_contents.has_section(key),
6584 'Section %s not found' % key)
6585 options = data[key]
6586 for k, v in options.items():
6587 v_content = file_contents.get(key, k)
6588 self.assertEqual(v_content, v,
6589 '%s: %s != %s' % (key, v_content, v))
6590
6591 def del_db_check(name):
6592 db = glob(os.path.join(local_db, '*-%s' % name))
6593 self.assertEqual(len(db), 0, '%s not deleted' % name)
6594
6595 locks = os.path.join(local_db, 'locks')
6596 self.assertTrue(os.path.isdir(local_db), 'Locks dir not created')
6597 def lock_check(name, items, count=1):
6598 lock = glob(os.path.join(locks, '*%s' % name))
6599 self.assertEqual(len(lock), count,
6600 '%s lock not created' % name)
6601 file_contents = []
6602 for i in range(count):
6603 file_contents.extend(open(lock[i], 'r').read().split('\n'))
6604 for data in items:
6605 self.assertIn(data, file_contents,
6606 '%s lock not created' % data)
6607
6608 def del_lock_check(name):
6609 lock = glob(os.path.join(locks, '*%s' % name))
6610 self.assertEqual(len(lock), 0, '%s lock not deleted' % name)
6611
6612 # Check the user profile
6613 user_profile = os.path.join(dname, 'etc/dconf/profile/user')
6614 self.assertTrue(os.path.exists(user_profile),
6615 'User profile not created')
6616
6617 # Enable the compose key
6618 data = { 'org/gnome/desktop/input-sources':
6619 { 'xkb-options': '[\'compose:ralt\']' }
6620 }
6621 db_check('input-sources', data)
6622 items = ['/org/gnome/desktop/input-sources/xkb-options']
6623 lock_check('input-sources', items)
6624
6625 # Dim screen when user is idle
6626 data = { 'org/gnome/settings-daemon/plugins/power':
6627 { 'idle-dim': 'true',
6628 'idle-brightness': '30'
6629 }
6630 }
6631 db_check('power', data)
6632 data = { 'org/gnome/desktop/session':
6633 { 'idle-delay': 'uint32 300' }
6634 }
6635 db_check('session', data)
6636 items = ['/org/gnome/settings-daemon/plugins/power/idle-dim',
6637 '/org/gnome/settings-daemon/plugins/power/idle-brightness',
6638 '/org/gnome/desktop/session/idle-delay']
6639 lock_check('power-saving', items)
6640
6641 # Lock down specific settings
6642 bg_locks = ['/org/gnome/desktop/background/picture-uri',
6643 '/org/gnome/desktop/background/picture-options',
6644 '/org/gnome/desktop/background/primary-color',
6645 '/org/gnome/desktop/background/secondary-color']
6646 lock_check('group-policy', bg_locks)
6647
6648 # Lock down enabled extensions
6649 data = { 'org/gnome/shell':
6650 { 'enabled-extensions':
6651 '[\'myextension1@myname.example.com\', \'myextension2@myname.example.com\']',
6652 'development-tools': 'false' }
6653 }
6654 db_check('extensions', data)
6655 items = [ '/org/gnome/shell/enabled-extensions',
6656 '/org/gnome/shell/development-tools' ]
6657 lock_check('extensions', items)
6658
6659 # Disallow login using a fingerprint
6660 data = { 'org/gnome/login-screen':
6661 { 'enable-fingerprint-authentication': 'false' }
6662 }
6663 db_check('fingerprintreader', data)
6664 items = ['/org/gnome/login-screen/enable-fingerprint-authentication']
6665 lock_check('fingerprintreader', items)
6666
6667 # Disable user logout and user switching
6668 data = { 'org/gnome/desktop/lockdown':
6669 { 'disable-log-out': 'true',
6670 'disable-user-switching': 'true' }
6671 }
6672 db_check('logout', data, 2)
6673 items = ['/org/gnome/desktop/lockdown/disable-log-out',
6674 '/org/gnome/desktop/lockdown/disable-user-switching']
6675 lock_check('logout', items, 2)
6676
6677 # Disable repartitioning
6678 actions = os.path.join(dname, 'etc/share/polkit-1/actions')
6679 udisk2 = glob(os.path.join(actions,
6680 'org.freedesktop.[u|U][d|D]isks2.policy'))
6681 self.assertEqual(len(udisk2), 1, 'udisk2 policy not created')
6682 udisk2_tree = etree.fromstring(open(udisk2[0], 'r').read())
6683 actions = udisk2_tree.findall('action')
6684 md = 'org.freedesktop.udisks2.modify-device'
6685 action = [a for a in actions if a.attrib['id'] == md]
6686 self.assertEqual(len(action), 1, 'modify-device not found')
6687 defaults = action[0].find('defaults')
6688 self.assertTrue(defaults is not None,
6689 'modify-device defaults not found')
6690 allow_any = defaults.find('allow_any').text
6691 self.assertEqual(allow_any, 'no',
6692 'modify-device allow_any not set to no')
6693 allow_inactive = defaults.find('allow_inactive').text
6694 self.assertEqual(allow_inactive, 'no',
6695 'modify-device allow_inactive not set to no')
6696 allow_active = defaults.find('allow_active').text
6697 self.assertEqual(allow_active, 'yes',
6698 'modify-device allow_active not set to yes')
6699
6700 # Disable printing
6701 data = { 'org/gnome/desktop/lockdown':
6702 { 'disable-printing': 'true' }
6703 }
6704 db_check('printing', data)
6705 items = ['/org/gnome/desktop/lockdown/disable-printing']
6706 lock_check('printing', items)
6707
6708 # Disable file saving
6709 data = { 'org/gnome/desktop/lockdown':
6710 { 'disable-save-to-disk': 'true' }
6711 }
6712 db_check('filesaving', data)
6713 items = ['/org/gnome/desktop/lockdown/disable-save-to-disk']
6714 lock_check('filesaving', items)
6715
6716 # Disable command-line access
6717 data = { 'org/gnome/desktop/lockdown':
6718 { 'disable-command-line': 'true' }
6719 }
6720 db_check('cmdline', data)
6721 items = ['/org/gnome/desktop/lockdown/disable-command-line']
6722 lock_check('cmdline', items)
6723
6724 # Allow or disallow online accounts
6725 data = { 'org/gnome/online-accounts':
6726 { 'whitelisted-providers': '[\'google\']' }
6727 }
6728 db_check('goa', data)
6729 items = ['/org/gnome/online-accounts/whitelisted-providers']
6730 lock_check('goa', items)
6731
6732 # Verify RSOP does not fail
6733 ext.rsop([g for g in gpos if g.name == guid][0])
6734
6735 # Check that a call to gpupdate --rsop also succeeds
6736 ret = rsop(self.lp)
6737 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6738
6739 # Remove policy
6740 gp_db = store.get_gplog(machine_creds.get_username())
6741 del_gpos = get_deleted_gpos_list(gp_db, [])
6742 ext.process_group_policy(del_gpos, [], dname)
6743 del_db_check('input-sources')
6744 del_lock_check('input-sources')
6745 del_db_check('power')
6746 del_db_check('session')
6747 del_lock_check('power-saving')
6748 del_lock_check('group-policy')
6749 del_db_check('extensions')
6750 del_lock_check('extensions')
6751 del_db_check('fingerprintreader')
6752 del_lock_check('fingerprintreader')
6753 del_db_check('logout')
6754 del_lock_check('logout')
6755 actions = os.path.join(dname, 'etc/share/polkit-1/actions')
6756 udisk2 = glob(os.path.join(actions,
6757 'org.freedesktop.[u|U][d|D]isks2.policy'))
6758 self.assertEqual(len(udisk2), 0, 'udisk2 policy not deleted')
6759 del_db_check('printing')
6760 del_lock_check('printing')
6761 del_db_check('filesaving')
6762 del_lock_check('filesaving')
6763 del_db_check('cmdline')
6764 del_lock_check('cmdline')
6765 del_db_check('goa')
6766 del_lock_check('goa')
6767
6768 # Unstage the Registry.pol file
6769 unstage_file(reg_pol)
6770
6771 def test_gp_cert_auto_enroll_ext_without_ndes(self):
6772 local_path = self.lp.cache_path('gpo_cache')
6773 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6774 reg_pol = os.path.join(local_path, policies, guid,
6775 'MACHINE/REGISTRY.POL')
6776 cache_dir = self.lp.get('cache directory')
6777 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6778
6779 machine_creds = Credentials()
6780 machine_creds.guess(self.lp)
6781 machine_creds.set_machine_account()
6782
6783 # Initialize the group policy extension
6784 cae.requests = dummy_requests(want_exception=True)
6785 ext = cae.gp_cert_auto_enroll_ext(self.lp, machine_creds,
6786 machine_creds.get_username(), store)
6787
6788 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6789 machine_creds.get_username())
6790
6791 # Stage the Registry.pol file with test data
6792 parser = GPPolParser()
6793 parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip()))
6794 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6795 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6796
6797 # Write the dummy CA entry, Enrollment Services, and Templates Entries
6798 admin_creds = Credentials()
6799 admin_creds.set_username(os.environ.get('DC_USERNAME'))
6800 admin_creds.set_password(os.environ.get('DC_PASSWORD'))
6801 admin_creds.set_realm(os.environ.get('REALM'))
6802 hostname = get_dc_hostname(machine_creds, self.lp)
6803 url = 'ldap://%s' % hostname
6804 ldb = Ldb(url=url, session_info=system_session(),
6805 lp=self.lp, credentials=admin_creds)
6806 # Write the dummy CA
6807 confdn = 'CN=Public Key Services,CN=Services,CN=Configuration,%s' % base_dn
6808 ca_cn = '%s-CA' % hostname.replace('.', '-')
6809 certa_dn = 'CN=%s,CN=Certification Authorities,%s' % (ca_cn, confdn)
6810 ldb.add({'dn': certa_dn,
6811 'objectClass': 'certificationAuthority',
6812 'authorityRevocationList': ['XXX'],
6813 'cACertificate': dummy_certificate(),
6814 'certificateRevocationList': ['XXX'],
6815 })
6816 # Write the dummy pKIEnrollmentService
6817 enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn)
6818 ldb.add({'dn': enroll_dn,
6819 'objectClass': 'pKIEnrollmentService',
6820 'cACertificate': dummy_certificate(),
6821 'certificateTemplates': ['Machine'],
6822 'dNSHostName': hostname,
6823 })
6824 # Write the dummy pKICertificateTemplate
6825 template_dn = 'CN=Machine,CN=Certificate Templates,%s' % confdn
6826 ldb.add({'dn': template_dn,
6827 'objectClass': 'pKICertificateTemplate',
6828 })
6829
6830 with TemporaryDirectory() as dname:
6831 try:
6832 ext.process_group_policy([], gpos, dname, dname)
6833 except Exception as e:
6834 self.fail(str(e))
6835
6836 ca_crt = os.path.join(dname, '%s.crt' % ca_cn)
6837 self.assertTrue(os.path.exists(ca_crt),
6838 'Root CA certificate was not requested')
6839 machine_crt = os.path.join(dname, '%s.Machine.crt' % ca_cn)
6840 self.assertTrue(os.path.exists(machine_crt),
6841 'Machine certificate was not requested')
6842 machine_key = os.path.join(dname, '%s.Machine.key' % ca_cn)
6843 self.assertTrue(os.path.exists(machine_key),
6844 'Machine key was not generated')
6845
6846 # Verify RSOP does not fail
6847 ext.rsop([g for g in gpos if g.name == guid][0])
6848
6849 # Check that a call to gpupdate --rsop also succeeds
6850 ret = rsop(self.lp)
6851 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6852
6853 # Remove policy
6854 gp_db = store.get_gplog(machine_creds.get_username())
6855 del_gpos = get_deleted_gpos_list(gp_db, [])
6856 ext.process_group_policy(del_gpos, [], dname)
6857 self.assertFalse(os.path.exists(ca_crt),
6858 'Root CA certificate was not removed')
6859 self.assertFalse(os.path.exists(machine_crt),
6860 'Machine certificate was not removed')
6861 self.assertFalse(os.path.exists(machine_key),
6862 'Machine key was not removed')
6863 out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate()
6864 self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed')
6865 out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate()
6866 self.assertNotIn(b'Machine', out,
6867 'Machine certificate not removed')
6868 self.assertNotIn(b'Workstation', out,
6869 'Workstation certificate not removed')
6870
6871 # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate
6872 ldb.delete(certa_dn)
6873 ldb.delete(enroll_dn)
6874 ldb.delete(template_dn)
6875
6876 # Unstage the Registry.pol file
6877 unstage_file(reg_pol)
6878
6879 def test_gp_cert_auto_enroll_ext(self):
6880 local_path = self.lp.cache_path('gpo_cache')
6881 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6882 reg_pol = os.path.join(local_path, policies, guid,
6883 'MACHINE/REGISTRY.POL')
6884 cache_dir = self.lp.get('cache directory')
6885 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6886
6887 machine_creds = Credentials()
6888 machine_creds.guess(self.lp)
6889 machine_creds.set_machine_account()
6890
6891 # Initialize the group policy extension
6892 cae.requests = dummy_requests()
6893 ext = cae.gp_cert_auto_enroll_ext(self.lp, machine_creds,
6894 machine_creds.get_username(), store)
6895
6896 gpos = get_gpo_list(self.server, machine_creds, self.lp,
6897 machine_creds.get_username())
6898
6899 # Stage the Registry.pol file with test data
6900 parser = GPPolParser()
6901 parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip()))
6902 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6903 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6904
6905 # Write the dummy CA entry, Enrollment Services, and Templates Entries
6906 admin_creds = Credentials()
6907 admin_creds.set_username(os.environ.get('DC_USERNAME'))
6908 admin_creds.set_password(os.environ.get('DC_PASSWORD'))
6909 admin_creds.set_realm(os.environ.get('REALM'))
6910 hostname = get_dc_hostname(machine_creds, self.lp)
6911 url = 'ldap://%s' % hostname
6912 ldb = Ldb(url=url, session_info=system_session(),
6913 lp=self.lp, credentials=admin_creds)
6914 # Write the dummy CA
6915 confdn = 'CN=Public Key Services,CN=Services,CN=Configuration,%s' % base_dn
6916 ca_cn = '%s-CA' % hostname.replace('.', '-')
6917 certa_dn = 'CN=%s,CN=Certification Authorities,%s' % (ca_cn, confdn)
6918 ldb.add({'dn': certa_dn,
6919 'objectClass': 'certificationAuthority',
6920 'authorityRevocationList': ['XXX'],
6921 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I',
6922 'certificateRevocationList': ['XXX'],
6923 })
6924 # Write the dummy pKIEnrollmentService
6925 enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn)
6926 ldb.add({'dn': enroll_dn,
6927 'objectClass': 'pKIEnrollmentService',
6928 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I',
6929 'certificateTemplates': ['Machine'],
6930 'dNSHostName': hostname,
6931 })
6932 # Write the dummy pKICertificateTemplate
6933 template_dn = 'CN=Machine,CN=Certificate Templates,%s' % confdn
6934 ldb.add({'dn': template_dn,
6935 'objectClass': 'pKICertificateTemplate',
6936 })
6937
6938 with TemporaryDirectory() as dname:
6939 ext.process_group_policy([], gpos, dname, dname)
6940 ca_crt = os.path.join(dname, '%s.crt' % ca_cn)
6941 self.assertTrue(os.path.exists(ca_crt),
6942 'Root CA certificate was not requested')
6943 machine_crt = os.path.join(dname, '%s.Machine.crt' % ca_cn)
6944 self.assertTrue(os.path.exists(machine_crt),
6945 'Machine certificate was not requested')
6946 machine_key = os.path.join(dname, '%s.Machine.key' % ca_cn)
6947 self.assertTrue(os.path.exists(machine_crt),
6948 'Machine key was not generated')
6949
6950 # Subsequent apply should react to new certificate templates
6951 os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation'
6952 self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES')
6953 ext.process_group_policy([], gpos, dname, dname)
6954 self.assertTrue(os.path.exists(ca_crt),
6955 'Root CA certificate was not requested')
6956 self.assertTrue(os.path.exists(machine_crt),
6957 'Machine certificate was not requested')
6958 self.assertTrue(os.path.exists(machine_crt),
6959 'Machine key was not generated')
6960 workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn)
6961 self.assertTrue(os.path.exists(workstation_crt),
6962 'Workstation certificate was not requested')
6963 workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn)
6964 self.assertTrue(os.path.exists(workstation_crt),
6965 'Workstation key was not generated')
6966
6967 # Verify RSOP does not fail
6968 ext.rsop([g for g in gpos if g.name == guid][0])
6969
6970 # Check that a call to gpupdate --rsop also succeeds
6971 ret = rsop(self.lp)
6972 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
6973
6974 # Remove policy by staging pol file with auto-enroll unchecked
6975 parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip()))
6976 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6977 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6978 ext.process_group_policy([], gpos, dname, dname)
6979 self.assertFalse(os.path.exists(ca_crt),
6980 'Root CA certificate was not removed')
6981 self.assertFalse(os.path.exists(machine_crt),
6982 'Machine certificate was not removed')
6983 self.assertFalse(os.path.exists(machine_crt),
6984 'Machine key was not removed')
6985 self.assertFalse(os.path.exists(workstation_crt),
6986 'Workstation certificate was not removed')
6987 self.assertFalse(os.path.exists(workstation_crt),
6988 'Workstation key was not removed')
6989
6990 # Reapply policy by staging the enabled pol file
6991 parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip()))
6992 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6993 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6994 ext.process_group_policy([], gpos, dname, dname)
6995 self.assertTrue(os.path.exists(ca_crt),
6996 'Root CA certificate was not requested')
6997 self.assertTrue(os.path.exists(machine_crt),
6998 'Machine certificate was not requested')
6999 self.assertTrue(os.path.exists(machine_crt),
7000 'Machine key was not generated')
7001 self.assertTrue(os.path.exists(workstation_crt),
7002 'Workstation certificate was not requested')
7003 self.assertTrue(os.path.exists(workstation_crt),
7004 'Workstation key was not generated')
7005
7006 # Remove policy
7007 gp_db = store.get_gplog(machine_creds.get_username())
7008 del_gpos = get_deleted_gpos_list(gp_db, [])
7009 ext.process_group_policy(del_gpos, [], dname)
7010 self.assertFalse(os.path.exists(ca_crt),
7011 'Root CA certificate was not removed')
7012 self.assertFalse(os.path.exists(machine_crt),
7013 'Machine certificate was not removed')
7014 self.assertFalse(os.path.exists(machine_crt),
7015 'Machine key was not removed')
7016 self.assertFalse(os.path.exists(workstation_crt),
7017 'Workstation certificate was not removed')
7018 self.assertFalse(os.path.exists(workstation_crt),
7019 'Workstation key was not removed')
7020 out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate()
7021 self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed')
7022 out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate()
7023 self.assertNotIn(b'Machine', out,
7024 'Machine certificate not removed')
7025 self.assertNotIn(b'Workstation', out,
7026 'Workstation certificate not removed')
7027
7028 # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate
7029 ldb.delete(certa_dn)
7030 ldb.delete(enroll_dn)
7031 ldb.delete(template_dn)
7032
7033 # Unstage the Registry.pol file
7034 unstage_file(reg_pol)
7035
7036 def test_gp_user_scripts_ext(self):
7037 local_path = self.lp.cache_path('gpo_cache')
7038 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7039 reg_pol = os.path.join(local_path, policies, guid,
7040 'USER/REGISTRY.POL')
7041 cache_dir = self.lp.get('cache directory')
7042 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7043
7044 machine_creds = Credentials()
7045 machine_creds.guess(self.lp)
7046 machine_creds.set_machine_account()
7047
7048 # Initialize the group policy extension
7049 ext = gp_user_scripts_ext(self.lp, machine_creds,
7050 os.environ.get('DC_USERNAME'), store)
7051
7052 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7053 machine_creds.get_username())
7054
7055 reg_key = b'Software\\Policies\\Samba\\Unix Settings'
7056 sections = { b'%s\\Daily Scripts' % reg_key : b'@daily',
7057 b'%s\\Monthly Scripts' % reg_key : b'@monthly',
7058 b'%s\\Weekly Scripts' % reg_key : b'@weekly',
7059 b'%s\\Hourly Scripts' % reg_key : b'@hourly' }
7060 for keyname in sections.keys():
7061 # Stage the Registry.pol file with test data
7062 stage = preg.file()
7063 e = preg.entry()
7064 e.keyname = keyname
7065 e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
7066 e.type = 1
7067 e.data = b'echo hello world'
7068 stage.num_entries = 1
7069 stage.entries = [e]
7070 ret = stage_file(reg_pol, ndr_pack(stage))
7071 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7072
7073 # Process all gpos, intentionally skipping the privilege drop
7074 ext.process_group_policy([], gpos)
7075 # Dump the fake crontab setup for testing
7076 p = Popen(['crontab', '-l'], stdout=PIPE)
7077 crontab, _ = p.communicate()
7078 entry = b'%s %s' % (sections[keyname], e.data.encode())
7079 self.assertIn(entry, crontab,
7080 'The crontab entry was not installed')
7081
7082 # Check that a call to gpupdate --rsop also succeeds
7083 ret = rsop(self.lp)
7084 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7085
7086 # Remove policy
7087 gp_db = store.get_gplog(os.environ.get('DC_USERNAME'))
7088 del_gpos = get_deleted_gpos_list(gp_db, [])
7089 ext.process_group_policy(del_gpos, [])
7090 # Dump the fake crontab setup for testing
7091 p = Popen(['crontab', '-l'], stdout=PIPE)
7092 crontab, _ = p.communicate()
7093 self.assertNotIn(entry, crontab,
7094 'Unapply failed to cleanup crontab entry')
7095
7096 # Unstage the Registry.pol file
7097 unstage_file(reg_pol)
7098
7099 def test_gp_firefox_ext(self):
7100 local_path = self.lp.cache_path('gpo_cache')
7101 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7102 reg_pol = os.path.join(local_path, policies, guid,
7103 'MACHINE/REGISTRY.POL')
7104 cache_dir = self.lp.get('cache directory')
7105 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7106
7107 machine_creds = Credentials()
7108 machine_creds.guess(self.lp)
7109 machine_creds.set_machine_account()
7110
7111 # Initialize the group policy extension
7112 ext = gp_firefox_ext(self.lp, machine_creds,
7113 machine_creds.get_username(), store)
7114
7115 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7116 machine_creds.get_username())
7117
7118 # Stage the Registry.pol file with test data
7119 parser = GPPolParser()
7120 parser.load_xml(etree.fromstring(firefox_reg_pol.strip()))
7121 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7122 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7123
7124 with TemporaryDirectory() as dname:
7125 ext.process_group_policy([], gpos, dname)
7126 policies_file = os.path.join(dname, 'policies.json')
7127 with open(policies_file, 'r') as r:
7128 policy_data = json.load(r)
7129 expected_policy_data = json.loads(firefox_json_expected)
7130 self.assertIn('policies', policy_data, 'Policies were not applied')
7131 self.assertEqual(expected_policy_data['policies'].keys(),
7132 policy_data['policies'].keys(),
7133 'Firefox policies are missing')
7134 for name in expected_policy_data['policies'].keys():
7135 self.assertEqual(expected_policy_data['policies'][name],
7136 policy_data['policies'][name],
7137 'Policies were not applied')
7138
7139 # Verify RSOP does not fail
7140 ext.rsop([g for g in gpos if g.name == guid][0])
7141
7142 # Check that a call to gpupdate --rsop also succeeds
7143 ret = rsop(self.lp)
7144 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7145
7146 # Unapply the policy
7147 gp_db = store.get_gplog(machine_creds.get_username())
7148 del_gpos = get_deleted_gpos_list(gp_db, [])
7149 ext.process_group_policy(del_gpos, [], dname)
7150 if os.path.exists(policies_file):
7151 data = json.load(open(policies_file, 'r'))
7152 if 'policies' in data.keys():
7153 self.assertEqual(len(data['policies'].keys()), 0,
7154 'The policy was not unapplied')
7155
7156 # Unstage the Registry.pol file
7157 unstage_file(reg_pol)
7158
7159 def test_gp_chromium_ext(self):
7160 local_path = self.lp.cache_path('gpo_cache')
7161 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7162 reg_pol = os.path.join(local_path, policies, guid,
7163 'MACHINE/REGISTRY.POL')
7164 cache_dir = self.lp.get('cache directory')
7165 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7166
7167 machine_creds = Credentials()
7168 machine_creds.guess(self.lp)
7169 machine_creds.set_machine_account()
7170
7171 # Initialize the group policy extension
7172 ext = gp_chromium_ext(self.lp, machine_creds,
7173 machine_creds.get_username(), store)
7174
7175 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7176 machine_creds.get_username())
7177
7178 # Stage the Registry.pol file with test data
7179 parser = GPPolParser()
7180 parser.load_xml(etree.fromstring(chromium_reg_pol.strip()))
7181 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7182 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7183
7184 with TemporaryDirectory() as dname:
7185 ext.process_group_policy([], gpos, dname)
7186 managed = os.path.join(dname, 'managed')
7187 managed_files = os.listdir(managed)
7188 self.assertEqual(len(managed_files), 1,
7189 'Chromium policies are missing')
7190 managed_file = os.path.join(managed, managed_files[0])
7191 with open(managed_file, 'r') as r:
7192 managed_data = json.load(r)
7193 recommended = os.path.join(dname, 'recommended')
7194 recommended_files = os.listdir(recommended)
7195 self.assertEqual(len(recommended_files), 1,
7196 'Chromium policies are missing')
7197 recommended_file = os.path.join(recommended, recommended_files[0])
7198 with open(recommended_file, 'r') as r:
7199 recommended_data = json.load(r)
7200 expected_managed_data = json.loads(chromium_json_expected_managed)
7201 expected_recommended_data = \
7202 json.loads(chromium_json_expected_recommended)
7203 self.maxDiff = None
7204 self.assertEqual(sorted(expected_managed_data.keys()),
7205 sorted(managed_data.keys()),
7206 'Chromium policies are missing')
7207 for name in expected_managed_data.keys():
7208 self.assertEqual(expected_managed_data[name],
7209 managed_data[name],
7210 'Policies were not applied')
7211 self.assertEqual(expected_recommended_data.keys(),
7212 recommended_data.keys(),
7213 'Chromium policies are missing')
7214 for name in expected_recommended_data.keys():
7215 self.assertEqual(expected_recommended_data[name],
7216 recommended_data[name],
7217 'Policies were not applied')
7218
7219 # Ensure modifying the policy does not generate extra policy files
7220 unstage_file(reg_pol)
7221 # Change a managed entry:
7222 parser.pol_file.entries[0].data = 0
7223 # Change a recommended entry:
7224 parser.pol_file.entries[-1].data = b'https://google.com'
7225 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7226 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7227
7228 ext.process_group_policy([], gpos, dname)
7229 managed_files = os.listdir(managed)
7230 self.assertEqual(len(managed_files), 1,
7231 'Number of Chromium policies is incorrect')
7232 omanaged_file = managed_file
7233 managed_file = os.path.join(managed, managed_files[0])
7234 self.assertNotEqual(omanaged_file, managed_file,
7235 'The managed Chromium file did not change')
7236
7237 recommended_files = os.listdir(recommended)
7238 self.assertEqual(len(recommended_files), 1,
7239 'Number of Chromium policies is incorrect')
7240 orecommended_file = recommended_file
7241 recommended_file = os.path.join(recommended, recommended_files[0])
7242 self.assertNotEqual(orecommended_file, recommended_file,
7243 'The recommended Chromium file did not change')
7244
7245 # Verify RSOP does not fail
7246 ext.rsop([g for g in gpos if g.name == guid][0])
7247
7248 # Check that a call to gpupdate --rsop also succeeds
7249 ret = rsop(self.lp)
7250 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7251
7252 # Unapply the policy
7253 gp_db = store.get_gplog(machine_creds.get_username())
7254 del_gpos = get_deleted_gpos_list(gp_db, [])
7255 ext.process_group_policy(del_gpos, [], dname)
7256 managed = os.path.join(managed, managed_files[0])
7257 if os.path.exists(managed):
7258 data = json.load(open(managed, 'r'))
7259 self.assertEqual(len(data.keys()), 0,
7260 'The policy was not unapplied')
7261 recommended = os.path.join(recommended, recommended_files[0])
7262 if os.path.exists(recommended):
7263 data = json.load(open(recommended, 'r'))
7264 self.assertEqual(len(data.keys()), 0,
7265 'The policy was not unapplied')
7266
7267 # Unstage the Registry.pol file
7268 unstage_file(reg_pol)
7269
7270 def test_gp_firewalld_ext(self):
7271 local_path = self.lp.cache_path('gpo_cache')
7272 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7273 reg_pol = os.path.join(local_path, policies, guid,
7274 'MACHINE/REGISTRY.POL')
7275 cache_dir = self.lp.get('cache directory')
7276 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7277
7278 machine_creds = Credentials()
7279 machine_creds.guess(self.lp)
7280 machine_creds.set_machine_account()
7281
7282 # Initialize the group policy extension
7283 ext = gp_firewalld_ext(self.lp, machine_creds,
7284 machine_creds.get_username(), store)
7285
7286 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7287 machine_creds.get_username())
7288
7289 # Stage the Registry.pol file with test data
7290 parser = GPPolParser()
7291 parser.load_xml(etree.fromstring(firewalld_reg_pol.strip()))
7292 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7293 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7294
7295 ext.process_group_policy([], gpos)
7296
7297 # Check that the policy was applied
7298 firewall_cmd = which('firewall-cmd')
7299 cmd = [firewall_cmd, '--get-zones']
7300 p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7301 out, err = p.communicate()
7302 self.assertIn(b'work', out, 'Failed to apply zones')
7303 self.assertIn(b'home', out, 'Failed to apply zones')
7304
7305 cmd = [firewall_cmd, '--zone=work', '--list-interfaces']
7306 p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7307 out, err = p.communicate()
7308 self.assertIn(b'eth0', out, 'Failed to set interface on zone')
7309
7310 cmd = [firewall_cmd, '--zone=home', '--list-interfaces']
7311 p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7312 out, err = p.communicate()
7313 self.assertIn(b'eth0', out, 'Failed to set interface on zone')
7314
7315 cmd = [firewall_cmd, '--zone=work', '--list-rich-rules']
7316 p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7317 out, err = p.communicate()
7318 rule = b'rule family=ipv4 source address=172.25.1.7 ' + \
7319 b'service name=ftp reject'
7320 self.assertEqual(rule, out.strip(), 'Failed to set rich rule')
7321
7322 # Verify RSOP does not fail
7323 ext.rsop([g for g in gpos if g.name == guid][0])
7324
7325 # Check that a call to gpupdate --rsop also succeeds
7326 ret = rsop(self.lp)
7327 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7328
7329 # Unapply the policy
7330 gp_db = store.get_gplog(machine_creds.get_username())
7331 del_gpos = get_deleted_gpos_list(gp_db, [])
7332 ext.process_group_policy(del_gpos, [])
7333
7334 # Check that the policy was unapplied
7335 cmd = [firewall_cmd, '--get-zones']
7336 p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7337 out, err = p.communicate()
7338 self.assertNotIn(b'work', out, 'Failed to unapply zones')
7339 self.assertNotIn(b'home', out, 'Failed to unapply zones')
7340
7341 # Unstage the Registry.pol file
7342 unstage_file(reg_pol)
7343
7344 def test_advanced_gp_cert_auto_enroll_ext(self):
7345 local_path = self.lp.cache_path('gpo_cache')
7346 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7347 reg_pol = os.path.join(local_path, policies, guid,
7348 'MACHINE/REGISTRY.POL')
7349 cache_dir = self.lp.get('cache directory')
7350 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7351
7352 machine_creds = Credentials()
7353 machine_creds.guess(self.lp)
7354 machine_creds.set_machine_account()
7355
7356 # Initialize the group policy extension
7357 cae.requests = dummy_requests()
7358 ext = cae.gp_cert_auto_enroll_ext(self.lp, machine_creds,
7359 machine_creds.get_username(), store)
7360
7361 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7362 machine_creds.get_username())
7363
7364 admin_creds = Credentials()
7365 admin_creds.set_username(os.environ.get('DC_USERNAME'))
7366 admin_creds.set_password(os.environ.get('DC_PASSWORD'))
7367 admin_creds.set_realm(os.environ.get('REALM'))
7368 hostname = get_dc_hostname(machine_creds, self.lp)
7369 url = 'ldap://%s' % hostname
7370 ldb = Ldb(url=url, session_info=system_session(),
7371 lp=self.lp, credentials=admin_creds)
7372
7373 # Stage the Registry.pol file with test data
7374 res = ldb.search('', _ldb.SCOPE_BASE, '(objectClass=*)',
7375 ['rootDomainNamingContext'])
7376 self.assertTrue(len(res) == 1, 'rootDomainNamingContext not found')
7377 res2 = ldb.search(res[0]['rootDomainNamingContext'][0],
7378 _ldb.SCOPE_BASE, '(objectClass=*)', ['objectGUID'])
7379 self.assertTrue(len(res2) == 1, 'objectGUID not found')
7380 objectGUID = b'{%s}' % \
7381 cae.octet_string_to_objectGUID(res2[0]['objectGUID'][0]).upper().encode()
7382 parser = GPPolParser()
7383 parser.load_xml(etree.fromstring(advanced_enroll_reg_pol.strip() % \
7384 (objectGUID, objectGUID, objectGUID, objectGUID)))
7385 ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7386 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7387
7388 # Write the dummy CA entry
7389 confdn = 'CN=Public Key Services,CN=Services,CN=Configuration,%s' % base_dn
7390 ca_cn = '%s-CA' % hostname.replace('.', '-')
7391 certa_dn = 'CN=%s,CN=Certification Authorities,%s' % (ca_cn, confdn)
7392 ldb.add({'dn': certa_dn,
7393 'objectClass': 'certificationAuthority',
7394 'authorityRevocationList': ['XXX'],
7395 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I',
7396 'certificateRevocationList': ['XXX'],
7397 })
7398 # Write the dummy pKIEnrollmentService
7399 enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn)
7400 ldb.add({'dn': enroll_dn,
7401 'objectClass': 'pKIEnrollmentService',
7402 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I',
7403 'certificateTemplates': ['Machine'],
7404 'dNSHostName': hostname,
7405 })
7406 # Write the dummy pKICertificateTemplate
7407 template_dn = 'CN=Machine,CN=Certificate Templates,%s' % confdn
7408 ldb.add({'dn': template_dn,
7409 'objectClass': 'pKICertificateTemplate',
7410 })
7411
7412 with TemporaryDirectory() as dname:
7413 ext.process_group_policy([], gpos, dname, dname)
7414 ca_list = [ca_cn, 'example0-com-CA', 'example1-com-CA',
7415 'example2-com-CA']
7416 for ca in ca_list:
7417 ca_crt = os.path.join(dname, '%s.crt' % ca)
7418 self.assertTrue(os.path.exists(ca_crt),
7419 'Root CA certificate was not requested')
7420 machine_crt = os.path.join(dname, '%s.Machine.crt' % ca)
7421 self.assertTrue(os.path.exists(machine_crt),
7422 'Machine certificate was not requested')
7423 machine_key = os.path.join(dname, '%s.Machine.key' % ca)
7424 self.assertTrue(os.path.exists(machine_crt),
7425 'Machine key was not generated')
7426
7427 # Subsequent apply should react to new certificate templates
7428 os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation'
7429 self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES')
7430 ext.process_group_policy([], gpos, dname, dname)
7431 for ca in ca_list:
7432 self.assertTrue(os.path.exists(ca_crt),
7433 'Root CA certificate was not requested')
7434 self.assertTrue(os.path.exists(machine_crt),
7435 'Machine certificate was not requested')
7436 self.assertTrue(os.path.exists(machine_crt),
7437 'Machine key was not generated')
7438
7439 workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca)
7440 self.assertTrue(os.path.exists(workstation_crt),
7441 'Workstation certificate was not requested')
7442 workstation_key = os.path.join(dname, '%s.Workstation.key' % ca)
7443 self.assertTrue(os.path.exists(workstation_crt),
7444 'Workstation key was not generated')
7445
7446 # Verify RSOP does not fail
7447 ext.rsop([g for g in gpos if g.name == guid][0])
7448
7449 # Check that a call to gpupdate --rsop also succeeds
7450 ret = rsop(self.lp)
7451 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7452
7453 # Remove policy
7454 gp_db = store.get_gplog(machine_creds.get_username())
7455 del_gpos = get_deleted_gpos_list(gp_db, [])
7456 ext.process_group_policy(del_gpos, [], dname)
7457 self.assertFalse(os.path.exists(ca_crt),
7458 'Root CA certificate was not removed')
7459 self.assertFalse(os.path.exists(machine_crt),
7460 'Machine certificate was not removed')
7461 self.assertFalse(os.path.exists(machine_crt),
7462 'Machine key was not removed')
7463 self.assertFalse(os.path.exists(workstation_crt),
7464 'Workstation certificate was not removed')
7465 self.assertFalse(os.path.exists(workstation_crt),
7466 'Workstation key was not removed')
7467 out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate()
7468 for ca in ca_list:
7469 self.assertNotIn(get_bytes(ca), out, 'CA was not removed')
7470 out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate()
7471 self.assertNotIn(b'Machine', out,
7472 'Machine certificate not removed')
7473 self.assertNotIn(b'Workstation', out,
7474 'Workstation certificate not removed')
7475
7476 # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate
7477 ldb.delete(certa_dn)
7478 ldb.delete(enroll_dn)
7479 ldb.delete(template_dn)
7480
7481 # Unstage the Registry.pol file
7482 unstage_file(reg_pol)
7483
7484 def test_gp_centrify_sudoers_ext(self):
7485 local_path = self.lp.cache_path('gpo_cache')
7486 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7487 reg_pol = os.path.join(local_path, policies, guid,
7488 'MACHINE/REGISTRY.POL')
7489 cache_dir = self.lp.get('cache directory')
7490 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7491
7492 machine_creds = Credentials()
7493 machine_creds.guess(self.lp)
7494 machine_creds.set_machine_account()
7495
7496 # Initialize the group policy extension
7497 ext = gp_centrify_sudoers_ext(self.lp, machine_creds,
7498 machine_creds.get_username(), store)
7499
7500 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7501 machine_creds.get_username())
7502
7503 # Stage the Registry.pol file with test data
7504 stage = preg.file()
7505 e1 = preg.entry()
7506 e1.keyname = b'Software\\Policies\\Centrify\\UnixSettings'
7507 e1.valuename = b'sudo.enabled'
7508 e1.type = 4
7509 e1.data = 1
7510 e2 = preg.entry()
7511 e2.keyname = b'Software\\Policies\\Centrify\\UnixSettings\\SuDo'
7512 e2.valuename = b'1'
7513 e2.type = 1
7514 e2.data = b'fakeu ALL=(ALL) NOPASSWD: ALL'
7515 stage.num_entries = 2
7516 stage.entries = [e1, e2]
7517 ret = stage_file(reg_pol, ndr_pack(stage))
7518 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7519
7520 # Process all gpos, with temp output directory
7521 with TemporaryDirectory() as dname:
7522 ext.process_group_policy([], gpos, dname)
7523 sudoers = os.listdir(dname)
7524 self.assertEqual(len(sudoers), 1, 'The sudoer file was not created')
7525 sudoers_file = os.path.join(dname, sudoers[0])
7526 self.assertIn(e2.data, open(sudoers_file, 'r').read(),
7527 'The sudoers entry was not applied')
7528
7529 # Remove the sudoers file, and make sure a re-apply puts it back
7530 os.unlink(sudoers_file)
7531 ext.process_group_policy([], gpos, dname)
7532 sudoers = os.listdir(dname)
7533 self.assertEqual(len(sudoers), 1,
7534 'The sudoer file was not recreated')
7535 sudoers_file = os.path.join(dname, sudoers[0])
7536 self.assertIn(e2.data, open(sudoers_file, 'r').read(),
7537 'The sudoers entry was not reapplied')
7538
7539 # Check that a call to gpupdate --rsop also succeeds
7540 ret = rsop(self.lp)
7541 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7542
7543 # Remove policy
7544 gp_db = store.get_gplog(machine_creds.get_username())
7545 del_gpos = get_deleted_gpos_list(gp_db, [])
7546 ext.process_group_policy(del_gpos, [])
7547 self.assertEqual(len(os.listdir(dname)), 0,
7548 'Unapply failed to cleanup scripts')
7549
7550 # Unstage the Registry.pol file
7551 unstage_file(reg_pol)
7552
7553 def test_gp_centrify_crontab_ext(self):
7554 local_path = self.lp.cache_path('gpo_cache')
7555 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7556 reg_pol = os.path.join(local_path, policies, guid,
7557 'MACHINE/REGISTRY.POL')
7558 cache_dir = self.lp.get('cache directory')
7559 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7560
7561 machine_creds = Credentials()
7562 machine_creds.guess(self.lp)
7563 machine_creds.set_machine_account()
7564
7565 # Initialize the group policy extension
7566 ext = gp_centrify_crontab_ext(self.lp, machine_creds,
7567 machine_creds.get_username(), store)
7568
7569 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7570 machine_creds.get_username())
7571
7572 # Stage the Registry.pol file with test data
7573 stage = preg.file()
7574 e = preg.entry()
7575 e.keyname = \
7576 b'Software\\Policies\\Centrify\\UnixSettings\\CrontabEntries'
7577 e.valuename = b'Command1'
7578 e.type = 1
7579 e.data = b'17 * * * * root echo hello world'
7580 stage.num_entries = 1
7581 stage.entries = [e]
7582 ret = stage_file(reg_pol, ndr_pack(stage))
7583 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7584
7585 # Process all gpos, with temp output directory
7586 with TemporaryDirectory() as dname:
7587 ext.process_group_policy([], gpos, dname)
7588 cron_entries = os.listdir(dname)
7589 self.assertEqual(len(cron_entries), 1, 'Cron entry not created')
7590 fname = os.path.join(dname, cron_entries[0])
7591 data = open(fname, 'rb').read()
7592 self.assertIn(get_bytes(e.data), data, 'Cron entry is missing')
7593
7594 # Check that a call to gpupdate --rsop also succeeds
7595 ret = rsop(self.lp)
7596 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7597
7598 # Remove policy
7599 gp_db = store.get_gplog(machine_creds.get_username())
7600 del_gpos = get_deleted_gpos_list(gp_db, [])
7601 ext.process_group_policy(del_gpos, [])
7602 self.assertEqual(len(os.listdir(dname)), 0,
7603 'Unapply failed to cleanup script')
7604
7605 # Unstage the Registry.pol file
7606 unstage_file(reg_pol)
7607
7608 def test_gp_user_centrify_crontab_ext(self):
7609 local_path = self.lp.cache_path('gpo_cache')
7610 guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7611 reg_pol = os.path.join(local_path, policies, guid,
7612 'USER/REGISTRY.POL')
7613 cache_dir = self.lp.get('cache directory')
7614 store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7615
7616 machine_creds = Credentials()
7617 machine_creds.guess(self.lp)
7618 machine_creds.set_machine_account()
7619
7620 # Initialize the group policy extension
7621 ext = gp_user_centrify_crontab_ext(self.lp, machine_creds,
7622 os.environ.get('DC_USERNAME'),
7623 store)
7624
7625 gpos = get_gpo_list(self.server, machine_creds, self.lp,
7626 machine_creds.get_username())
7627
7628 # Stage the Registry.pol file with test data
7629 stage = preg.file()
7630 e = preg.entry()
7631 e.keyname = \
7632 b'Software\\Policies\\Centrify\\UnixSettings\\CrontabEntries'
7633 e.valuename = b'Command1'
7634 e.type = 1
7635 e.data = b'17 * * * * echo hello world'
7636 stage.num_entries = 1
7637 stage.entries = [e]
7638 ret = stage_file(reg_pol, ndr_pack(stage))
7639 self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7640
7641 # Process all gpos, intentionally skipping the privilege drop
7642 ext.process_group_policy([], gpos)
7643 # Dump the fake crontab setup for testing
7644 p = Popen(['crontab', '-l'], stdout=PIPE)
7645 crontab, _ = p.communicate()
7646 self.assertIn(get_bytes(e.data), crontab,
7647 'The crontab entry was not installed')
7648
7649 # Check that a call to gpupdate --rsop also succeeds
7650 ret = rsop(self.lp)
7651 self.assertEqual(ret, 0, 'gpupdate --rsop failed!')
7652
7653 # Remove policy
7654 gp_db = store.get_gplog(os.environ.get('DC_USERNAME'))
7655 del_gpos = get_deleted_gpos_list(gp_db, [])
7656 ext.process_group_policy(del_gpos, [])
7657 # Dump the fake crontab setup for testing
7658 p = Popen(['crontab', '-l'], stdout=PIPE)
7659 crontab, _ = p.communicate()
7660 self.assertNotIn(get_bytes(e.data), crontab,
7661 'Unapply failed to cleanup crontab entry')
7662
7663 # Unstage the Registry.pol file
7664 unstage_file(reg_pol)
Samba GIT mirror