python/samba/tests/gpo.py

   1 # Unix SMB/CIFS implementation. Tests for smb manipulation
   2 # Copyright (C) David Mulder <dmulder@suse.com> 2018
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License as published by
   6 # the Free Software Foundation; either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16
  17 import os, grp, pwd
  18 import errno
  19 from samba import gpo, tests
  20 from samba.gp.gpclass import register_gp_extension, list_gp_extensions, \
  21     unregister_gp_extension, GPOStorage
  22 from samba.param import LoadParm
  23 from samba.gp.gpclass import check_refresh_gpo_list, check_safe_path, \
  24     check_guid, parse_gpext_conf, atomic_write_conf, get_deleted_gpos_list
  25 from subprocess import Popen, PIPE
  26 from tempfile import NamedTemporaryFile, TemporaryDirectory
  27 from samba.gp import gpclass
  28 # Disable privilege dropping for testing
  29 gpclass.drop_privileges = lambda _, func, *args : func(*args)
  30 from samba.gp.gp_sec_ext import gp_krb_ext, gp_access_ext
  31 from samba.gp.gp_scripts_ext import gp_scripts_ext, gp_user_scripts_ext
  32 from samba.gp.gp_sudoers_ext import gp_sudoers_ext
  33 from samba.gp.vgp_sudoers_ext import vgp_sudoers_ext
  34 from samba.gp.vgp_symlink_ext import vgp_symlink_ext
  35 from samba.gp.gpclass import gp_inf_ext
  36 from samba.gp.gp_smb_conf_ext import gp_smb_conf_ext
  37 from samba.gp.vgp_files_ext import vgp_files_ext
  38 from samba.gp.vgp_openssh_ext import vgp_openssh_ext
  39 from samba.gp.vgp_startup_scripts_ext import vgp_startup_scripts_ext
  40 from samba.gp.vgp_motd_ext import vgp_motd_ext
  41 from samba.gp.vgp_issue_ext import vgp_issue_ext
  42 from samba.gp.vgp_access_ext import vgp_access_ext
  43 from samba.gp.gp_gnome_settings_ext import gp_gnome_settings_ext
  44 from samba.gp import gp_cert_auto_enroll_ext as cae
  45 from samba.gp.gp_firefox_ext import gp_firefox_ext
  46 from samba.gp.gp_chromium_ext import gp_chromium_ext
  47 from samba.gp.gp_firewalld_ext import gp_firewalld_ext
  48 from samba.credentials import Credentials
  49 from samba.gp.gp_msgs_ext import gp_msgs_ext
  50 from samba.gp.gp_centrify_sudoers_ext import gp_centrify_sudoers_ext
  51 from samba.gp.gp_centrify_crontab_ext import gp_centrify_crontab_ext, \
  52                                              gp_user_centrify_crontab_ext
  53 from samba.common import get_bytes
  54 from samba.dcerpc import preg
  55 from samba.ndr import ndr_pack
  56 import codecs
  57 from shutil import copyfile
  58 import xml.etree.ElementTree as etree
  59 import hashlib
  60 from samba.gp_parse.gp_pol import GPPolParser
  61 from glob import glob
  62 from configparser import ConfigParser
  63 from samba.gp.gpclass import get_dc_hostname
  64 from samba import Ldb
  65 import ldb as _ldb
  66 from samba.auth import system_session
  67 import json
  68 from shutil import which
  69 import requests
  70 from cryptography import x509
  71 from cryptography.hazmat.primitives import hashes
  72 from cryptography.hazmat.backends import default_backend
  73 from cryptography.hazmat.primitives.asymmetric import rsa
  74 from cryptography.hazmat.primitives.serialization import Encoding
  75 from datetime import datetime, timedelta
  76
  77 def dummy_certificate():
  78     name = x509.Name([
  79         x509.NameAttribute(x509.NameOID.COMMON_NAME,
  80                            os.environ.get('SERVER'))
  81     ])
  82     cons = x509.BasicConstraints(ca=True, path_length=0)
  83     now = datetime.utcnow()
  84
  85     key = rsa.generate_private_key(public_exponent=65537, key_size=2048,
  86                                    backend=default_backend())
  87
  88     cert = (
  89         x509.CertificateBuilder()
  90         .subject_name(name)
  91         .issuer_name(name)
  92         .public_key(key.public_key())
  93         .serial_number(1000)
  94         .not_valid_before(now)
  95         .not_valid_after(now + timedelta(seconds=300))
  96         .add_extension(cons, False)
  97         .sign(key, hashes.SHA256(), default_backend())
  98     )
  99
 100     return cert.public_bytes(encoding=Encoding.DER)
 101
 102 # Dummy requests structure for Certificate Auto Enrollment
 103 class dummy_requests(object):
 104     @staticmethod
 105     def get(url=None, params=None):
 106         dummy = requests.Response()
 107         dummy._content = dummy_certificate()
 108         dummy.headers = {'Content-Type': 'application/x-x509-ca-cert'}
 109         return dummy
 110
 111     class exceptions(object):
 112         ConnectionError = Exception
 113 cae.requests = dummy_requests
 114
 115 realm = os.environ.get('REALM')
 116 policies = realm + '/POLICIES'
 117 realm = realm.lower()
 118 poldir = r'\\{0}\sysvol\{0}\Policies'.format(realm)
 119 # the first part of the base DN varies by testenv. Work it out from the realm
 120 base_dn = 'DC={0},DC=samba,DC=example,DC=com'.format(realm.split('.')[0])
 121 dspath = 'CN=Policies,CN=System,' + base_dn
 122 gpt_data = '[General]\nVersion=%d'
 123
 124 gnome_test_reg_pol = \
 125 b"""
 126 <?xml version="1.0" encoding="utf-8"?>
 127 <PolFile num_entries="26" signature="PReg" version="1">
 128     <Entry type="4" type_name="REG_DWORD">
 129         <Key>GNOME Settings\Lock Down Settings</Key>
 130         <ValueName>Lock Down Enabled Extensions</ValueName>
 131         <Value>1</Value>
 132     </Entry>
 133     <Entry type="4" type_name="REG_DWORD">
 134         <Key>GNOME Settings\Lock Down Settings</Key>
 135         <ValueName>Lock Down Specific Settings</ValueName>
 136         <Value>1</Value>
 137     </Entry>
 138     <Entry type="4" type_name="REG_DWORD">
 139         <Key>GNOME Settings\Lock Down Settings</Key>
 140         <ValueName>Disable Printing</ValueName>
 141         <Value>1</Value>
 142     </Entry>
 143     <Entry type="4" type_name="REG_DWORD">
 144         <Key>GNOME Settings\Lock Down Settings</Key>
 145         <ValueName>Disable File Saving</ValueName>
 146         <Value>1</Value>
 147     </Entry>
 148     <Entry type="4" type_name="REG_DWORD">
 149         <Key>GNOME Settings\Lock Down Settings</Key>
 150         <ValueName>Disable Command-Line Access</ValueName>
 151         <Value>1</Value>
 152     </Entry>
 153     <Entry type="4" type_name="REG_DWORD">
 154         <Key>GNOME Settings\Lock Down Settings</Key>
 155         <ValueName>Disallow Login Using a Fingerprint</ValueName>
 156         <Value>1</Value>
 157     </Entry>
 158     <Entry type="4" type_name="REG_DWORD">
 159         <Key>GNOME Settings\Lock Down Settings</Key>
 160         <ValueName>Disable User Logout</ValueName>
 161         <Value>1</Value>
 162     </Entry>
 163     <Entry type="4" type_name="REG_DWORD">
 164         <Key>GNOME Settings\Lock Down Settings</Key>
 165         <ValueName>Disable User Switching</ValueName>
 166         <Value>1</Value>
 167     </Entry>
 168     <Entry type="4" type_name="REG_DWORD">
 169         <Key>GNOME Settings\Lock Down Settings</Key>
 170         <ValueName>Disable Repartitioning</ValueName>
 171         <Value>1</Value>
 172     </Entry>
 173     <Entry type="4" type_name="REG_DWORD">
 174         <Key>GNOME Settings\Lock Down Settings</Key>
 175         <ValueName>Whitelisted Online Accounts</ValueName>
 176         <Value>1</Value>
 177     </Entry>
 178     <Entry type="4" type_name="REG_DWORD">
 179         <Key>GNOME Settings\Lock Down Settings</Key>
 180         <ValueName>Compose Key</ValueName>
 181         <Value>1</Value>
 182     </Entry>
 183     <Entry type="4" type_name="REG_DWORD">
 184         <Key>GNOME Settings\Lock Down Settings</Key>
 185         <ValueName>Dim Screen when User is Idle</ValueName>
 186         <Value>1</Value>
 187     </Entry>
 188     <Entry type="4" type_name="REG_DWORD">
 189         <Key>GNOME Settings\Lock Down Settings</Key>
 190         <ValueName>Enabled Extensions</ValueName>
 191         <Value>1</Value>
 192     </Entry>
 193     <Entry type="1" type_name="REG_SZ">
 194         <Key>GNOME Settings\Lock Down Settings\Compose Key</Key>
 195         <ValueName>Key Name</ValueName>
 196         <Value>Right Alt</Value>
 197     </Entry>
 198     <Entry type="4" type_name="REG_DWORD">
 199         <Key>GNOME Settings\Lock Down Settings\Dim Screen when User is Idle</Key>
 200         <ValueName>Delay</ValueName>
 201         <Value>300</Value>
 202     </Entry>
 203     <Entry type="4" type_name="REG_DWORD">
 204         <Key>GNOME Settings\Lock Down Settings\Dim Screen when User is Idle</Key>
 205         <ValueName>Dim Idle Brightness</ValueName>
 206         <Value>30</Value>
 207     </Entry>
 208     <Entry type="1" type_name="REG_SZ">
 209         <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
 210         <ValueName>**delvals.</ValueName>
 211         <Value> </Value>
 212     </Entry>
 213     <Entry type="1" type_name="REG_SZ">
 214         <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
 215         <ValueName>myextension1@myname.example.com</ValueName>
 216         <Value>myextension1@myname.example.com</Value>
 217     </Entry>
 218     <Entry type="1" type_name="REG_SZ">
 219         <Key>GNOME Settings\Lock Down Settings\Enabled Extensions</Key>
 220         <ValueName>myextension2@myname.example.com</ValueName>
 221         <Value>myextension2@myname.example.com</Value>
 222     </Entry>
 223     <Entry type="1" type_name="REG_SZ">
 224         <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
 225         <ValueName>**delvals.</ValueName>
 226         <Value> </Value>
 227     </Entry>
 228     <Entry type="1" type_name="REG_SZ">
 229         <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
 230         <ValueName>/org/gnome/desktop/background/picture-uri</ValueName>
 231         <Value>/org/gnome/desktop/background/picture-uri</Value>
 232     </Entry>
 233     <Entry type="1" type_name="REG_SZ">
 234         <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
 235         <ValueName>/org/gnome/desktop/background/picture-options</ValueName>
 236         <Value>/org/gnome/desktop/background/picture-options</Value>
 237     </Entry>
 238     <Entry type="1" type_name="REG_SZ">
 239         <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
 240         <ValueName>/org/gnome/desktop/background/primary-color</ValueName>
 241         <Value>/org/gnome/desktop/background/primary-color</Value>
 242     </Entry>
 243     <Entry type="1" type_name="REG_SZ">
 244         <Key>GNOME Settings\Lock Down Settings\Lock Down Specific Settings</Key>
 245         <ValueName>/org/gnome/desktop/background/secondary-color</ValueName>
 246         <Value>/org/gnome/desktop/background/secondary-color</Value>
 247     </Entry>
 248     <Entry type="1" type_name="REG_SZ">
 249         <Key>GNOME Settings\Lock Down Settings\Whitelisted Online Accounts</Key>
 250         <ValueName>**delvals.</ValueName>
 251         <Value> </Value>
 252     </Entry>
 253     <Entry type="1" type_name="REG_SZ">
 254         <Key>GNOME Settings\Lock Down Settings\Whitelisted Online Accounts</Key>
 255         <ValueName>google</ValueName>
 256         <Value>google</Value>
 257     </Entry>
 258 </PolFile>
 259 """
 260
 261 auto_enroll_reg_pol = \
 262 b"""
 263 <?xml version="1.0" encoding="utf-8"?>
 264 <PolFile num_entries="3" signature="PReg" version="1">
 265         <Entry type="4" type_name="REG_DWORD">
 266                 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 267                 <ValueName>AEPolicy</ValueName>
 268                 <Value>7</Value>
 269         </Entry>
 270         <Entry type="4" type_name="REG_DWORD">
 271                 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 272                 <ValueName>OfflineExpirationPercent</ValueName>
 273                 <Value>10</Value>
 274         </Entry>
 275         <Entry type="1" type_name="REG_SZ">
 276                 <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 277                 <ValueName>OfflineExpirationStoreNames</ValueName>
 278                 <Value>MY</Value>
 279         </Entry>
 280 </PolFile>
 281 """
 282
 283 advanced_enroll_reg_pol = \
 284 b"""
 285 <?xml version="1.0" encoding="utf-8"?>
 286 <PolFile num_entries="30" signature="PReg" version="1">
 287     <Entry type="1" type_name="REG_SZ">
 288         <Key>Software\Policies\Microsoft\Cryptography</Key>
 289         <ValueName>**DeleteKeys</ValueName>
 290         <Value>Software\Policies\Microsoft\Cryptography\PolicyServers</Value>
 291     </Entry>
 292     <Entry type="4" type_name="REG_DWORD">
 293         <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 294         <ValueName>AEPolicy</ValueName>
 295         <Value>7</Value>
 296     </Entry>
 297     <Entry type="4" type_name="REG_DWORD">
 298         <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 299         <ValueName>OfflineExpirationPercent</ValueName>
 300         <Value>25</Value>
 301     </Entry>
 302     <Entry type="1" type_name="REG_SZ">
 303         <Key>Software\Policies\Microsoft\Cryptography\AutoEnrollment</Key>
 304         <ValueName>OfflineExpirationStoreNames</ValueName>
 305         <Value>MY</Value>
 306     </Entry>
 307     <Entry type="1" type_name="REG_SZ">
 308         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers</Key>
 309         <ValueName/>
 310         <Value>{5AD0BE6D-3393-4940-BFC3-6E19555A8919}</Value>
 311     </Entry>
 312     <Entry type="4" type_name="REG_DWORD">
 313         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers</Key>
 314         <ValueName>Flags</ValueName>
 315         <Value>0</Value>
 316     </Entry>
 317     <Entry type="1" type_name="REG_SZ">
 318         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 319         <ValueName>URL</ValueName>
 320         <Value>LDAP:</Value>
 321     </Entry>
 322     <Entry type="1" type_name="REG_SZ">
 323         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 324         <ValueName>PolicyID</ValueName>
 325         <Value>%s</Value>
 326     </Entry>
 327     <Entry type="1" type_name="REG_SZ">
 328         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 329         <ValueName>FriendlyName</ValueName>
 330         <Value>Example</Value>
 331     </Entry>
 332     <Entry type="4" type_name="REG_DWORD">
 333         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 334         <ValueName>Flags</ValueName>
 335         <Value>16</Value>
 336     </Entry>
 337     <Entry type="4" type_name="REG_DWORD">
 338         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 339         <ValueName>AuthFlags</ValueName>
 340         <Value>2</Value>
 341     </Entry>
 342     <Entry type="4" type_name="REG_DWORD">
 343         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\37c9dc30f207f27f61a2f7c3aed598a6e2920b54</Key>
 344         <ValueName>Cost</ValueName>
 345         <Value>2147483645</Value>
 346     </Entry>
 347     <Entry type="1" type_name="REG_SZ">
 348         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 349         <ValueName>URL</ValueName>
 350         <Value>https://example2.com/ADPolicyProvider_CEP_Certificate/service.svc/CEP</Value>
 351     </Entry>
 352     <Entry type="1" type_name="REG_SZ">
 353         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 354         <ValueName>PolicyID</ValueName>
 355         <Value>%s</Value>
 356     </Entry>
 357     <Entry type="1" type_name="REG_SZ">
 358         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 359         <ValueName>FriendlyName</ValueName>
 360         <Value>Example2</Value>
 361     </Entry>
 362     <Entry type="4" type_name="REG_DWORD">
 363         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 364         <ValueName>Flags</ValueName>
 365         <Value>16</Value>
 366     </Entry>
 367     <Entry type="4" type_name="REG_DWORD">
 368         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 369         <ValueName>AuthFlags</ValueName>
 370         <Value>8</Value>
 371     </Entry>
 372     <Entry type="4" type_name="REG_DWORD">
 373         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\144bdbb8e4717c26e408f3c9a0cb8d6cfacbcbbe</Key>
 374         <ValueName>Cost</ValueName>
 375         <Value>10</Value>
 376     </Entry>
 377     <Entry type="1" type_name="REG_SZ">
 378         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 379         <ValueName>URL</ValueName>
 380         <Value>https://example0.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP</Value>
 381     </Entry>
 382     <Entry type="1" type_name="REG_SZ">
 383         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 384         <ValueName>PolicyID</ValueName>
 385         <Value>%s</Value>
 386     </Entry>
 387     <Entry type="1" type_name="REG_SZ">
 388         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 389         <ValueName>FriendlyName</ValueName>
 390         <Value>Example0</Value>
 391     </Entry>
 392     <Entry type="4" type_name="REG_DWORD">
 393         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 394         <ValueName>Flags</ValueName>
 395         <Value>16</Value>
 396     </Entry>
 397     <Entry type="4" type_name="REG_DWORD">
 398         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 399         <ValueName>AuthFlags</ValueName>
 400         <Value>2</Value>
 401     </Entry>
 402     <Entry type="4" type_name="REG_DWORD">
 403         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\20d46e856e9b9746c0b1265c328f126a7b3283a9</Key>
 404         <ValueName>Cost</ValueName>
 405         <Value>1</Value>
 406     </Entry>
 407     <Entry type="1" type_name="REG_SZ">
 408         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 409         <ValueName>URL</ValueName>
 410         <Value>https://example1.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP</Value>
 411     </Entry>
 412     <Entry type="1" type_name="REG_SZ">
 413         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 414         <ValueName>PolicyID</ValueName>
 415         <Value>%s</Value>
 416     </Entry>
 417     <Entry type="1" type_name="REG_SZ">
 418         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 419         <ValueName>FriendlyName</ValueName>
 420         <Value>Example1</Value>
 421     </Entry>
 422     <Entry type="4" type_name="REG_DWORD">
 423         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 424         <ValueName>Flags</ValueName>
 425         <Value>16</Value>
 426     </Entry>
 427     <Entry type="4" type_name="REG_DWORD">
 428         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 429         <ValueName>AuthFlags</ValueName>
 430         <Value>2</Value>
 431     </Entry>
 432     <Entry type="4" type_name="REG_DWORD">
 433         <Key>Software\Policies\Microsoft\Cryptography\PolicyServers\\855b5246433a48402ac4f5c3427566df26ccc9ac</Key>
 434         <ValueName>Cost</ValueName>
 435         <Value>1</Value>
 436     </Entry>
 437 </PolFile>
 438 """
 439
 440 firefox_reg_pol = \
 441 b"""
 442 <?xml version="1.0" encoding="utf-8"?>
 443 <PolFile num_entries="241" signature="PReg" version="1">
 444     <Entry type="7" type_name="REG_MULTI_SZ">
 445         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 446         <ValueName>ExtensionSettings</ValueName>
 447         <Value>{ &quot;*&quot;: { &quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;install_sources&quot;: [&quot;about:addons&quot;,&quot;https://addons.mozilla.org/&quot;], &quot;installation_mode&quot;: &quot;blocked&quot;, &quot;allowed_types&quot;: [&quot;extension&quot;] }, &quot;uBlock0@raymondhill.net&quot;: { &quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;install_url&quot;: &quot;https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi&quot; }, &quot;https-everywhere@eff.org&quot;: { &quot;installation_mode&quot;: &quot;allowed&quot; } }</Value>
 448     </Entry>
 449     <Entry type="4" type_name="REG_DWORD">
 450         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 451         <ValueName>ExtensionUpdate</ValueName>
 452         <Value>1</Value>
 453     </Entry>
 454     <Entry type="4" type_name="REG_DWORD">
 455         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 456         <ValueName>SearchSuggestEnabled</ValueName>
 457         <Value>1</Value>
 458     </Entry>
 459     <Entry type="4" type_name="REG_DWORD">
 460         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 461         <ValueName>AppAutoUpdate</ValueName>
 462         <Value>1</Value>
 463     </Entry>
 464     <Entry type="1" type_name="REG_SZ">
 465         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 466         <ValueName>AppUpdateURL</ValueName>
 467         <Value>https://yoursite.com</Value>
 468     </Entry>
 469     <Entry type="4" type_name="REG_DWORD">
 470         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 471         <ValueName>BlockAboutAddons</ValueName>
 472         <Value>1</Value>
 473     </Entry>
 474     <Entry type="4" type_name="REG_DWORD">
 475         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 476         <ValueName>BlockAboutConfig</ValueName>
 477         <Value>1</Value>
 478     </Entry>
 479     <Entry type="4" type_name="REG_DWORD">
 480         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 481         <ValueName>BlockAboutProfiles</ValueName>
 482         <Value>1</Value>
 483     </Entry>
 484     <Entry type="4" type_name="REG_DWORD">
 485         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 486         <ValueName>BlockAboutSupport</ValueName>
 487         <Value>1</Value>
 488     </Entry>
 489     <Entry type="4" type_name="REG_DWORD">
 490         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 491         <ValueName>CaptivePortal</ValueName>
 492         <Value>1</Value>
 493     </Entry>
 494     <Entry type="2" type_name="REG_EXPAND_SZ">
 495         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 496         <ValueName>DefaultDownloadDirectory</ValueName>
 497         <Value>${home}/Downloads</Value>
 498     </Entry>
 499     <Entry type="4" type_name="REG_DWORD">
 500         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 501         <ValueName>DisableAppUpdate</ValueName>
 502         <Value>1</Value>
 503     </Entry>
 504     <Entry type="4" type_name="REG_DWORD">
 505         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 506         <ValueName>DisableBuiltinPDFViewer</ValueName>
 507         <Value>1</Value>
 508     </Entry>
 509     <Entry type="4" type_name="REG_DWORD">
 510         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 511         <ValueName>DisableDefaultBrowserAgent</ValueName>
 512         <Value>1</Value>
 513     </Entry>
 514     <Entry type="4" type_name="REG_DWORD">
 515         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 516         <ValueName>DisableDeveloperTools</ValueName>
 517         <Value>1</Value>
 518     </Entry>
 519     <Entry type="4" type_name="REG_DWORD">
 520         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 521         <ValueName>DisableFeedbackCommands</ValueName>
 522         <Value>1</Value>
 523     </Entry>
 524     <Entry type="4" type_name="REG_DWORD">
 525         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 526         <ValueName>DisableFirefoxAccounts</ValueName>
 527         <Value>1</Value>
 528     </Entry>
 529     <Entry type="4" type_name="REG_DWORD">
 530         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 531         <ValueName>DisableFirefoxScreenshots</ValueName>
 532         <Value>1</Value>
 533     </Entry>
 534     <Entry type="4" type_name="REG_DWORD">
 535         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 536         <ValueName>DisableFirefoxStudies</ValueName>
 537         <Value>1</Value>
 538     </Entry>
 539     <Entry type="4" type_name="REG_DWORD">
 540         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 541         <ValueName>DisableForgetButton</ValueName>
 542         <Value>1</Value>
 543     </Entry>
 544     <Entry type="4" type_name="REG_DWORD">
 545         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 546         <ValueName>DisableFormHistory</ValueName>
 547         <Value>1</Value>
 548     </Entry>
 549     <Entry type="4" type_name="REG_DWORD">
 550         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 551         <ValueName>DisableMasterPasswordCreation</ValueName>
 552         <Value>1</Value>
 553     </Entry>
 554     <Entry type="4" type_name="REG_DWORD">
 555         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 556         <ValueName>DisablePasswordReveal</ValueName>
 557         <Value>1</Value>
 558     </Entry>
 559     <Entry type="4" type_name="REG_DWORD">
 560         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 561         <ValueName>DisablePocket</ValueName>
 562         <Value>1</Value>
 563     </Entry>
 564     <Entry type="4" type_name="REG_DWORD">
 565         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 566         <ValueName>DisablePrivateBrowsing</ValueName>
 567         <Value>1</Value>
 568     </Entry>
 569     <Entry type="4" type_name="REG_DWORD">
 570         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 571         <ValueName>DisableProfileImport</ValueName>
 572         <Value>1</Value>
 573     </Entry>
 574     <Entry type="4" type_name="REG_DWORD">
 575         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 576         <ValueName>DisableProfileRefresh</ValueName>
 577         <Value>1</Value>
 578     </Entry>
 579     <Entry type="4" type_name="REG_DWORD">
 580         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 581         <ValueName>DisableSafeMode</ValueName>
 582         <Value>1</Value>
 583     </Entry>
 584     <Entry type="4" type_name="REG_DWORD">
 585         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 586         <ValueName>DisableSetDesktopBackground</ValueName>
 587         <Value>1</Value>
 588     </Entry>
 589     <Entry type="4" type_name="REG_DWORD">
 590         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 591         <ValueName>DisableSystemAddonUpdate</ValueName>
 592         <Value>1</Value>
 593     </Entry>
 594     <Entry type="4" type_name="REG_DWORD">
 595         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 596         <ValueName>DisableTelemetry</ValueName>
 597         <Value>1</Value>
 598     </Entry>
 599     <Entry type="4" type_name="REG_DWORD">
 600         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 601         <ValueName>DisplayBookmarksToolbar</ValueName>
 602         <Value>1</Value>
 603     </Entry>
 604     <Entry type="1" type_name="REG_SZ">
 605         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 606         <ValueName>DisplayMenuBar</ValueName>
 607         <Value>default-on</Value>
 608     </Entry>
 609     <Entry type="4" type_name="REG_DWORD">
 610         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 611         <ValueName>DontCheckDefaultBrowser</ValueName>
 612         <Value>1</Value>
 613     </Entry>
 614     <Entry type="2" type_name="REG_EXPAND_SZ">
 615         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 616         <ValueName>DownloadDirectory</ValueName>
 617         <Value>${home}/Downloads</Value>
 618     </Entry>
 619     <Entry type="7" type_name="REG_MULTI_SZ">
 620         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 621         <ValueName>Handlers</ValueName>
 622         <Value>{ &quot;mimeTypes&quot;: { &quot;application/msword&quot;: { &quot;action&quot;: &quot;useSystemDefault&quot;, &quot;ask&quot;:  true } }, &quot;schemes&quot;: { &quot;mailto&quot;: { &quot;action&quot;: &quot;useHelperApp&quot;, &quot;ask&quot;:  true, &quot;handlers&quot;: [{ &quot;name&quot;: &quot;Gmail&quot;, &quot;uriTemplate&quot;: &quot;https://mail.google.com/mail/?extsrc=mailto&amp;url=%s&quot; }] } }, &quot;extensions&quot;: { &quot;pdf&quot;: { &quot;action&quot;: &quot;useHelperApp&quot;, &quot;ask&quot;:  true, &quot;handlers&quot;: [{ &quot;name&quot;: &quot;Adobe Acrobat&quot;, &quot;path&quot;: &quot;/usr/bin/acroread&quot; }] } } }</Value>
 623     </Entry>
 624     <Entry type="4" type_name="REG_DWORD">
 625         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 626         <ValueName>HardwareAcceleration</ValueName>
 627         <Value>1</Value>
 628     </Entry>
 629     <Entry type="7" type_name="REG_MULTI_SZ">
 630         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 631         <ValueName>ManagedBookmarks</ValueName>
 632         <Value>[ { &quot;toplevel_name&quot;: &quot;My managed bookmarks folder&quot; }, { &quot;url&quot;: &quot;example.com&quot;, &quot;name&quot;: &quot;Example&quot; }, { &quot;name&quot;: &quot;Mozilla links&quot;, &quot;children&quot;: [ { &quot;url&quot;: &quot;https://mozilla.org&quot;, &quot;name&quot;: &quot;Mozilla.org&quot; }, { &quot;url&quot;: &quot;https://support.mozilla.org/&quot;, &quot;name&quot;: &quot;SUMO&quot; } ] } ]</Value>
 633     </Entry>
 634     <Entry type="4" type_name="REG_DWORD">
 635         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 636         <ValueName>NetworkPrediction</ValueName>
 637         <Value>1</Value>
 638     </Entry>
 639     <Entry type="4" type_name="REG_DWORD">
 640         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 641         <ValueName>NewTabPage</ValueName>
 642         <Value>1</Value>
 643     </Entry>
 644     <Entry type="4" type_name="REG_DWORD">
 645         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 646         <ValueName>NoDefaultBookmarks</ValueName>
 647         <Value>1</Value>
 648     </Entry>
 649     <Entry type="4" type_name="REG_DWORD">
 650         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 651         <ValueName>OfferToSaveLogins</ValueName>
 652         <Value>1</Value>
 653     </Entry>
 654     <Entry type="4" type_name="REG_DWORD">
 655         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 656         <ValueName>OfferToSaveLoginsDefault</ValueName>
 657         <Value>1</Value>
 658     </Entry>
 659     <Entry type="1" type_name="REG_SZ">
 660         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 661         <ValueName>OverrideFirstRunPage</ValueName>
 662         <Value>http://example.org</Value>
 663     </Entry>
 664     <Entry type="1" type_name="REG_SZ">
 665         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 666         <ValueName>OverridePostUpdatePage</ValueName>
 667         <Value>http://example.org</Value>
 668     </Entry>
 669     <Entry type="4" type_name="REG_DWORD">
 670         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 671         <ValueName>PasswordManagerEnabled</ValueName>
 672         <Value>1</Value>
 673     </Entry>
 674     <Entry type="7" type_name="REG_MULTI_SZ">
 675         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 676         <ValueName>Preferences</ValueName>
 677         <Value>{ &quot;accessibility.force_disabled&quot;: { &quot;Value&quot;: 1, &quot;Status&quot;: &quot;default&quot; }, &quot;browser.cache.disk.parent_directory&quot;: { &quot;Value&quot;: &quot;SOME_NATIVE_PATH&quot;, &quot;Status&quot;: &quot;user&quot; }, &quot;browser.tabs.warnOnClose&quot;: { &quot;Value&quot;: false, &quot;Status&quot;: &quot;locked&quot; } }</Value>
 678     </Entry>
 679     <Entry type="4" type_name="REG_DWORD">
 680         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 681         <ValueName>PrimaryPassword</ValueName>
 682         <Value>1</Value>
 683     </Entry>
 684     <Entry type="4" type_name="REG_DWORD">
 685         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 686         <ValueName>PromptForDownloadLocation</ValueName>
 687         <Value>1</Value>
 688     </Entry>
 689     <Entry type="1" type_name="REG_SZ">
 690         <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
 691         <ValueName>**delvals.</ValueName>
 692         <Value> </Value>
 693     </Entry>
 694     <Entry type="1" type_name="REG_SZ">
 695         <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
 696         <ValueName>1</ValueName>
 697         <Value>de</Value>
 698     </Entry>
 699     <Entry type="1" type_name="REG_SZ">
 700         <Key>Software\\Policies\\Mozilla\\Firefox\\RequestedLocales</Key>
 701         <ValueName>2</ValueName>
 702         <Value>en-US</Value>
 703     </Entry>
 704     <Entry type="1" type_name="REG_SZ">
 705         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 706         <ValueName>SSLVersionMax</ValueName>
 707         <Value>tls1.3</Value>
 708     </Entry>
 709     <Entry type="1" type_name="REG_SZ">
 710         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 711         <ValueName>SSLVersionMin</ValueName>
 712         <Value>tls1.3</Value>
 713     </Entry>
 714     <Entry type="1" type_name="REG_SZ">
 715         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
 716         <ValueName>SearchBar</ValueName>
 717         <Value>unified</Value>
 718     </Entry>
 719     <Entry type="4" type_name="REG_DWORD">
 720         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication</Key>
 721         <ValueName>Locked</ValueName>
 722         <Value>1</Value>
 723     </Entry>
 724     <Entry type="4" type_name="REG_DWORD">
 725         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication</Key>
 726         <ValueName>PrivateBrowsing</ValueName>
 727         <Value>1</Value>
 728     </Entry>
 729     <Entry type="4" type_name="REG_DWORD">
 730         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowNonFQDN</Key>
 731         <ValueName>NTLM</ValueName>
 732         <Value>1</Value>
 733     </Entry>
 734     <Entry type="4" type_name="REG_DWORD">
 735         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowNonFQDN</Key>
 736         <ValueName>SPNEGO</ValueName>
 737         <Value>1</Value>
 738     </Entry>
 739     <Entry type="4" type_name="REG_DWORD">
 740         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowProxies</Key>
 741         <ValueName>NTLM</ValueName>
 742         <Value>1</Value>
 743     </Entry>
 744     <Entry type="4" type_name="REG_DWORD">
 745         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\AllowProxies</Key>
 746         <ValueName>SPNEGO</ValueName>
 747         <Value>1</Value>
 748     </Entry>
 749     <Entry type="1" type_name="REG_SZ">
 750         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
 751         <ValueName>**delvals.</ValueName>
 752         <Value> </Value>
 753     </Entry>
 754     <Entry type="1" type_name="REG_SZ">
 755         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
 756         <ValueName>1</ValueName>
 757         <Value>mydomain.com</Value>
 758     </Entry>
 759     <Entry type="1" type_name="REG_SZ">
 760         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\Delegated</Key>
 761         <ValueName>1</ValueName>
 762         <Value>https://myotherdomain.com</Value>
 763     </Entry>
 764     <Entry type="1" type_name="REG_SZ">
 765         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
 766         <ValueName>**delvals.</ValueName>
 767         <Value> </Value>
 768     </Entry>
 769     <Entry type="1" type_name="REG_SZ">
 770         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
 771         <ValueName>1</ValueName>
 772         <Value>mydomain.com</Value>
 773     </Entry>
 774     <Entry type="1" type_name="REG_SZ">
 775         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\NTLM</Key>
 776         <ValueName>1</ValueName>
 777         <Value>https://myotherdomain.com</Value>
 778     </Entry>
 779     <Entry type="1" type_name="REG_SZ">
 780         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
 781         <ValueName>**delvals.</ValueName>
 782         <Value> </Value>
 783     </Entry>
 784     <Entry type="1" type_name="REG_SZ">
 785         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
 786         <ValueName>1</ValueName>
 787         <Value>mydomain.com</Value>
 788     </Entry>
 789     <Entry type="1" type_name="REG_SZ">
 790         <Key>Software\\Policies\\Mozilla\\Firefox\\Authentication\\SPNEGO</Key>
 791         <ValueName>1</ValueName>
 792         <Value>https://myotherdomain.com</Value>
 793     </Entry>
 794     <Entry type="1" type_name="REG_SZ">
 795         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
 796         <ValueName>Title</ValueName>
 797         <Value>Example</Value>
 798     </Entry>
 799     <Entry type="1" type_name="REG_SZ">
 800         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
 801         <ValueName>URL</ValueName>
 802         <Value>https://example.com</Value>
 803     </Entry>
 804     <Entry type="1" type_name="REG_SZ">
 805         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
 806         <ValueName>Favicon</ValueName>
 807         <Value>https://example.com/favicon.ico</Value>
 808     </Entry>
 809     <Entry type="1" type_name="REG_SZ">
 810         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
 811         <ValueName>Placement</ValueName>
 812         <Value>menu</Value>
 813     </Entry>
 814     <Entry type="1" type_name="REG_SZ">
 815         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\1</Key>
 816         <ValueName>Folder</ValueName>
 817         <Value>FolderName</Value>
 818     </Entry>
 819     <Entry type="1" type_name="REG_SZ">
 820         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
 821         <ValueName>Title</ValueName>
 822         <Value>Samba</Value>
 823     </Entry>
 824     <Entry type="1" type_name="REG_SZ">
 825         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
 826         <ValueName>URL</ValueName>
 827         <Value>www.samba.org</Value>
 828     </Entry>
 829     <Entry type="1" type_name="REG_SZ">
 830         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
 831         <ValueName>Favicon</ValueName>
 832         <Value/>
 833     </Entry>
 834     <Entry type="1" type_name="REG_SZ">
 835         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
 836         <ValueName>Placement</ValueName>
 837         <Value>toolbar</Value>
 838     </Entry>
 839     <Entry type="1" type_name="REG_SZ">
 840         <Key>Software\\Policies\\Mozilla\\Firefox\\Bookmarks\\10</Key>
 841         <ValueName>Folder</ValueName>
 842         <Value/>
 843     </Entry>
 844     <Entry type="1" type_name="REG_SZ">
 845         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
 846         <ValueName>AcceptThirdParty</ValueName>
 847         <Value>never</Value>
 848     </Entry>
 849     <Entry type="4" type_name="REG_DWORD">
 850         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
 851         <ValueName>Default</ValueName>
 852         <Value>1</Value>
 853     </Entry>
 854     <Entry type="4" type_name="REG_DWORD">
 855         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
 856         <ValueName>ExpireAtSessionEnd</ValueName>
 857         <Value>1</Value>
 858     </Entry>
 859     <Entry type="4" type_name="REG_DWORD">
 860         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
 861         <ValueName>Locked</ValueName>
 862         <Value>1</Value>
 863     </Entry>
 864     <Entry type="4" type_name="REG_DWORD">
 865         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies</Key>
 866         <ValueName>RejectTracker</ValueName>
 867         <Value>1</Value>
 868     </Entry>
 869     <Entry type="1" type_name="REG_SZ">
 870         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Allow</Key>
 871         <ValueName>**delvals.</ValueName>
 872         <Value> </Value>
 873     </Entry>
 874     <Entry type="1" type_name="REG_SZ">
 875         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Allow</Key>
 876         <ValueName>1</ValueName>
 877         <Value>http://example.org/</Value>
 878     </Entry>
 879     <Entry type="1" type_name="REG_SZ">
 880         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\AllowSession</Key>
 881         <ValueName>**delvals.</ValueName>
 882         <Value> </Value>
 883     </Entry>
 884     <Entry type="1" type_name="REG_SZ">
 885         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\AllowSession</Key>
 886         <ValueName>1</ValueName>
 887         <Value>http://example.edu/</Value>
 888     </Entry>
 889     <Entry type="1" type_name="REG_SZ">
 890         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Block</Key>
 891         <ValueName>**delvals.</ValueName>
 892         <Value> </Value>
 893     </Entry>
 894     <Entry type="1" type_name="REG_SZ">
 895         <Key>Software\\Policies\\Mozilla\\Firefox\\Cookies\\Block</Key>
 896         <ValueName>1</ValueName>
 897         <Value>http://example.edu/</Value>
 898     </Entry>
 899     <Entry type="4" type_name="REG_DWORD">
 900         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 901         <ValueName>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</ValueName>
 902         <Value>1</Value>
 903     </Entry>
 904     <Entry type="4" type_name="REG_DWORD">
 905         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 906         <ValueName>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</ValueName>
 907         <Value>1</Value>
 908     </Entry>
 909     <Entry type="4" type_name="REG_DWORD">
 910         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 911         <ValueName>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</ValueName>
 912         <Value>1</Value>
 913     </Entry>
 914     <Entry type="4" type_name="REG_DWORD">
 915         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 916         <ValueName>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ValueName>
 917         <Value>1</Value>
 918     </Entry>
 919     <Entry type="4" type_name="REG_DWORD">
 920         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 921         <ValueName>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</ValueName>
 922         <Value>1</Value>
 923     </Entry>
 924     <Entry type="4" type_name="REG_DWORD">
 925         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 926         <ValueName>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</ValueName>
 927         <Value>1</Value>
 928     </Entry>
 929     <Entry type="4" type_name="REG_DWORD">
 930         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 931         <ValueName>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ValueName>
 932         <Value>1</Value>
 933     </Entry>
 934     <Entry type="4" type_name="REG_DWORD">
 935         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 936         <ValueName>TLS_RSA_WITH_AES_128_CBC_SHA</ValueName>
 937         <Value>1</Value>
 938     </Entry>
 939     <Entry type="4" type_name="REG_DWORD">
 940         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 941         <ValueName>TLS_RSA_WITH_AES_128_GCM_SHA256</ValueName>
 942         <Value>1</Value>
 943     </Entry>
 944     <Entry type="4" type_name="REG_DWORD">
 945         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 946         <ValueName>TLS_RSA_WITH_AES_256_CBC_SHA</ValueName>
 947         <Value>1</Value>
 948     </Entry>
 949     <Entry type="4" type_name="REG_DWORD">
 950         <Key>Software\\Policies\\Mozilla\\Firefox\\DisabledCiphers</Key>
 951         <ValueName>TLS_RSA_WITH_AES_256_GCM_SHA384</ValueName>
 952         <Value>1</Value>
 953     </Entry>
 954     <Entry type="4" type_name="REG_DWORD">
 955         <Key>Software\\Policies\\Mozilla\\Firefox\\DisableSecurityBypass</Key>
 956         <ValueName>InvalidCertificate</ValueName>
 957         <Value>1</Value>
 958     </Entry>
 959     <Entry type="4" type_name="REG_DWORD">
 960         <Key>Software\\Policies\\Mozilla\\Firefox\\DisableSecurityBypass</Key>
 961         <ValueName>SafeBrowsing</ValueName>
 962         <Value>1</Value>
 963     </Entry>
 964     <Entry type="4" type_name="REG_DWORD">
 965         <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
 966         <ValueName>Enabled</ValueName>
 967         <Value>1</Value>
 968     </Entry>
 969     <Entry type="4" type_name="REG_DWORD">
 970         <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
 971         <ValueName>Locked</ValueName>
 972         <Value>1</Value>
 973     </Entry>
 974     <Entry type="1" type_name="REG_SZ">
 975         <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS</Key>
 976         <ValueName>ProviderURL</ValueName>
 977         <Value>URL_TO_ALTERNATE_PROVIDER</Value>
 978     </Entry>
 979     <Entry type="1" type_name="REG_SZ">
 980         <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS\\ExcludedDomains</Key>
 981         <ValueName>**delvals.</ValueName>
 982         <Value> </Value>
 983     </Entry>
 984     <Entry type="1" type_name="REG_SZ">
 985         <Key>Software\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS\\ExcludedDomains</Key>
 986         <ValueName>1</ValueName>
 987         <Value>example.com</Value>
 988     </Entry>
 989     <Entry type="4" type_name="REG_DWORD">
 990         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
 991         <ValueName>Value</ValueName>
 992         <Value>1</Value>
 993     </Entry>
 994     <Entry type="4" type_name="REG_DWORD">
 995         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
 996         <ValueName>Cryptomining</ValueName>
 997         <Value>1</Value>
 998     </Entry>
 999     <Entry type="4" type_name="REG_DWORD">
1000         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1001         <ValueName>Fingerprinting</ValueName>
1002         <Value>1</Value>
1003     </Entry>
1004     <Entry type="4" type_name="REG_DWORD">
1005         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection</Key>
1006         <ValueName>Locked</ValueName>
1007         <Value>1</Value>
1008     </Entry>
1009     <Entry type="1" type_name="REG_SZ">
1010         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection\\Exceptions</Key>
1011         <ValueName>**delvals.</ValueName>
1012         <Value> </Value>
1013     </Entry>
1014     <Entry type="1" type_name="REG_SZ">
1015         <Key>Software\\Policies\\Mozilla\\Firefox\\EnableTrackingProtection\\Exceptions</Key>
1016         <ValueName>1</ValueName>
1017         <Value>https://example.com</Value>
1018     </Entry>
1019     <Entry type="4" type_name="REG_DWORD">
1020         <Key>Software\\Policies\\Mozilla\\Firefox\\EncryptedMediaExtensions</Key>
1021         <ValueName>Enabled</ValueName>
1022         <Value>1</Value>
1023     </Entry>
1024     <Entry type="4" type_name="REG_DWORD">
1025         <Key>Software\\Policies\\Mozilla\\Firefox\\EncryptedMediaExtensions</Key>
1026         <ValueName>Locked</ValueName>
1027         <Value>1</Value>
1028     </Entry>
1029     <Entry type="1" type_name="REG_SZ">
1030         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1031         <ValueName>**delvals.</ValueName>
1032         <Value> </Value>
1033     </Entry>
1034     <Entry type="2" type_name="REG_EXPAND_SZ">
1035         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1036         <ValueName>1</ValueName>
1037         <Value>https://addons.mozilla.org/firefox/downloads/somefile.xpi</Value>
1038     </Entry>
1039     <Entry type="2" type_name="REG_EXPAND_SZ">
1040         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Install</Key>
1041         <ValueName>2</ValueName>
1042         <Value>//path/to/xpi</Value>
1043     </Entry>
1044     <Entry type="1" type_name="REG_SZ">
1045         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Locked</Key>
1046         <ValueName>**delvals.</ValueName>
1047         <Value> </Value>
1048     </Entry>
1049     <Entry type="1" type_name="REG_SZ">
1050         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Locked</Key>
1051         <ValueName>1</ValueName>
1052         <Value>addon_id@mozilla.org</Value>
1053     </Entry>
1054     <Entry type="1" type_name="REG_SZ">
1055         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Uninstall</Key>
1056         <ValueName>**delvals.</ValueName>
1057         <Value> </Value>
1058     </Entry>
1059     <Entry type="1" type_name="REG_SZ">
1060         <Key>Software\\Policies\\Mozilla\\Firefox\\Extensions\\Uninstall</Key>
1061         <ValueName>1</ValueName>
1062         <Value>bad_addon_id@mozilla.org</Value>
1063     </Entry>
1064     <Entry type="4" type_name="REG_DWORD">
1065         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1066         <ValueName>Search</ValueName>
1067         <Value>1</Value>
1068     </Entry>
1069     <Entry type="4" type_name="REG_DWORD">
1070         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1071         <ValueName>TopSites</ValueName>
1072         <Value>1</Value>
1073     </Entry>
1074     <Entry type="4" type_name="REG_DWORD">
1075         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1076         <ValueName>Highlights</ValueName>
1077         <Value>1</Value>
1078     </Entry>
1079     <Entry type="4" type_name="REG_DWORD">
1080         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1081         <ValueName>Pocket</ValueName>
1082         <Value>1</Value>
1083     </Entry>
1084     <Entry type="4" type_name="REG_DWORD">
1085         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1086         <ValueName>Snippets</ValueName>
1087         <Value>1</Value>
1088     </Entry>
1089     <Entry type="4" type_name="REG_DWORD">
1090         <Key>Software\\Policies\\Mozilla\\Firefox\\FirefoxHome</Key>
1091         <ValueName>Locked</ValueName>
1092         <Value>1</Value>
1093     </Entry>
1094     <Entry type="4" type_name="REG_DWORD">
1095         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin</Key>
1096         <ValueName>Default</ValueName>
1097         <Value>1</Value>
1098     </Entry>
1099     <Entry type="4" type_name="REG_DWORD">
1100         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin</Key>
1101         <ValueName>Locked</ValueName>
1102         <Value>1</Value>
1103     </Entry>
1104     <Entry type="1" type_name="REG_SZ">
1105         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Allow</Key>
1106         <ValueName>**delvals.</ValueName>
1107         <Value> </Value>
1108     </Entry>
1109     <Entry type="1" type_name="REG_SZ">
1110         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Allow</Key>
1111         <ValueName>1</ValueName>
1112         <Value>http://example.org/</Value>
1113     </Entry>
1114     <Entry type="1" type_name="REG_SZ">
1115         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Block</Key>
1116         <ValueName>**delvals.</ValueName>
1117         <Value> </Value>
1118     </Entry>
1119     <Entry type="1" type_name="REG_SZ">
1120         <Key>Software\\Policies\\Mozilla\\Firefox\\FlashPlugin\\Block</Key>
1121         <ValueName>1</ValueName>
1122         <Value>http://example.edu/</Value>
1123     </Entry>
1124     <Entry type="1" type_name="REG_SZ">
1125         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1126         <ValueName>StartPage</ValueName>
1127         <Value>homepage</Value>
1128     </Entry>
1129     <Entry type="1" type_name="REG_SZ">
1130         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1131         <ValueName>URL</ValueName>
1132         <Value>http://example.com/</Value>
1133     </Entry>
1134     <Entry type="4" type_name="REG_DWORD">
1135         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage</Key>
1136         <ValueName>Locked</ValueName>
1137         <Value>1</Value>
1138     </Entry>
1139     <Entry type="1" type_name="REG_SZ">
1140         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1141         <ValueName>**delvals.</ValueName>
1142         <Value> </Value>
1143     </Entry>
1144     <Entry type="1" type_name="REG_SZ">
1145         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1146         <ValueName>1</ValueName>
1147         <Value>http://example.org/</Value>
1148     </Entry>
1149     <Entry type="1" type_name="REG_SZ">
1150         <Key>Software\\Policies\\Mozilla\\Firefox\\Homepage\\Additional</Key>
1151         <ValueName>2</ValueName>
1152         <Value>http://example.edu/</Value>
1153     </Entry>
1154     <Entry type="4" type_name="REG_DWORD">
1155         <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission</Key>
1156         <ValueName>Default</ValueName>
1157         <Value>1</Value>
1158     </Entry>
1159     <Entry type="1" type_name="REG_SZ">
1160         <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1161         <ValueName>**delvals.</ValueName>
1162         <Value> </Value>
1163     </Entry>
1164     <Entry type="1" type_name="REG_SZ">
1165         <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1166         <ValueName>1</ValueName>
1167         <Value>http://example.org/</Value>
1168     </Entry>
1169     <Entry type="1" type_name="REG_SZ">
1170         <Key>Software\\Policies\\Mozilla\\Firefox\\InstallAddonsPermission\\Allow</Key>
1171         <ValueName>2</ValueName>
1172         <Value>http://example.edu/</Value>
1173     </Entry>
1174     <Entry type="1" type_name="REG_SZ">
1175         <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1176         <ValueName>**delvals.</ValueName>
1177         <Value> </Value>
1178     </Entry>
1179     <Entry type="1" type_name="REG_SZ">
1180         <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1181         <ValueName>1</ValueName>
1182         <Value>http://example.org/</Value>
1183     </Entry>
1184     <Entry type="1" type_name="REG_SZ">
1185         <Key>Software\\Policies\\Mozilla\\Firefox\\LocalFileLinks</Key>
1186         <ValueName>2</ValueName>
1187         <Value>http://example.edu/</Value>
1188     </Entry>
1189     <Entry type="4" type_name="REG_DWORD">
1190         <Key>Software\\Policies\\Mozilla\\Firefox\\PDFjs</Key>
1191         <ValueName>EnablePermissions</ValueName>
1192         <Value>1</Value>
1193     </Entry>
1194     <Entry type="4" type_name="REG_DWORD">
1195         <Key>Software\\Policies\\Mozilla\\Firefox\\PDFjs</Key>
1196         <ValueName>Enabled</ValueName>
1197         <Value>1</Value>
1198     </Entry>
1199     <Entry type="1" type_name="REG_SZ">
1200         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay</Key>
1201         <ValueName>Default</ValueName>
1202         <Value>block-audio</Value>
1203     </Entry>
1204     <Entry type="4" type_name="REG_DWORD">
1205         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay</Key>
1206         <ValueName>Locked</ValueName>
1207         <Value>1</Value>
1208     </Entry>
1209     <Entry type="1" type_name="REG_SZ">
1210         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Allow</Key>
1211         <ValueName>**delvals.</ValueName>
1212         <Value> </Value>
1213     </Entry>
1214     <Entry type="1" type_name="REG_SZ">
1215         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Allow</Key>
1216         <ValueName>1</ValueName>
1217         <Value>https://example.org</Value>
1218     </Entry>
1219     <Entry type="1" type_name="REG_SZ">
1220         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Block</Key>
1221         <ValueName>**delvals.</ValueName>
1222         <Value> </Value>
1223     </Entry>
1224     <Entry type="1" type_name="REG_SZ">
1225         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Autoplay\\Block</Key>
1226         <ValueName>1</ValueName>
1227         <Value>https://example.edu</Value>
1228     </Entry>
1229     <Entry type="4" type_name="REG_DWORD">
1230         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera</Key>
1231         <ValueName>BlockNewRequests</ValueName>
1232         <Value>1</Value>
1233     </Entry>
1234     <Entry type="4" type_name="REG_DWORD">
1235         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera</Key>
1236         <ValueName>Locked</ValueName>
1237         <Value>1</Value>
1238     </Entry>
1239     <Entry type="1" type_name="REG_SZ">
1240         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1241         <ValueName>**delvals.</ValueName>
1242         <Value> </Value>
1243     </Entry>
1244     <Entry type="1" type_name="REG_SZ">
1245         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1246         <ValueName>1</ValueName>
1247         <Value>https://example.org</Value>
1248     </Entry>
1249     <Entry type="1" type_name="REG_SZ">
1250         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Allow</Key>
1251         <ValueName>2</ValueName>
1252         <Value>https://example.org:1234</Value>
1253     </Entry>
1254     <Entry type="1" type_name="REG_SZ">
1255         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Block</Key>
1256         <ValueName>**delvals.</ValueName>
1257         <Value> </Value>
1258     </Entry>
1259     <Entry type="1" type_name="REG_SZ">
1260         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Camera\\Block</Key>
1261         <ValueName>1</ValueName>
1262         <Value>https://example.edu</Value>
1263     </Entry>
1264     <Entry type="4" type_name="REG_DWORD">
1265         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location</Key>
1266         <ValueName>BlockNewRequests</ValueName>
1267         <Value>1</Value>
1268     </Entry>
1269     <Entry type="4" type_name="REG_DWORD">
1270         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location</Key>
1271         <ValueName>Locked</ValueName>
1272         <Value>1</Value>
1273     </Entry>
1274     <Entry type="1" type_name="REG_SZ">
1275         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Allow</Key>
1276         <ValueName>**delvals.</ValueName>
1277         <Value> </Value>
1278     </Entry>
1279     <Entry type="1" type_name="REG_SZ">
1280         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Allow</Key>
1281         <ValueName>1</ValueName>
1282         <Value>https://example.org</Value>
1283     </Entry>
1284     <Entry type="1" type_name="REG_SZ">
1285         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Block</Key>
1286         <ValueName>**delvals.</ValueName>
1287         <Value> </Value>
1288     </Entry>
1289     <Entry type="1" type_name="REG_SZ">
1290         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Location\\Block</Key>
1291         <ValueName>1</ValueName>
1292         <Value>https://example.edu</Value>
1293     </Entry>
1294     <Entry type="4" type_name="REG_DWORD">
1295         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone</Key>
1296         <ValueName>BlockNewRequests</ValueName>
1297         <Value>1</Value>
1298     </Entry>
1299     <Entry type="4" type_name="REG_DWORD">
1300         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone</Key>
1301         <ValueName>Locked</ValueName>
1302         <Value>1</Value>
1303     </Entry>
1304     <Entry type="1" type_name="REG_SZ">
1305         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Allow</Key>
1306         <ValueName>**delvals.</ValueName>
1307         <Value> </Value>
1308     </Entry>
1309     <Entry type="1" type_name="REG_SZ">
1310         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Allow</Key>
1311         <ValueName>1</ValueName>
1312         <Value>https://example.org</Value>
1313     </Entry>
1314     <Entry type="1" type_name="REG_SZ">
1315         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Block</Key>
1316         <ValueName>**delvals.</ValueName>
1317         <Value> </Value>
1318     </Entry>
1319     <Entry type="1" type_name="REG_SZ">
1320         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Microphone\\Block</Key>
1321         <ValueName>1</ValueName>
1322         <Value>https://example.edu</Value>
1323     </Entry>
1324     <Entry type="4" type_name="REG_DWORD">
1325         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications</Key>
1326         <ValueName>BlockNewRequests</ValueName>
1327         <Value>1</Value>
1328     </Entry>
1329     <Entry type="4" type_name="REG_DWORD">
1330         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications</Key>
1331         <ValueName>Locked</ValueName>
1332         <Value>1</Value>
1333     </Entry>
1334     <Entry type="1" type_name="REG_SZ">
1335         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Allow</Key>
1336         <ValueName>**delvals.</ValueName>
1337         <Value> </Value>
1338     </Entry>
1339     <Entry type="1" type_name="REG_SZ">
1340         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Allow</Key>
1341         <ValueName>1</ValueName>
1342         <Value>https://example.org</Value>
1343     </Entry>
1344     <Entry type="1" type_name="REG_SZ">
1345         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Block</Key>
1346         <ValueName>**delvals.</ValueName>
1347         <Value> </Value>
1348     </Entry>
1349     <Entry type="1" type_name="REG_SZ">
1350         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\Notifications\\Block</Key>
1351         <ValueName>1</ValueName>
1352         <Value>https://example.edu</Value>
1353     </Entry>
1354     <Entry type="4" type_name="REG_DWORD">
1355         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality</Key>
1356         <ValueName>BlockNewRequests</ValueName>
1357         <Value>1</Value>
1358     </Entry>
1359     <Entry type="4" type_name="REG_DWORD">
1360         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality</Key>
1361         <ValueName>Locked</ValueName>
1362         <Value>1</Value>
1363     </Entry>
1364     <Entry type="1" type_name="REG_SZ">
1365         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Allow</Key>
1366         <ValueName>**delvals.</ValueName>
1367         <Value> </Value>
1368     </Entry>
1369     <Entry type="1" type_name="REG_SZ">
1370         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Allow</Key>
1371         <ValueName>1</ValueName>
1372         <Value>https://example.org</Value>
1373     </Entry>
1374     <Entry type="1" type_name="REG_SZ">
1375         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Block</Key>
1376         <ValueName>**delvals.</ValueName>
1377         <Value> </Value>
1378     </Entry>
1379     <Entry type="1" type_name="REG_SZ">
1380         <Key>Software\\Policies\\Mozilla\\Firefox\\Permissions\\VirtualReality\\Block</Key>
1381         <ValueName>1</ValueName>
1382         <Value>https://example.edu</Value>
1383     </Entry>
1384     <Entry type="4" type_name="REG_DWORD">
1385         <Key>Software\\Policies\\Mozilla\\Firefox\\PictureInPicture</Key>
1386         <ValueName>Enabled</ValueName>
1387         <Value>1</Value>
1388     </Entry>
1389     <Entry type="4" type_name="REG_DWORD">
1390         <Key>Software\\Policies\\Mozilla\\Firefox\\PictureInPicture</Key>
1391         <ValueName>Locked</ValueName>
1392         <Value>1</Value>
1393     </Entry>
1394     <Entry type="4" type_name="REG_DWORD">
1395         <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking</Key>
1396         <ValueName>Default</ValueName>
1397         <Value>1</Value>
1398     </Entry>
1399     <Entry type="4" type_name="REG_DWORD">
1400         <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking</Key>
1401         <ValueName>Locked</ValueName>
1402         <Value>1</Value>
1403     </Entry>
1404     <Entry type="1" type_name="REG_SZ">
1405         <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1406         <ValueName>**delvals.</ValueName>
1407         <Value> </Value>
1408     </Entry>
1409     <Entry type="1" type_name="REG_SZ">
1410         <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1411         <ValueName>1</ValueName>
1412         <Value>http://example.org/</Value>
1413     </Entry>
1414     <Entry type="1" type_name="REG_SZ">
1415         <Key>Software\\Policies\\Mozilla\\Firefox\\PopupBlocking\\Allow</Key>
1416         <ValueName>2</ValueName>
1417         <Value>http://example.edu/</Value>
1418     </Entry>
1419     <Entry type="4" type_name="REG_DWORD">
1420         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1421         <ValueName>Locked</ValueName>
1422         <Value>1</Value>
1423     </Entry>
1424     <Entry type="1" type_name="REG_SZ">
1425         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1426         <ValueName>Mode</ValueName>
1427         <Value>autoDetect</Value>
1428     </Entry>
1429     <Entry type="1" type_name="REG_SZ">
1430         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1431         <ValueName>HTTPProxy</ValueName>
1432         <Value>hostname</Value>
1433     </Entry>
1434     <Entry type="4" type_name="REG_DWORD">
1435         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1436         <ValueName>UseHTTPProxyForAllProtocols</ValueName>
1437         <Value>1</Value>
1438     </Entry>
1439     <Entry type="1" type_name="REG_SZ">
1440         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1441         <ValueName>SSLProxy</ValueName>
1442         <Value>hostname</Value>
1443     </Entry>
1444     <Entry type="1" type_name="REG_SZ">
1445         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1446         <ValueName>FTPProxy</ValueName>
1447         <Value>hostname</Value>
1448     </Entry>
1449     <Entry type="1" type_name="REG_SZ">
1450         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1451         <ValueName>SOCKSProxy</ValueName>
1452         <Value>hostname</Value>
1453     </Entry>
1454     <Entry type="4" type_name="REG_DWORD">
1455         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1456         <ValueName>SOCKSVersion</ValueName>
1457         <Value>5</Value>
1458     </Entry>
1459     <Entry type="1" type_name="REG_SZ">
1460         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1461         <ValueName>Passthrough</ValueName>
1462         <Value>&lt;local&gt;</Value>
1463     </Entry>
1464     <Entry type="1" type_name="REG_SZ">
1465         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1466         <ValueName>AutoConfigURL</ValueName>
1467         <Value>URL_TO_AUTOCONFIG</Value>
1468     </Entry>
1469     <Entry type="4" type_name="REG_DWORD">
1470         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1471         <ValueName>AutoLogin</ValueName>
1472         <Value>1</Value>
1473     </Entry>
1474     <Entry type="4" type_name="REG_DWORD">
1475         <Key>Software\\Policies\\Mozilla\\Firefox\\Proxy</Key>
1476         <ValueName>UseProxyForDNS</ValueName>
1477         <Value>1</Value>
1478     </Entry>
1479     <Entry type="4" type_name="REG_DWORD">
1480         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1481         <ValueName>SanitizeOnShutdown</ValueName>
1482         <Value>1</Value>
1483     </Entry>
1484     <Entry type="1" type_name="REG_SZ">
1485         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines</Key>
1486         <ValueName>Default</ValueName>
1487         <Value>Google</Value>
1488     </Entry>
1489     <Entry type="4" type_name="REG_DWORD">
1490         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines</Key>
1491         <ValueName>PreventInstalls</ValueName>
1492         <Value>1</Value>
1493     </Entry>
1494     <Entry type="1" type_name="REG_SZ">
1495         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1496         <ValueName>Name</ValueName>
1497         <Value>Example1</Value>
1498     </Entry>
1499     <Entry type="1" type_name="REG_SZ">
1500         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1501         <ValueName>URLTemplate</ValueName>
1502         <Value>https://www.example.org/q={searchTerms}</Value>
1503     </Entry>
1504     <Entry type="1" type_name="REG_SZ">
1505         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1506         <ValueName>Method</ValueName>
1507         <Value>POST</Value>
1508     </Entry>
1509     <Entry type="1" type_name="REG_SZ">
1510         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1511         <ValueName>IconURL</ValueName>
1512         <Value>https://www.example.org/favicon.ico</Value>
1513     </Entry>
1514     <Entry type="1" type_name="REG_SZ">
1515         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1516         <ValueName>Alias</ValueName>
1517         <Value>example</Value>
1518     </Entry>
1519     <Entry type="1" type_name="REG_SZ">
1520         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1521         <ValueName>Description</ValueName>
1522         <Value>Description</Value>
1523     </Entry>
1524     <Entry type="1" type_name="REG_SZ">
1525         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1526         <ValueName>SuggestURLTemplate</ValueName>
1527         <Value>https://www.example.org/suggestions/q={searchTerms}</Value>
1528     </Entry>
1529     <Entry type="1" type_name="REG_SZ">
1530         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Add\\1</Key>
1531         <ValueName>PostData</ValueName>
1532         <Value>name=value&amp;q={searchTerms}</Value>
1533     </Entry>
1534     <Entry type="1" type_name="REG_SZ">
1535         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Remove</Key>
1536         <ValueName>**delvals.</ValueName>
1537         <Value> </Value>
1538     </Entry>
1539     <Entry type="1" type_name="REG_SZ">
1540         <Key>Software\\Policies\\Mozilla\\Firefox\\SearchEngines\\Remove</Key>
1541         <ValueName>1</ValueName>
1542         <Value>Bing</Value>
1543     </Entry>
1544     <Entry type="1" type_name="REG_SZ">
1545         <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1546         <ValueName>Title</ValueName>
1547         <Value>Support Menu</Value>
1548     </Entry>
1549     <Entry type="1" type_name="REG_SZ">
1550         <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1551         <ValueName>URL</ValueName>
1552         <Value>http://example.com/support</Value>
1553     </Entry>
1554     <Entry type="1" type_name="REG_SZ">
1555         <Key>Software\\Policies\\Mozilla\\Firefox\\SupportMenu</Key>
1556         <ValueName>AccessKey</ValueName>
1557         <Value>S</Value>
1558     </Entry>
1559     <Entry type="4" type_name="REG_DWORD">
1560         <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1561         <ValueName>ExtensionRecommendations</ValueName>
1562         <Value>1</Value>
1563     </Entry>
1564     <Entry type="4" type_name="REG_DWORD">
1565         <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1566         <ValueName>FeatureRecommendations</ValueName>
1567         <Value>1</Value>
1568     </Entry>
1569     <Entry type="4" type_name="REG_DWORD">
1570         <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1571         <ValueName>WhatsNew</ValueName>
1572         <Value>1</Value>
1573     </Entry>
1574     <Entry type="4" type_name="REG_DWORD">
1575         <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1576         <ValueName>UrlbarInterventions</ValueName>
1577         <Value>1</Value>
1578     </Entry>
1579     <Entry type="4" type_name="REG_DWORD">
1580         <Key>Software\\Policies\\Mozilla\\Firefox\\UserMessaging</Key>
1581         <ValueName>SkipOnboarding</ValueName>
1582         <Value>1</Value>
1583     </Entry>
1584     <Entry type="1" type_name="REG_SZ">
1585         <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Block</Key>
1586         <ValueName>**delvals.</ValueName>
1587         <Value> </Value>
1588     </Entry>
1589     <Entry type="1" type_name="REG_SZ">
1590         <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Block</Key>
1591         <ValueName>1</ValueName>
1592         <Value>&lt;all_urls&gt;</Value>
1593     </Entry>
1594     <Entry type="1" type_name="REG_SZ">
1595         <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Exceptions</Key>
1596         <ValueName>**delvals.</ValueName>
1597         <Value> </Value>
1598     </Entry>
1599     <Entry type="1" type_name="REG_SZ">
1600         <Key>Software\\Policies\\Mozilla\\Firefox\\WebsiteFilter\\Exceptions</Key>
1601         <ValueName>1</ValueName>
1602         <Value>http://example.org/*</Value>
1603     </Entry>
1604     <Entry type="1" type_name="REG_SZ">
1605         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1606         <ValueName>AllowedDomainsForApps</ValueName>
1607         <Value>managedfirefox.com,example.com</Value>
1608     </Entry>
1609     <Entry type="4" type_name="REG_DWORD">
1610         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1611         <ValueName>BackgroundAppUpdate</ValueName>
1612         <Value>1</Value>
1613     </Entry>
1614     <Entry type="4" type_name="REG_DWORD">
1615         <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates</Key>
1616         <ValueName>ImportEnterpriseRoots</ValueName>
1617         <Value>1</Value>
1618     </Entry>
1619     <Entry type="1" type_name="REG_SZ">
1620         <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1621         <ValueName>**delvals.</ValueName>
1622         <Value> </Value>
1623     </Entry>
1624     <Entry type="1" type_name="REG_SZ">
1625         <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1626         <ValueName>1</ValueName>
1627         <Value>cert1.der</Value>
1628     </Entry>
1629     <Entry type="1" type_name="REG_SZ">
1630         <Key>Software\\Policies\\Mozilla\\Firefox\\Certificates\\Install</Key>
1631         <ValueName>2</ValueName>
1632         <Value>/home/username/cert2.pem</Value>
1633     </Entry>
1634     <Entry type="1" type_name="REG_SZ">
1635         <Key>Software\\Policies\\Mozilla\\Firefox\\SecurityDevices</Key>
1636         <ValueName>NAME_OF_DEVICE</ValueName>
1637         <Value>PATH_TO_LIBRARY_FOR_DEVICE</Value>
1638     </Entry>
1639     <Entry type="4" type_name="REG_DWORD">
1640         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1641         <ValueName>ShowHomeButton</ValueName>
1642         <Value>1</Value>
1643     </Entry>
1644     <Entry type="7" type_name="REG_MULTI_SZ">
1645         <Key>Software\\Policies\\Mozilla\\Firefox</Key>
1646         <ValueName>AutoLaunchProtocolsFromOrigins</ValueName>
1647         <Value>[{&quot;protocol&quot;: &quot;zoommtg&quot;, &quot;allowed_origins&quot;: [&quot;https://somesite.zoom.us&quot;]}]</Value>
1648     </Entry>
1649 </PolFile>
1650 """
1651
1652 firefox_json_expected = \
1653 """
1654 {
1655   "policies": {
1656     "AppAutoUpdate": true,
1657     "AllowedDomainsForApps": "managedfirefox.com,example.com",
1658     "AppUpdateURL": "https://yoursite.com",
1659     "Authentication": {
1660       "SPNEGO": [
1661         "mydomain.com",
1662         "https://myotherdomain.com"
1663       ],
1664       "Delegated": [
1665         "mydomain.com",
1666         "https://myotherdomain.com"
1667       ],
1668       "NTLM": [
1669         "mydomain.com",
1670         "https://myotherdomain.com"
1671       ],
1672       "AllowNonFQDN": {
1673         "SPNEGO": true,
1674         "NTLM": true
1675       },
1676       "AllowProxies": {
1677         "SPNEGO": true,
1678         "NTLM": true
1679       },
1680       "Locked": true,
1681       "PrivateBrowsing": true
1682     },
1683     "AutoLaunchProtocolsFromOrigins": [
1684       {
1685         "protocol": "zoommtg",
1686         "allowed_origins": [
1687           "https://somesite.zoom.us"
1688         ]
1689       }
1690     ],
1691     "BackgroundAppUpdate": true,
1692     "BlockAboutAddons": true,
1693     "BlockAboutConfig": true,
1694     "BlockAboutProfiles": true,
1695     "BlockAboutSupport": true,
1696     "Bookmarks": [
1697       {
1698         "Title": "Example",
1699         "URL": "https://example.com",
1700         "Favicon": "https://example.com/favicon.ico",
1701         "Placement": "menu",
1702         "Folder": "FolderName"
1703       },
1704       {
1705         "Title": "Samba",
1706         "URL": "www.samba.org",
1707         "Favicon": "",
1708         "Placement": "toolbar",
1709         "Folder": ""
1710       }
1711     ],
1712     "CaptivePortal": true,
1713     "Certificates": {
1714       "ImportEnterpriseRoots": true,
1715       "Install": [
1716         "cert1.der",
1717         "/home/username/cert2.pem"
1718       ]
1719     },
1720     "Cookies": {
1721       "Allow": [
1722         "http://example.org/"
1723       ],
1724       "AllowSession": [
1725         "http://example.edu/"
1726       ],
1727       "Block": [
1728         "http://example.edu/"
1729       ],
1730       "Default": true,
1731       "AcceptThirdParty": "never",
1732       "ExpireAtSessionEnd": true,
1733       "RejectTracker": true,
1734       "Locked": true
1735     },
1736     "DisableSetDesktopBackground": true,
1737     "DisableMasterPasswordCreation": true,
1738     "DisableAppUpdate": true,
1739     "DisableBuiltinPDFViewer": true,
1740     "DisabledCiphers": {
1741       "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true,
1742       "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true,
1743       "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true,
1744       "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true,
1745       "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true,
1746       "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true,
1747       "TLS_RSA_WITH_AES_128_CBC_SHA": true,
1748       "TLS_RSA_WITH_AES_256_CBC_SHA": true,
1749       "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true,
1750       "TLS_RSA_WITH_AES_128_GCM_SHA256": true,
1751       "TLS_RSA_WITH_AES_256_GCM_SHA384": true
1752     },
1753     "DisableDefaultBrowserAgent": true,
1754     "DisableDeveloperTools": true,
1755     "DisableFeedbackCommands": true,
1756     "DisableFirefoxScreenshots": true,
1757     "DisableFirefoxAccounts": true,
1758     "DisableFirefoxStudies": true,
1759     "DisableForgetButton": true,
1760     "DisableFormHistory": true,
1761     "DisablePasswordReveal": true,
1762     "DisablePocket": true,
1763     "DisablePrivateBrowsing": true,
1764     "DisableProfileImport": true,
1765     "DisableProfileRefresh": true,
1766     "DisableSafeMode": true,
1767     "DisableSecurityBypass": {
1768       "InvalidCertificate": true,
1769       "SafeBrowsing": true
1770     },
1771     "DisableSystemAddonUpdate": true,
1772     "DisableTelemetry": true,
1773     "DisplayBookmarksToolbar": true,
1774     "DisplayMenuBar": "default-on",
1775     "DNSOverHTTPS": {
1776       "Enabled": true,
1777       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
1778       "Locked": true,
1779       "ExcludedDomains": [
1780         "example.com"
1781       ]
1782     },
1783     "DontCheckDefaultBrowser": true,
1784     "EnableTrackingProtection": {
1785       "Value": true,
1786       "Locked": true,
1787       "Cryptomining": true,
1788       "Fingerprinting": true,
1789       "Exceptions": [
1790         "https://example.com"
1791       ]
1792     },
1793     "EncryptedMediaExtensions": {
1794       "Enabled": true,
1795       "Locked": true
1796     },
1797     "Extensions": {
1798       "Install": [
1799         "https://addons.mozilla.org/firefox/downloads/somefile.xpi",
1800         "//path/to/xpi"
1801       ],
1802       "Uninstall": [
1803         "bad_addon_id@mozilla.org"
1804       ],
1805       "Locked": [
1806         "addon_id@mozilla.org"
1807       ]
1808     },
1809     "ExtensionSettings": {
1810       "*": {
1811         "blocked_install_message": "Custom error message.",
1812         "install_sources": [
1813           "about:addons",
1814           "https://addons.mozilla.org/"
1815         ],
1816         "installation_mode": "blocked",
1817         "allowed_types": [
1818           "extension"
1819         ]
1820       },
1821       "uBlock0@raymondhill.net": {
1822         "installation_mode": "force_installed",
1823         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
1824       },
1825       "https-everywhere@eff.org": {
1826         "installation_mode": "allowed"
1827       }
1828     },
1829     "ExtensionUpdate": true,
1830     "FlashPlugin": {
1831       "Allow": [
1832         "http://example.org/"
1833       ],
1834       "Block": [
1835         "http://example.edu/"
1836       ],
1837       "Default": true,
1838       "Locked": true
1839     },
1840     "Handlers": {
1841       "mimeTypes": {
1842         "application/msword": {
1843           "action": "useSystemDefault",
1844           "ask": true
1845         }
1846       },
1847       "schemes": {
1848         "mailto": {
1849           "action": "useHelperApp",
1850           "ask": true,
1851           "handlers": [
1852             {
1853               "name": "Gmail",
1854               "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
1855             }
1856           ]
1857         }
1858       },
1859       "extensions": {
1860         "pdf": {
1861           "action": "useHelperApp",
1862           "ask": true,
1863           "handlers": [
1864             {
1865               "name": "Adobe Acrobat",
1866               "path": "/usr/bin/acroread"
1867             }
1868           ]
1869         }
1870       }
1871     },
1872     "FirefoxHome": {
1873       "Search": true,
1874       "TopSites": true,
1875       "Highlights": true,
1876       "Pocket": true,
1877       "Snippets": true,
1878       "Locked": true
1879     },
1880     "HardwareAcceleration": true,
1881     "Homepage": {
1882       "URL": "http://example.com/",
1883       "Locked": true,
1884       "Additional": [
1885         "http://example.org/",
1886         "http://example.edu/"
1887       ],
1888       "StartPage": "homepage"
1889     },
1890     "InstallAddonsPermission": {
1891       "Allow": [
1892         "http://example.org/",
1893         "http://example.edu/"
1894       ],
1895       "Default": true
1896     },
1897     "LocalFileLinks": [
1898       "http://example.org/",
1899       "http://example.edu/"
1900     ],
1901     "ManagedBookmarks": [
1902       {
1903         "toplevel_name": "My managed bookmarks folder"
1904       },
1905       {
1906         "url": "example.com",
1907         "name": "Example"
1908       },
1909       {
1910         "name": "Mozilla links",
1911         "children": [
1912           {
1913             "url": "https://mozilla.org",
1914             "name": "Mozilla.org"
1915           },
1916           {
1917             "url": "https://support.mozilla.org/",
1918             "name": "SUMO"
1919           }
1920         ]
1921       }
1922     ],
1923     "PrimaryPassword": true,
1924     "NoDefaultBookmarks": true,
1925     "OfferToSaveLogins": true,
1926     "OfferToSaveLoginsDefault": true,
1927     "OverrideFirstRunPage": "http://example.org",
1928     "OverridePostUpdatePage": "http://example.org",
1929     "PasswordManagerEnabled": true,
1930     "PSFjs": {
1931       "Enabled": true,
1932       "EnablePermissions": true
1933     },
1934     "Permissions": {
1935       "Camera": {
1936         "Allow": [
1937           "https://example.org",
1938           "https://example.org:1234"
1939         ],
1940         "Block": [
1941           "https://example.edu"
1942         ],
1943         "BlockNewRequests": true,
1944         "Locked": true
1945       },
1946       "Microphone": {
1947         "Allow": [
1948           "https://example.org"
1949         ],
1950         "Block": [
1951           "https://example.edu"
1952         ],
1953         "BlockNewRequests": true,
1954         "Locked": true
1955       },
1956       "Location": {
1957         "Allow": [
1958           "https://example.org"
1959         ],
1960         "Block": [
1961           "https://example.edu"
1962         ],
1963         "BlockNewRequests": true,
1964         "Locked": true
1965       },
1966       "Notifications": {
1967         "Allow": [
1968           "https://example.org"
1969         ],
1970         "Block": [
1971           "https://example.edu"
1972         ],
1973         "BlockNewRequests": true,
1974         "Locked": true
1975       },
1976       "Autoplay": {
1977         "Allow": [
1978           "https://example.org"
1979         ],
1980         "Block": [
1981           "https://example.edu"
1982         ],
1983         "Default": "block-audio",
1984         "Locked": true
1985       },
1986       "VirtualReality": {
1987         "Allow": [
1988           "https://example.org"
1989         ],
1990         "Block": [
1991           "https://example.edu"
1992         ],
1993         "BlockNewRequests": true,
1994         "Locked": true
1995       }
1996     },
1997     "PictureInPicture": {
1998       "Enabled": true,
1999       "Locked": true
2000     },
2001     "PopupBlocking": {
2002       "Allow": [
2003         "http://example.org/",
2004         "http://example.edu/"
2005       ],
2006       "Default": true,
2007       "Locked": true
2008     },
2009     "Preferences": {
2010       "accessibility.force_disabled": {
2011         "Value": 1,
2012         "Status": "default"
2013       },
2014       "browser.cache.disk.parent_directory": {
2015         "Value": "SOME_NATIVE_PATH",
2016         "Status": "user"
2017       },
2018       "browser.tabs.warnOnClose": {
2019         "Value": false,
2020         "Status": "locked"
2021       }
2022     },
2023     "PromptForDownloadLocation": true,
2024     "Proxy": {
2025       "Mode": "autoDetect",
2026       "Locked": true,
2027       "HTTPProxy": "hostname",
2028       "UseHTTPProxyForAllProtocols": true,
2029       "SSLProxy": "hostname",
2030       "FTPProxy": "hostname",
2031       "SOCKSProxy": "hostname",
2032       "SOCKSVersion": 5,
2033       "Passthrough": "<local>",
2034       "AutoConfigURL": "URL_TO_AUTOCONFIG",
2035       "AutoLogin": true,
2036       "UseProxyForDNS": true
2037     },
2038     "SanitizeOnShutdown": true,
2039     "SearchEngines": {
2040       "Add": [
2041         {
2042           "Name": "Example1",
2043           "URLTemplate": "https://www.example.org/q={searchTerms}",
2044           "Method": "POST",
2045           "IconURL": "https://www.example.org/favicon.ico",
2046           "Alias": "example",
2047           "Description": "Description",
2048           "PostData": "name=value&q={searchTerms}",
2049           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
2050         }
2051       ],
2052       "Remove": [
2053         "Bing"
2054       ],
2055       "Default": "Google",
2056       "PreventInstalls": true
2057     },
2058     "SearchSuggestEnabled": true,
2059     "SecurityDevices": {
2060       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
2061     },
2062     "ShowHomeButton": true,
2063     "SSLVersionMax": "tls1.3",
2064     "SSLVersionMin": "tls1.3",
2065     "SupportMenu": {
2066       "Title": "Support Menu",
2067       "URL": "http://example.com/support",
2068       "AccessKey": "S"
2069     },
2070     "UserMessaging": {
2071       "WhatsNew": true,
2072       "ExtensionRecommendations": true,
2073       "FeatureRecommendations": true,
2074       "UrlbarInterventions": true,
2075       "SkipOnboarding": true
2076     },
2077     "WebsiteFilter": {
2078       "Block": [
2079         "<all_urls>"
2080       ],
2081       "Exceptions": [
2082         "http://example.org/*"
2083       ]
2084     },
2085     "DefaultDownloadDirectory": "${home}/Downloads",
2086     "DownloadDirectory": "${home}/Downloads",
2087     "NetworkPrediction": true,
2088     "NewTabPage": true,
2089     "RequestedLocales": ["de", "en-US"],
2090     "SearchBar": "unified"
2091   }
2092 }
2093 """
2094
2095 chromium_reg_pol = \
2096 b"""
2097 <?xml version="1.0" encoding="utf-8"?>
2098 <PolFile num_entries="418" signature="PReg" version="1">
2099     <Entry type="4" type_name="REG_DWORD">
2100         <Key>Software\Policies\Google\Chrome</Key>
2101         <ValueName>AbusiveExperienceInterventionEnforce</ValueName>
2102         <Value>1</Value>
2103     </Entry>
2104     <Entry type="4" type_name="REG_DWORD">
2105         <Key>Software\Policies\Google\Chrome</Key>
2106         <ValueName>AccessibilityImageLabelsEnabled</ValueName>
2107         <Value>0</Value>
2108     </Entry>
2109     <Entry type="4" type_name="REG_DWORD">
2110         <Key>Software\Policies\Google\Chrome</Key>
2111         <ValueName>AdditionalDnsQueryTypesEnabled</ValueName>
2112         <Value>1</Value>
2113     </Entry>
2114     <Entry type="4" type_name="REG_DWORD">
2115         <Key>Software\Policies\Google\Chrome</Key>
2116         <ValueName>AdsSettingForIntrusiveAdsSites</ValueName>
2117         <Value>1</Value>
2118     </Entry>
2119     <Entry type="4" type_name="REG_DWORD">
2120         <Key>Software\Policies\Google\Chrome</Key>
2121         <ValueName>AdvancedProtectionAllowed</ValueName>
2122         <Value>1</Value>
2123     </Entry>
2124     <Entry type="4" type_name="REG_DWORD">
2125         <Key>Software\Policies\Google\Chrome</Key>
2126         <ValueName>AllowCrossOriginAuthPrompt</ValueName>
2127         <Value>0</Value>
2128     </Entry>
2129     <Entry type="4" type_name="REG_DWORD">
2130         <Key>Software\Policies\Google\Chrome</Key>
2131         <ValueName>AllowDeletingBrowserHistory</ValueName>
2132         <Value>1</Value>
2133     </Entry>
2134     <Entry type="4" type_name="REG_DWORD">
2135         <Key>Software\Policies\Google\Chrome</Key>
2136         <ValueName>AllowDinosaurEasterEgg</ValueName>
2137         <Value>0</Value>
2138     </Entry>
2139     <Entry type="4" type_name="REG_DWORD">
2140         <Key>Software\Policies\Google\Chrome</Key>
2141         <ValueName>AllowFileSelectionDialogs</ValueName>
2142         <Value>1</Value>
2143     </Entry>
2144     <Entry type="4" type_name="REG_DWORD">
2145         <Key>Software\Policies\Google\Chrome</Key>
2146         <ValueName>AllowSyncXHRInPageDismissal</ValueName>
2147         <Value>0</Value>
2148     </Entry>
2149     <Entry type="1" type_name="REG_SZ">
2150         <Key>Software\Policies\Google\Chrome</Key>
2151         <ValueName>AllowedDomainsForApps</ValueName>
2152         <Value>managedchrome.com,example.com</Value>
2153     </Entry>
2154     <Entry type="4" type_name="REG_DWORD">
2155         <Key>Software\Policies\Google\Chrome</Key>
2156         <ValueName>AlternateErrorPagesEnabled</ValueName>
2157         <Value>1</Value>
2158     </Entry>
2159     <Entry type="1" type_name="REG_SZ">
2160         <Key>Software\Policies\Google\Chrome</Key>
2161         <ValueName>AlternativeBrowserPath</ValueName>
2162         <Value>${ie}</Value>
2163     </Entry>
2164     <Entry type="4" type_name="REG_DWORD">
2165         <Key>Software\Policies\Google\Chrome</Key>
2166         <ValueName>AlwaysOpenPdfExternally</ValueName>
2167         <Value>1</Value>
2168     </Entry>
2169     <Entry type="4" type_name="REG_DWORD">
2170         <Key>Software\Policies\Google\Chrome</Key>
2171         <ValueName>AmbientAuthenticationInPrivateModesEnabled</ValueName>
2172         <Value>0</Value>
2173     </Entry>
2174     <Entry type="4" type_name="REG_DWORD">
2175         <Key>Software\Policies\Google\Chrome</Key>
2176         <ValueName>AppCacheForceEnabled</ValueName>
2177         <Value>0</Value>
2178     </Entry>
2179     <Entry type="1" type_name="REG_SZ">
2180         <Key>Software\Policies\Google\Chrome</Key>
2181         <ValueName>ApplicationLocaleValue</ValueName>
2182         <Value>en</Value>
2183     </Entry>
2184     <Entry type="4" type_name="REG_DWORD">
2185         <Key>Software\Policies\Google\Chrome</Key>
2186         <ValueName>AudioCaptureAllowed</ValueName>
2187         <Value>0</Value>
2188     </Entry>
2189     <Entry type="4" type_name="REG_DWORD">
2190         <Key>Software\Policies\Google\Chrome</Key>
2191         <ValueName>AudioProcessHighPriorityEnabled</ValueName>
2192         <Value>1</Value>
2193     </Entry>
2194     <Entry type="4" type_name="REG_DWORD">
2195         <Key>Software\Policies\Google\Chrome</Key>
2196         <ValueName>AudioSandboxEnabled</ValueName>
2197         <Value>1</Value>
2198     </Entry>
2199     <Entry type="1" type_name="REG_SZ">
2200         <Key>Software\Policies\Google\Chrome</Key>
2201         <ValueName>AuthNegotiateDelegateAllowlist</ValueName>
2202         <Value>foobar.example.com</Value>
2203     </Entry>
2204     <Entry type="1" type_name="REG_SZ">
2205         <Key>Software\Policies\Google\Chrome</Key>
2206         <ValueName>AuthSchemes</ValueName>
2207         <Value>basic,digest,ntlm,negotiate</Value>
2208     </Entry>
2209     <Entry type="1" type_name="REG_SZ">
2210         <Key>Software\Policies\Google\Chrome</Key>
2211         <ValueName>AuthServerAllowlist</ValueName>
2212         <Value>*.example.com,example.com</Value>
2213     </Entry>
2214     <Entry type="1" type_name="REG_SZ">
2215         <Key>Software\Policies\Google\Chrome</Key>
2216         <ValueName>AutoLaunchProtocolsFromOrigins</ValueName>
2217         <Value>[{&quot;allowed_origins&quot;: [&quot;example.com&quot;, &quot;http://www.example.com:8080&quot;], &quot;protocol&quot;: &quot;spotify&quot;}, {&quot;allowed_origins&quot;: [&quot;https://example.com&quot;, &quot;https://.mail.example.com&quot;], &quot;protocol&quot;: &quot;teams&quot;}, {&quot;allowed_origins&quot;: [&quot;*&quot;], &quot;protocol&quot;: &quot;outlook&quot;}]</Value>
2218     </Entry>
2219     <Entry type="4" type_name="REG_DWORD">
2220         <Key>Software\Policies\Google\Chrome</Key>
2221         <ValueName>AutofillAddressEnabled</ValueName>
2222         <Value>0</Value>
2223     </Entry>
2224     <Entry type="4" type_name="REG_DWORD">
2225         <Key>Software\Policies\Google\Chrome</Key>
2226         <ValueName>AutofillCreditCardEnabled</ValueName>
2227         <Value>0</Value>
2228     </Entry>
2229     <Entry type="4" type_name="REG_DWORD">
2230         <Key>Software\Policies\Google\Chrome</Key>
2231         <ValueName>AutoplayAllowed</ValueName>
2232         <Value>1</Value>
2233     </Entry>
2234     <Entry type="4" type_name="REG_DWORD">
2235         <Key>Software\Policies\Google\Chrome</Key>
2236         <ValueName>BackgroundModeEnabled</ValueName>
2237         <Value>1</Value>
2238     </Entry>
2239     <Entry type="4" type_name="REG_DWORD">
2240         <Key>Software\Policies\Google\Chrome</Key>
2241         <ValueName>BasicAuthOverHttpEnabled</ValueName>
2242         <Value>0</Value>
2243     </Entry>
2244     <Entry type="4" type_name="REG_DWORD">
2245         <Key>Software\Policies\Google\Chrome</Key>
2246         <ValueName>BlockExternalExtensions</ValueName>
2247         <Value>1</Value>
2248     </Entry>
2249     <Entry type="4" type_name="REG_DWORD">
2250         <Key>Software\Policies\Google\Chrome</Key>
2251         <ValueName>BlockThirdPartyCookies</ValueName>
2252         <Value>0</Value>
2253     </Entry>
2254     <Entry type="4" type_name="REG_DWORD">
2255         <Key>Software\Policies\Google\Chrome</Key>
2256         <ValueName>BookmarkBarEnabled</ValueName>
2257         <Value>1</Value>
2258     </Entry>
2259     <Entry type="4" type_name="REG_DWORD">
2260         <Key>Software\Policies\Google\Chrome</Key>
2261         <ValueName>BrowserAddPersonEnabled</ValueName>
2262         <Value>1</Value>
2263     </Entry>
2264     <Entry type="4" type_name="REG_DWORD">
2265         <Key>Software\Policies\Google\Chrome</Key>
2266         <ValueName>BrowserGuestModeEnabled</ValueName>
2267         <Value>1</Value>
2268     </Entry>
2269     <Entry type="4" type_name="REG_DWORD">
2270         <Key>Software\Policies\Google\Chrome</Key>
2271         <ValueName>BrowserGuestModeEnforced</ValueName>
2272         <Value>1</Value>
2273     </Entry>
2274     <Entry type="4" type_name="REG_DWORD">
2275         <Key>Software\Policies\Google\Chrome</Key>
2276         <ValueName>BrowserLabsEnabled</ValueName>
2277         <Value>0</Value>
2278     </Entry>
2279     <Entry type="4" type_name="REG_DWORD">
2280         <Key>Software\Policies\Google\Chrome</Key>
2281         <ValueName>BrowserNetworkTimeQueriesEnabled</ValueName>
2282         <Value>1</Value>
2283     </Entry>
2284     <Entry type="4" type_name="REG_DWORD">
2285         <Key>Software\Policies\Google\Chrome</Key>
2286         <ValueName>BrowserSignin</ValueName>
2287         <Value>2</Value>
2288     </Entry>
2289     <Entry type="1" type_name="REG_SZ">
2290         <Key>Software\Policies\Google\Chrome</Key>
2291         <ValueName>BrowserSwitcherChromePath</ValueName>
2292         <Value>${chrome}</Value>
2293     </Entry>
2294     <Entry type="4" type_name="REG_DWORD">
2295         <Key>Software\Policies\Google\Chrome</Key>
2296         <ValueName>BrowserSwitcherDelay</ValueName>
2297         <Value>10000</Value>
2298     </Entry>
2299     <Entry type="4" type_name="REG_DWORD">
2300         <Key>Software\Policies\Google\Chrome</Key>
2301         <ValueName>BrowserSwitcherEnabled</ValueName>
2302         <Value>1</Value>
2303     </Entry>
2304     <Entry type="1" type_name="REG_SZ">
2305         <Key>Software\Policies\Google\Chrome</Key>
2306         <ValueName>BrowserSwitcherExternalGreylistUrl</ValueName>
2307         <Value>http://example.com/greylist.xml</Value>
2308     </Entry>
2309     <Entry type="1" type_name="REG_SZ">
2310         <Key>Software\Policies\Google\Chrome</Key>
2311         <ValueName>BrowserSwitcherExternalSitelistUrl</ValueName>
2312         <Value>http://example.com/sitelist.xml</Value>
2313     </Entry>
2314     <Entry type="4" type_name="REG_DWORD">
2315         <Key>Software\Policies\Google\Chrome</Key>
2316         <ValueName>BrowserSwitcherKeepLastChromeTab</ValueName>
2317         <Value>0</Value>
2318     </Entry>
2319     <Entry type="4" type_name="REG_DWORD">
2320         <Key>Software\Policies\Google\Chrome</Key>
2321         <ValueName>BrowserSwitcherUseIeSitelist</ValueName>
2322         <Value>1</Value>
2323     </Entry>
2324     <Entry type="1" type_name="REG_SZ">
2325         <Key>Software\Policies\Google\Chrome</Key>
2326         <ValueName>BrowserThemeColor</ValueName>
2327         <Value>#FFFFFF</Value>
2328     </Entry>
2329     <Entry type="1" type_name="REG_SZ">
2330         <Key>Software\Policies\Google\Chrome</Key>
2331         <ValueName>BrowsingDataLifetime</ValueName>
2332         <Value>[{&quot;data_types&quot;: [&quot;browsing_history&quot;], &quot;time_to_live_in_hours&quot;: 24}, {&quot;data_types&quot;: [&quot;password_signin&quot;, &quot;autofill&quot;], &quot;time_to_live_in_hours&quot;: 12}]</Value>
2333     </Entry>
2334     <Entry type="4" type_name="REG_DWORD">
2335         <Key>Software\Policies\Google\Chrome</Key>
2336         <ValueName>BuiltInDnsClientEnabled</ValueName>
2337         <Value>1</Value>
2338     </Entry>
2339     <Entry type="4" type_name="REG_DWORD">
2340         <Key>Software\Policies\Google\Chrome</Key>
2341         <ValueName>CECPQ2Enabled</ValueName>
2342         <Value>1</Value>
2343     </Entry>
2344     <Entry type="4" type_name="REG_DWORD">
2345         <Key>Software\Policies\Google\Chrome</Key>
2346         <ValueName>ChromeCleanupEnabled</ValueName>
2347         <Value>1</Value>
2348     </Entry>
2349     <Entry type="4" type_name="REG_DWORD">
2350         <Key>Software\Policies\Google\Chrome</Key>
2351         <ValueName>ChromeCleanupReportingEnabled</ValueName>
2352         <Value>1</Value>
2353     </Entry>
2354     <Entry type="4" type_name="REG_DWORD">
2355         <Key>Software\Policies\Google\Chrome</Key>
2356         <ValueName>ChromeVariations</ValueName>
2357         <Value>1</Value>
2358     </Entry>
2359     <Entry type="4" type_name="REG_DWORD">
2360         <Key>Software\Policies\Google\Chrome</Key>
2361         <ValueName>ClickToCallEnabled</ValueName>
2362         <Value>1</Value>
2363     </Entry>
2364     <Entry type="4" type_name="REG_DWORD">
2365         <Key>Software\Policies\Google\Chrome</Key>
2366         <ValueName>CloudManagementEnrollmentMandatory</ValueName>
2367         <Value>1</Value>
2368     </Entry>
2369     <Entry type="1" type_name="REG_SZ">
2370         <Key>Software\Policies\Google\Chrome</Key>
2371         <ValueName>CloudManagementEnrollmentToken</ValueName>
2372         <Value>37185d02-e055-11e7-80c1-9a214cf093ae</Value>
2373     </Entry>
2374     <Entry type="4" type_name="REG_DWORD">
2375         <Key>Software\Policies\Google\Chrome</Key>
2376         <ValueName>CloudPolicyOverridesPlatformPolicy</ValueName>
2377         <Value>0</Value>
2378     </Entry>
2379     <Entry type="4" type_name="REG_DWORD">
2380         <Key>Software\Policies\Google\Chrome</Key>
2381         <ValueName>CloudPrintProxyEnabled</ValueName>
2382         <Value>1</Value>
2383     </Entry>
2384     <Entry type="4" type_name="REG_DWORD">
2385         <Key>Software\Policies\Google\Chrome</Key>
2386         <ValueName>CloudPrintSubmitEnabled</ValueName>
2387         <Value>1</Value>
2388     </Entry>
2389     <Entry type="4" type_name="REG_DWORD">
2390         <Key>Software\Policies\Google\Chrome</Key>
2391         <ValueName>CloudUserPolicyMerge</ValueName>
2392         <Value>1</Value>
2393     </Entry>
2394     <Entry type="4" type_name="REG_DWORD">
2395         <Key>Software\Policies\Google\Chrome</Key>
2396         <ValueName>CommandLineFlagSecurityWarningsEnabled</ValueName>
2397         <Value>1</Value>
2398     </Entry>
2399     <Entry type="4" type_name="REG_DWORD">
2400         <Key>Software\Policies\Google\Chrome</Key>
2401         <ValueName>ComponentUpdatesEnabled</ValueName>
2402         <Value>1</Value>
2403     </Entry>
2404     <Entry type="4" type_name="REG_DWORD">
2405         <Key>Software\Policies\Google\Chrome</Key>
2406         <ValueName>DNSInterceptionChecksEnabled</ValueName>
2407         <Value>1</Value>
2408     </Entry>
2409     <Entry type="4" type_name="REG_DWORD">
2410         <Key>Software\Policies\Google\Chrome</Key>
2411         <ValueName>DefaultBrowserSettingEnabled</ValueName>
2412         <Value>1</Value>
2413     </Entry>
2414     <Entry type="4" type_name="REG_DWORD">
2415         <Key>Software\Policies\Google\Chrome</Key>
2416         <ValueName>DefaultCookiesSetting</ValueName>
2417         <Value>1</Value>
2418     </Entry>
2419     <Entry type="4" type_name="REG_DWORD">
2420         <Key>Software\Policies\Google\Chrome</Key>
2421         <ValueName>DefaultFileHandlingGuardSetting</ValueName>
2422         <Value>2</Value>
2423     </Entry>
2424     <Entry type="4" type_name="REG_DWORD">
2425         <Key>Software\Policies\Google\Chrome</Key>
2426         <ValueName>DefaultFileSystemReadGuardSetting</ValueName>
2427         <Value>2</Value>
2428     </Entry>
2429     <Entry type="4" type_name="REG_DWORD">
2430         <Key>Software\Policies\Google\Chrome</Key>
2431         <ValueName>DefaultFileSystemWriteGuardSetting</ValueName>
2432         <Value>2</Value>
2433     </Entry>
2434     <Entry type="4" type_name="REG_DWORD">
2435         <Key>Software\Policies\Google\Chrome</Key>
2436         <ValueName>DefaultGeolocationSetting</ValueName>
2437         <Value>1</Value>
2438     </Entry>
2439     <Entry type="4" type_name="REG_DWORD">
2440         <Key>Software\Policies\Google\Chrome</Key>
2441         <ValueName>DefaultImagesSetting</ValueName>
2442         <Value>1</Value>
2443     </Entry>
2444     <Entry type="4" type_name="REG_DWORD">
2445         <Key>Software\Policies\Google\Chrome</Key>
2446         <ValueName>DefaultInsecureContentSetting</ValueName>
2447         <Value>2</Value>
2448     </Entry>
2449     <Entry type="4" type_name="REG_DWORD">
2450         <Key>Software\Policies\Google\Chrome</Key>
2451         <ValueName>DefaultJavaScriptSetting</ValueName>
2452         <Value>1</Value>
2453     </Entry>
2454     <Entry type="4" type_name="REG_DWORD">
2455         <Key>Software\Policies\Google\Chrome</Key>
2456         <ValueName>DefaultNotificationsSetting</ValueName>
2457         <Value>2</Value>
2458     </Entry>
2459     <Entry type="4" type_name="REG_DWORD">
2460         <Key>Software\Policies\Google\Chrome</Key>
2461         <ValueName>DefaultPopupsSetting</ValueName>
2462         <Value>1</Value>
2463     </Entry>
2464     <Entry type="1" type_name="REG_SZ">
2465         <Key>Software\Policies\Google\Chrome</Key>
2466         <ValueName>DefaultPrinterSelection</ValueName>
2467         <Value>{ &quot;kind&quot;: &quot;cloud&quot;, &quot;idPattern&quot;: &quot;.*public&quot;, &quot;namePattern&quot;: &quot;.*Color&quot; }</Value>
2468     </Entry>
2469     <Entry type="4" type_name="REG_DWORD">
2470         <Key>Software\Policies\Google\Chrome</Key>
2471         <ValueName>DefaultSearchProviderContextMenuAccessAllowed</ValueName>
2472         <Value>1</Value>
2473     </Entry>
2474     <Entry type="4" type_name="REG_DWORD">
2475         <Key>Software\Policies\Google\Chrome</Key>
2476         <ValueName>DefaultSearchProviderEnabled</ValueName>
2477         <Value>1</Value>
2478     </Entry>
2479     <Entry type="1" type_name="REG_SZ">
2480         <Key>Software\Policies\Google\Chrome</Key>
2481         <ValueName>DefaultSearchProviderIconURL</ValueName>
2482         <Value>https://search.my.company/favicon.ico</Value>
2483     </Entry>
2484     <Entry type="1" type_name="REG_SZ">
2485         <Key>Software\Policies\Google\Chrome</Key>
2486         <ValueName>DefaultSearchProviderImageURL</ValueName>
2487         <Value>https://search.my.company/searchbyimage/upload</Value>
2488     </Entry>
2489     <Entry type="1" type_name="REG_SZ">
2490         <Key>Software\Policies\Google\Chrome</Key>
2491         <ValueName>DefaultSearchProviderImageURLPostParams</ValueName>
2492         <Value>content={imageThumbnail},url={imageURL},sbisrc={SearchSource}</Value>
2493     </Entry>
2494     <Entry type="1" type_name="REG_SZ">
2495         <Key>Software\Policies\Google\Chrome</Key>
2496         <ValueName>DefaultSearchProviderKeyword</ValueName>
2497         <Value>mis</Value>
2498     </Entry>
2499     <Entry type="1" type_name="REG_SZ">
2500         <Key>Software\Policies\Google\Chrome</Key>
2501         <ValueName>DefaultSearchProviderName</ValueName>
2502         <Value>My Intranet Search</Value>
2503     </Entry>
2504     <Entry type="1" type_name="REG_SZ">
2505         <Key>Software\Policies\Google\Chrome</Key>
2506         <ValueName>DefaultSearchProviderNewTabURL</ValueName>
2507         <Value>https://search.my.company/newtab</Value>
2508     </Entry>
2509     <Entry type="1" type_name="REG_SZ">
2510         <Key>Software\Policies\Google\Chrome</Key>
2511         <ValueName>DefaultSearchProviderSearchURL</ValueName>
2512         <Value>https://search.my.company/search?q={searchTerms}</Value>
2513     </Entry>
2514     <Entry type="1" type_name="REG_SZ">
2515         <Key>Software\Policies\Google\Chrome</Key>
2516         <ValueName>DefaultSearchProviderSearchURLPostParams</ValueName>
2517         <Value>q={searchTerms},ie=utf-8,oe=utf-8</Value>
2518     </Entry>
2519     <Entry type="1" type_name="REG_SZ">
2520         <Key>Software\Policies\Google\Chrome</Key>
2521         <ValueName>DefaultSearchProviderSuggestURL</ValueName>
2522         <Value>https://search.my.company/suggest?q={searchTerms}</Value>
2523     </Entry>
2524     <Entry type="1" type_name="REG_SZ">
2525         <Key>Software\Policies\Google\Chrome</Key>
2526         <ValueName>DefaultSearchProviderSuggestURLPostParams</ValueName>
2527         <Value>q={searchTerms},ie=utf-8,oe=utf-8</Value>
2528     </Entry>
2529     <Entry type="4" type_name="REG_DWORD">
2530         <Key>Software\Policies\Google\Chrome</Key>
2531         <ValueName>DefaultSensorsSetting</ValueName>
2532         <Value>2</Value>
2533     </Entry>
2534     <Entry type="4" type_name="REG_DWORD">
2535         <Key>Software\Policies\Google\Chrome</Key>
2536         <ValueName>DefaultSerialGuardSetting</ValueName>
2537         <Value>2</Value>
2538     </Entry>
2539     <Entry type="4" type_name="REG_DWORD">
2540         <Key>Software\Policies\Google\Chrome</Key>
2541         <ValueName>DefaultWebBluetoothGuardSetting</ValueName>
2542         <Value>2</Value>
2543     </Entry>
2544     <Entry type="4" type_name="REG_DWORD">
2545         <Key>Software\Policies\Google\Chrome</Key>
2546         <ValueName>DefaultWebUsbGuardSetting</ValueName>
2547         <Value>2</Value>
2548     </Entry>
2549     <Entry type="4" type_name="REG_DWORD">
2550         <Key>Software\Policies\Google\Chrome</Key>
2551         <ValueName>DeveloperToolsAvailability</ValueName>
2552         <Value>2</Value>
2553     </Entry>
2554     <Entry type="4" type_name="REG_DWORD">
2555         <Key>Software\Policies\Google\Chrome</Key>
2556         <ValueName>Disable3DAPIs</ValueName>
2557         <Value>0</Value>
2558     </Entry>
2559     <Entry type="4" type_name="REG_DWORD">
2560         <Key>Software\Policies\Google\Chrome</Key>
2561         <ValueName>DisableAuthNegotiateCnameLookup</ValueName>
2562         <Value>0</Value>
2563     </Entry>
2564     <Entry type="4" type_name="REG_DWORD">
2565         <Key>Software\Policies\Google\Chrome</Key>
2566         <ValueName>DisablePrintPreview</ValueName>
2567         <Value>0</Value>
2568     </Entry>
2569     <Entry type="4" type_name="REG_DWORD">
2570         <Key>Software\Policies\Google\Chrome</Key>
2571         <ValueName>DisableSafeBrowsingProceedAnyway</ValueName>
2572         <Value>1</Value>
2573     </Entry>
2574     <Entry type="4" type_name="REG_DWORD">
2575         <Key>Software\Policies\Google\Chrome</Key>
2576         <ValueName>DisableScreenshots</ValueName>
2577         <Value>1</Value>
2578     </Entry>
2579     <Entry type="1" type_name="REG_SZ">
2580         <Key>Software\Policies\Google\Chrome</Key>
2581         <ValueName>DiskCacheDir</ValueName>
2582         <Value>${user_home}/Chrome_cache</Value>
2583     </Entry>
2584     <Entry type="4" type_name="REG_DWORD">
2585         <Key>Software\Policies\Google\Chrome</Key>
2586         <ValueName>DiskCacheSize</ValueName>
2587         <Value>104857600</Value>
2588     </Entry>
2589     <Entry type="1" type_name="REG_SZ">
2590         <Key>Software\Policies\Google\Chrome</Key>
2591         <ValueName>DnsOverHttpsMode</ValueName>
2592         <Value>off</Value>
2593     </Entry>
2594     <Entry type="1" type_name="REG_SZ">
2595         <Key>Software\Policies\Google\Chrome</Key>
2596         <ValueName>DnsOverHttpsTemplates</ValueName>
2597         <Value>https://dns.example.net/dns-query{?dns}</Value>
2598     </Entry>
2599     <Entry type="1" type_name="REG_SZ">
2600         <Key>Software\Policies\Google\Chrome</Key>
2601         <ValueName>DownloadDirectory</ValueName>
2602         <Value>/home/${user_name}/Downloads</Value>
2603     </Entry>
2604     <Entry type="4" type_name="REG_DWORD">
2605         <Key>Software\Policies\Google\Chrome</Key>
2606         <ValueName>DownloadRestrictions</ValueName>
2607         <Value>2</Value>
2608     </Entry>
2609     <Entry type="4" type_name="REG_DWORD">
2610         <Key>Software\Policies\Google\Chrome</Key>
2611         <ValueName>EditBookmarksEnabled</ValueName>
2612         <Value>0</Value>
2613     </Entry>
2614     <Entry type="4" type_name="REG_DWORD">
2615         <Key>Software\Policies\Google\Chrome</Key>
2616         <ValueName>EnableAuthNegotiatePort</ValueName>
2617         <Value>0</Value>
2618     </Entry>
2619     <Entry type="4" type_name="REG_DWORD">
2620         <Key>Software\Policies\Google\Chrome</Key>
2621         <ValueName>EnableDeprecatedPrivetPrinting</ValueName>
2622         <Value>1</Value>
2623     </Entry>
2624     <Entry type="4" type_name="REG_DWORD">
2625         <Key>Software\Policies\Google\Chrome</Key>
2626         <ValueName>EnableMediaRouter</ValueName>
2627         <Value>1</Value>
2628     </Entry>
2629     <Entry type="4" type_name="REG_DWORD">
2630         <Key>Software\Policies\Google\Chrome</Key>
2631         <ValueName>EnableOnlineRevocationChecks</ValueName>
2632         <Value>0</Value>
2633     </Entry>
2634     <Entry type="4" type_name="REG_DWORD">
2635         <Key>Software\Policies\Google\Chrome</Key>
2636         <ValueName>EnterpriseHardwarePlatformAPIEnabled</ValueName>
2637         <Value>1</Value>
2638     </Entry>
2639     <Entry type="1" type_name="REG_SZ">
2640         <Key>Software\Policies\Google\Chrome</Key>
2641         <ValueName>ExtensionSettings</ValueName>
2642         <Value>{&quot;*&quot;: {&quot;allowed_types&quot;: [&quot;hosted_app&quot;], &quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;blocked_permissions&quot;: [&quot;downloads&quot;, &quot;bookmarks&quot;], &quot;install_sources&quot;: [&quot;https://company-intranet/chromeapps&quot;], &quot;installation_mode&quot;: &quot;blocked&quot;, &quot;runtime_allowed_hosts&quot;: [&quot;*://good.example.com&quot;], &quot;runtime_blocked_hosts&quot;: [&quot;*://*.example.com&quot;]}, &quot;abcdefghijklmnopabcdefghijklmnop&quot;: {&quot;blocked_permissions&quot;: [&quot;history&quot;], &quot;installation_mode&quot;: &quot;allowed&quot;, &quot;minimum_version_required&quot;: &quot;1.0.1&quot;, &quot;toolbar_pin&quot;: &quot;force_pinned&quot;}, &quot;bcdefghijklmnopabcdefghijklmnopa&quot;: {&quot;allowed_permissions&quot;: [&quot;downloads&quot;], &quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;runtime_allowed_hosts&quot;: [&quot;*://good.example.com&quot;], &quot;runtime_blocked_hosts&quot;: [&quot;*://*.example.com&quot;], &quot;update_url&quot;: &quot;https://example.com/update_url&quot;}, &quot;cdefghijklmnopabcdefghijklmnopab&quot;: {&quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;installation_mode&quot;: &quot;blocked&quot;}, &quot;defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd&quot;: {&quot;blocked_install_message&quot;: &quot;Custom error message.&quot;, &quot;installation_mode&quot;: &quot;blocked&quot;}, &quot;fghijklmnopabcdefghijklmnopabcde&quot;: {&quot;blocked_install_message&quot;: &quot;Custom removal message.&quot;, &quot;installation_mode&quot;: &quot;removed&quot;}, &quot;ghijklmnopabcdefghijklmnopabcdef&quot;: {&quot;installation_mode&quot;: &quot;force_installed&quot;, &quot;override_update_url&quot;: true, &quot;update_url&quot;: &quot;https://example.com/update_url&quot;}, &quot;update_url:https://www.example.com/update.xml&quot;: {&quot;allowed_permissions&quot;: [&quot;downloads&quot;], &quot;blocked_permissions&quot;: [&quot;wallpaper&quot;], &quot;installation_mode&quot;: &quot;allowed&quot;}}</Value>
2643     </Entry>
2644     <Entry type="4" type_name="REG_DWORD">
2645         <Key>Software\Policies\Google\Chrome</Key>
2646         <ValueName>ExternalProtocolDialogShowAlwaysOpenCheckbox</ValueName>
2647         <Value>1</Value>
2648     </Entry>
2649     <Entry type="4" type_name="REG_DWORD">
2650         <Key>Software\Policies\Google\Chrome</Key>
2651         <ValueName>FetchKeepaliveDurationSecondsOnShutdown</ValueName>
2652         <Value>1</Value>
2653     </Entry>
2654     <Entry type="4" type_name="REG_DWORD">
2655         <Key>Software\Policies\Google\Chrome</Key>
2656         <ValueName>ForceEphemeralProfiles</ValueName>
2657         <Value>1</Value>
2658     </Entry>
2659     <Entry type="4" type_name="REG_DWORD">
2660         <Key>Software\Policies\Google\Chrome</Key>
2661         <ValueName>ForceGoogleSafeSearch</ValueName>
2662         <Value>0</Value>
2663     </Entry>
2664     <Entry type="4" type_name="REG_DWORD">
2665         <Key>Software\Policies\Google\Chrome</Key>
2666         <ValueName>ForceYouTubeRestrict</ValueName>
2667         <Value>0</Value>
2668     </Entry>
2669     <Entry type="4" type_name="REG_DWORD">
2670         <Key>Software\Policies\Google\Chrome</Key>
2671         <ValueName>FullscreenAllowed</ValueName>
2672         <Value>1</Value>
2673     </Entry>
2674     <Entry type="4" type_name="REG_DWORD">
2675         <Key>Software\Policies\Google\Chrome</Key>
2676         <ValueName>GloballyScopeHTTPAuthCacheEnabled</ValueName>
2677         <Value>0</Value>
2678     </Entry>
2679     <Entry type="4" type_name="REG_DWORD">
2680         <Key>Software\Policies\Google\Chrome</Key>
2681         <ValueName>HardwareAccelerationModeEnabled</ValueName>
2682         <Value>1</Value>
2683     </Entry>
2684     <Entry type="4" type_name="REG_DWORD">
2685         <Key>Software\Policies\Google\Chrome</Key>
2686         <ValueName>HeadlessMode</ValueName>
2687         <Value>2</Value>
2688     </Entry>
2689     <Entry type="4" type_name="REG_DWORD">
2690         <Key>Software\Policies\Google\Chrome</Key>
2691         <ValueName>HideWebStoreIcon</ValueName>
2692         <Value>1</Value>
2693     </Entry>
2694     <Entry type="4" type_name="REG_DWORD">
2695         <Key>Software\Policies\Google\Chrome</Key>
2696         <ValueName>HomepageIsNewTabPage</ValueName>
2697         <Value>1</Value>
2698     </Entry>
2699     <Entry type="1" type_name="REG_SZ">
2700         <Key>Software\Policies\Google\Chrome</Key>
2701         <ValueName>HomepageLocation</ValueName>
2702         <Value>https://www.chromium.org</Value>
2703     </Entry>
2704     <Entry type="4" type_name="REG_DWORD">
2705         <Key>Software\Policies\Google\Chrome</Key>
2706         <ValueName>ImportAutofillFormData</ValueName>
2707         <Value>1</Value>
2708     </Entry>
2709     <Entry type="4" type_name="REG_DWORD">
2710         <Key>Software\Policies\Google\Chrome</Key>
2711         <ValueName>ImportBookmarks</ValueName>
2712         <Value>1</Value>
2713     </Entry>
2714     <Entry type="4" type_name="REG_DWORD">
2715         <Key>Software\Policies\Google\Chrome</Key>
2716         <ValueName>ImportHistory</ValueName>
2717         <Value>1</Value>
2718     </Entry>
2719     <Entry type="4" type_name="REG_DWORD">
2720         <Key>Software\Policies\Google\Chrome</Key>
2721         <ValueName>ImportHomepage</ValueName>
2722         <Value>1</Value>
2723     </Entry>
2724     <Entry type="4" type_name="REG_DWORD">
2725         <Key>Software\Policies\Google\Chrome</Key>
2726         <ValueName>ImportSavedPasswords</ValueName>
2727         <Value>1</Value>
2728     </Entry>
2729     <Entry type="4" type_name="REG_DWORD">
2730         <Key>Software\Policies\Google\Chrome</Key>
2731         <ValueName>ImportSearchEngine</ValueName>
2732         <Value>1</Value>
2733     </Entry>
2734     <Entry type="4" type_name="REG_DWORD">
2735         <Key>Software\Policies\Google\Chrome</Key>
2736         <ValueName>IncognitoModeAvailability</ValueName>
2737         <Value>1</Value>
2738     </Entry>
2739     <Entry type="4" type_name="REG_DWORD">
2740         <Key>Software\Policies\Google\Chrome</Key>
2741         <ValueName>InsecureFormsWarningsEnabled</ValueName>
2742         <Value>1</Value>
2743     </Entry>
2744     <Entry type="4" type_name="REG_DWORD">
2745         <Key>Software\Policies\Google\Chrome</Key>
2746         <ValueName>InsecurePrivateNetworkRequestsAllowed</ValueName>
2747         <Value>0</Value>
2748     </Entry>
2749     <Entry type="4" type_name="REG_DWORD">
2750         <Key>Software\Policies\Google\Chrome</Key>
2751         <ValueName>IntensiveWakeUpThrottlingEnabled</ValueName>
2752         <Value>1</Value>
2753     </Entry>
2754     <Entry type="4" type_name="REG_DWORD">
2755         <Key>Software\Policies\Google\Chrome</Key>
2756         <ValueName>IntranetRedirectBehavior</ValueName>
2757         <Value>1</Value>
2758     </Entry>
2759     <Entry type="1" type_name="REG_SZ">
2760         <Key>Software\Policies\Google\Chrome</Key>
2761         <ValueName>IsolateOrigins</ValueName>
2762         <Value>https://example.com/,https://othersite.org/</Value>
2763     </Entry>
2764     <Entry type="1" type_name="REG_SZ">
2765         <Key>Software\Policies\Google\Chrome</Key>
2766         <ValueName>ManagedBookmarks</ValueName>
2767         <Value>[{&quot;toplevel_name&quot;: &quot;My managed bookmarks folder&quot;}, {&quot;name&quot;: &quot;Google&quot;, &quot;url&quot;: &quot;google.com&quot;}, {&quot;name&quot;: &quot;Youtube&quot;, &quot;url&quot;: &quot;youtube.com&quot;}, {&quot;children&quot;: [{&quot;name&quot;: &quot;Chromium&quot;, &quot;url&quot;: &quot;chromium.org&quot;}, {&quot;name&quot;: &quot;Chromium Developers&quot;, &quot;url&quot;: &quot;dev.chromium.org&quot;}], &quot;name&quot;: &quot;Chrome links&quot;}]</Value>
2768     </Entry>
2769     <Entry type="1" type_name="REG_SZ">
2770         <Key>Software\Policies\Google\Chrome</Key>
2771         <ValueName>ManagedConfigurationPerOrigin</ValueName>
2772         <Value>[{&quot;managed_configuration_hash&quot;: &quot;asd891jedasd12ue9h&quot;, &quot;managed_configuration_url&quot;: &quot;https://gstatic.google.com/configuration.json&quot;, &quot;origin&quot;: &quot;https://www.google.com&quot;}, {&quot;managed_configuration_hash&quot;: &quot;djio12easd89u12aws&quot;, &quot;managed_configuration_url&quot;: &quot;https://gstatic.google.com/configuration2.json&quot;, &quot;origin&quot;: &quot;https://www.example.com&quot;}]</Value>
2773     </Entry>
2774     <Entry type="4" type_name="REG_DWORD">
2775         <Key>Software\Policies\Google\Chrome</Key>
2776         <ValueName>MaxConnectionsPerProxy</ValueName>
2777         <Value>32</Value>
2778     </Entry>
2779     <Entry type="4" type_name="REG_DWORD">
2780         <Key>Software\Policies\Google\Chrome</Key>
2781         <ValueName>MaxInvalidationFetchDelay</ValueName>
2782         <Value>10000</Value>
2783     </Entry>
2784     <Entry type="4" type_name="REG_DWORD">
2785         <Key>Software\Policies\Google\Chrome</Key>
2786         <ValueName>MediaRecommendationsEnabled</ValueName>
2787         <Value>1</Value>
2788     </Entry>
2789     <Entry type="4" type_name="REG_DWORD">
2790         <Key>Software\Policies\Google\Chrome</Key>
2791         <ValueName>MediaRouterCastAllowAllIPs</ValueName>
2792         <Value>0</Value>
2793     </Entry>
2794     <Entry type="4" type_name="REG_DWORD">
2795         <Key>Software\Policies\Google\Chrome</Key>
2796         <ValueName>MetricsReportingEnabled</ValueName>
2797         <Value>1</Value>
2798     </Entry>
2799     <Entry type="4" type_name="REG_DWORD">
2800         <Key>Software\Policies\Google\Chrome</Key>
2801         <ValueName>NTPCardsVisible</ValueName>
2802         <Value>1</Value>
2803     </Entry>
2804     <Entry type="4" type_name="REG_DWORD">
2805         <Key>Software\Policies\Google\Chrome</Key>
2806         <ValueName>NTPCustomBackgroundEnabled</ValueName>
2807         <Value>1</Value>
2808     </Entry>
2809     <Entry type="4" type_name="REG_DWORD">
2810         <Key>Software\Policies\Google\Chrome</Key>
2811         <ValueName>NativeMessagingUserLevelHosts</ValueName>
2812         <Value>0</Value>
2813     </Entry>
2814     <Entry type="4" type_name="REG_DWORD">
2815         <Key>Software\Policies\Google\Chrome</Key>
2816         <ValueName>NetworkPredictionOptions</ValueName>
2817         <Value>1</Value>
2818     </Entry>
2819     <Entry type="1" type_name="REG_SZ">
2820         <Key>Software\Policies\Google\Chrome</Key>
2821         <ValueName>NewTabPageLocation</ValueName>
2822         <Value>https://www.chromium.org</Value>
2823     </Entry>
2824     <Entry type="4" type_name="REG_DWORD">
2825         <Key>Software\Policies\Google\Chrome</Key>
2826         <ValueName>PasswordLeakDetectionEnabled</ValueName>
2827         <Value>1</Value>
2828     </Entry>
2829     <Entry type="4" type_name="REG_DWORD">
2830         <Key>Software\Policies\Google\Chrome</Key>
2831         <ValueName>PasswordManagerEnabled</ValueName>
2832         <Value>1</Value>
2833     </Entry>
2834     <Entry type="1" type_name="REG_SZ">
2835         <Key>Software\Policies\Google\Chrome</Key>
2836         <ValueName>PasswordProtectionChangePasswordURL</ValueName>
2837         <Value>https://mydomain.com/change_password.html</Value>
2838     </Entry>
2839     <Entry type="4" type_name="REG_DWORD">
2840         <Key>Software\Policies\Google\Chrome</Key>
2841         <ValueName>PasswordProtectionWarningTrigger</ValueName>
2842         <Value>1</Value>
2843     </Entry>
2844     <Entry type="4" type_name="REG_DWORD">
2845         <Key>Software\Policies\Google\Chrome</Key>
2846         <ValueName>PaymentMethodQueryEnabled</ValueName>
2847         <Value>1</Value>
2848     </Entry>
2849     <Entry type="4" type_name="REG_DWORD">
2850         <Key>Software\Policies\Google\Chrome</Key>
2851         <ValueName>PolicyAtomicGroupsEnabled</ValueName>
2852         <Value>1</Value>
2853     </Entry>
2854     <Entry type="4" type_name="REG_DWORD">
2855         <Key>Software\Policies\Google\Chrome</Key>
2856         <ValueName>PolicyRefreshRate</ValueName>
2857         <Value>3600000</Value>
2858     </Entry>
2859     <Entry type="4" type_name="REG_DWORD">
2860         <Key>Software\Policies\Google\Chrome</Key>
2861         <ValueName>PrintHeaderFooter</ValueName>
2862         <Value>0</Value>
2863     </Entry>
2864     <Entry type="4" type_name="REG_DWORD">
2865         <Key>Software\Policies\Google\Chrome</Key>
2866         <ValueName>PrintPreviewUseSystemDefaultPrinter</ValueName>
2867         <Value>0</Value>
2868     </Entry>
2869     <Entry type="4" type_name="REG_DWORD">
2870         <Key>Software\Policies\Google\Chrome</Key>
2871         <ValueName>PrintRasterizationMode</ValueName>
2872         <Value>1</Value>
2873     </Entry>
2874     <Entry type="1" type_name="REG_SZ">
2875         <Key>Software\Policies\Google\Chrome</Key>
2876         <ValueName>PrintingAllowedBackgroundGraphicsModes</ValueName>
2877         <Value>enabled</Value>
2878     </Entry>
2879     <Entry type="1" type_name="REG_SZ">
2880         <Key>Software\Policies\Google\Chrome</Key>
2881         <ValueName>PrintingBackgroundGraphicsDefault</ValueName>
2882         <Value>enabled</Value>
2883     </Entry>
2884     <Entry type="4" type_name="REG_DWORD">
2885         <Key>Software\Policies\Google\Chrome</Key>
2886         <ValueName>PrintingEnabled</ValueName>
2887         <Value>1</Value>
2888     </Entry>
2889     <Entry type="1" type_name="REG_SZ">
2890         <Key>Software\Policies\Google\Chrome</Key>
2891         <ValueName>PrintingPaperSizeDefault</ValueName>
2892         <Value>{&quot;custom_size&quot;: {&quot;height&quot;: 297000, &quot;width&quot;: 210000}, &quot;name&quot;: &quot;custom&quot;}</Value>
2893     </Entry>
2894     <Entry type="4" type_name="REG_DWORD">
2895         <Key>Software\Policies\Google\Chrome</Key>
2896         <ValueName>ProfilePickerOnStartupAvailability</ValueName>
2897         <Value>0</Value>
2898     </Entry>
2899     <Entry type="4" type_name="REG_DWORD">
2900         <Key>Software\Policies\Google\Chrome</Key>
2901         <ValueName>PromotionalTabsEnabled</ValueName>
2902         <Value>0</Value>
2903     </Entry>
2904     <Entry type="4" type_name="REG_DWORD">
2905         <Key>Software\Policies\Google\Chrome</Key>
2906         <ValueName>PromptForDownloadLocation</ValueName>
2907         <Value>0</Value>
2908     </Entry>
2909     <Entry type="1" type_name="REG_SZ">
2910         <Key>Software\Policies\Google\Chrome</Key>
2911         <ValueName>ProxySettings</ValueName>
2912         <Value>{&quot;ProxyBypassList&quot;: &quot;https://www.example1.com,https://www.example2.com,https://internalsite/&quot;, &quot;ProxyMode&quot;: &quot;direct&quot;, &quot;ProxyPacUrl&quot;: &quot;https://internal.site/example.pac&quot;, &quot;ProxyServer&quot;: &quot;123.123.123.123:8080&quot;, &quot;ProxyServerMode&quot;: 2}</Value>
2913     </Entry>
2914     <Entry type="4" type_name="REG_DWORD">
2915         <Key>Software\Policies\Google\Chrome</Key>
2916         <ValueName>QuicAllowed</ValueName>
2917         <Value>1</Value>
2918     </Entry>
2919     <Entry type="4" type_name="REG_DWORD">
2920         <Key>Software\Policies\Google\Chrome</Key>
2921         <ValueName>RelaunchNotification</ValueName>
2922         <Value>1</Value>
2923     </Entry>
2924     <Entry type="4" type_name="REG_DWORD">
2925         <Key>Software\Policies\Google\Chrome</Key>
2926         <ValueName>RelaunchNotificationPeriod</ValueName>
2927         <Value>604800000</Value>
2928     </Entry>
2929     <Entry type="4" type_name="REG_DWORD">
2930         <Key>Software\Policies\Google\Chrome</Key>
2931         <ValueName>RemoteAccessHostAllowClientPairing</ValueName>
2932         <Value>0</Value>
2933     </Entry>
2934     <Entry type="4" type_name="REG_DWORD">
2935         <Key>Software\Policies\Google\Chrome</Key>
2936         <ValueName>RemoteAccessHostAllowFileTransfer</ValueName>
2937         <Value>0</Value>
2938     </Entry>
2939     <Entry type="4" type_name="REG_DWORD">
2940         <Key>Software\Policies\Google\Chrome</Key>
2941         <ValueName>RemoteAccessHostAllowRelayedConnection</ValueName>
2942         <Value>0</Value>
2943     </Entry>
2944     <Entry type="4" type_name="REG_DWORD">
2945         <Key>Software\Policies\Google\Chrome</Key>
2946         <ValueName>RemoteAccessHostAllowRemoteAccessConnections</ValueName>
2947         <Value>0</Value>
2948     </Entry>
2949     <Entry type="4" type_name="REG_DWORD">
2950         <Key>Software\Policies\Google\Chrome</Key>
2951         <ValueName>RemoteAccessHostAllowUiAccessForRemoteAssistance</ValueName>
2952         <Value>1</Value>
2953     </Entry>
2954     <Entry type="4" type_name="REG_DWORD">
2955         <Key>Software\Policies\Google\Chrome</Key>
2956         <ValueName>RemoteAccessHostFirewallTraversal</ValueName>
2957         <Value>0</Value>
2958     </Entry>
2959     <Entry type="4" type_name="REG_DWORD">
2960         <Key>Software\Policies\Google\Chrome</Key>
2961         <ValueName>RemoteAccessHostMaximumSessionDurationMinutes</ValueName>
2962         <Value>1200</Value>
2963     </Entry>
2964     <Entry type="4" type_name="REG_DWORD">
2965         <Key>Software\Policies\Google\Chrome</Key>
2966         <ValueName>RemoteAccessHostRequireCurtain</ValueName>
2967         <Value>0</Value>
2968     </Entry>
2969     <Entry type="1" type_name="REG_SZ">
2970         <Key>Software\Policies\Google\Chrome</Key>
2971         <ValueName>RemoteAccessHostUdpPortRange</ValueName>
2972         <Value>12400-12409</Value>
2973     </Entry>
2974     <Entry type="4" type_name="REG_DWORD">
2975         <Key>Software\Policies\Google\Chrome</Key>
2976         <ValueName>RendererCodeIntegrityEnabled</ValueName>
2977         <Value>0</Value>
2978     </Entry>
2979     <Entry type="4" type_name="REG_DWORD">
2980         <Key>Software\Policies\Google\Chrome</Key>
2981         <ValueName>RequireOnlineRevocationChecksForLocalAnchors</ValueName>
2982         <Value>0</Value>
2983     </Entry>
2984     <Entry type="4" type_name="REG_DWORD">
2985         <Key>Software\Policies\Google\Chrome</Key>
2986         <ValueName>RestoreOnStartup</ValueName>
2987         <Value>4</Value>
2988     </Entry>
2989     <Entry type="1" type_name="REG_SZ">
2990         <Key>Software\Policies\Google\Chrome</Key>
2991         <ValueName>RestrictSigninToPattern</ValueName>
2992         <Value>.*@example\\.com</Value>
2993     </Entry>
2994     <Entry type="1" type_name="REG_SZ">
2995         <Key>Software\Policies\Google\Chrome</Key>
2996         <ValueName>RoamingProfileLocation</ValueName>
2997         <Value>${roaming_app_data}\\chrome-profile</Value>
2998     </Entry>
2999     <Entry type="4" type_name="REG_DWORD">
3000         <Key>Software\Policies\Google\Chrome</Key>
3001         <ValueName>RoamingProfileSupportEnabled</ValueName>
3002         <Value>1</Value>
3003     </Entry>
3004     <Entry type="4" type_name="REG_DWORD">
3005         <Key>Software\Policies\Google\Chrome</Key>
3006         <ValueName>SSLErrorOverrideAllowed</ValueName>
3007         <Value>1</Value>
3008     </Entry>
3009     <Entry type="1" type_name="REG_SZ">
3010         <Key>Software\Policies\Google\Chrome</Key>
3011         <ValueName>SSLVersionMin</ValueName>
3012         <Value>tls1</Value>
3013     </Entry>
3014     <Entry type="4" type_name="REG_DWORD">
3015         <Key>Software\Policies\Google\Chrome</Key>
3016         <ValueName>SafeBrowsingExtendedReportingEnabled</ValueName>
3017         <Value>1</Value>
3018     </Entry>
3019     <Entry type="4" type_name="REG_DWORD">
3020         <Key>Software\Policies\Google\Chrome</Key>
3021         <ValueName>SafeBrowsingForTrustedSourcesEnabled</ValueName>
3022         <Value>0</Value>
3023     </Entry>
3024     <Entry type="4" type_name="REG_DWORD">
3025         <Key>Software\Policies\Google\Chrome</Key>
3026         <ValueName>SafeBrowsingProtectionLevel</ValueName>
3027         <Value>2</Value>
3028     </Entry>
3029     <Entry type="4" type_name="REG_DWORD">
3030         <Key>Software\Policies\Google\Chrome</Key>
3031         <ValueName>SafeSitesFilterBehavior</ValueName>
3032         <Value>0</Value>
3033     </Entry>
3034     <Entry type="4" type_name="REG_DWORD">
3035         <Key>Software\Policies\Google\Chrome</Key>
3036         <ValueName>SavingBrowserHistoryDisabled</ValueName>
3037         <Value>1</Value>
3038     </Entry>
3039     <Entry type="4" type_name="REG_DWORD">
3040         <Key>Software\Policies\Google\Chrome</Key>
3041         <ValueName>ScreenCaptureAllowed</ValueName>
3042         <Value>0</Value>
3043     </Entry>
3044     <Entry type="4" type_name="REG_DWORD">
3045         <Key>Software\Policies\Google\Chrome</Key>
3046         <ValueName>ScrollToTextFragmentEnabled</ValueName>
3047         <Value>0</Value>
3048     </Entry>
3049     <Entry type="4" type_name="REG_DWORD">
3050         <Key>Software\Policies\Google\Chrome</Key>
3051         <ValueName>SearchSuggestEnabled</ValueName>
3052         <Value>1</Value>
3053     </Entry>
3054     <Entry type="4" type_name="REG_DWORD">
3055         <Key>Software\Policies\Google\Chrome</Key>
3056         <ValueName>SharedArrayBufferUnrestrictedAccessAllowed</ValueName>
3057         <Value>1</Value>
3058     </Entry>
3059     <Entry type="4" type_name="REG_DWORD">
3060         <Key>Software\Policies\Google\Chrome</Key>
3061         <ValueName>SharedClipboardEnabled</ValueName>
3062         <Value>1</Value>
3063     </Entry>
3064     <Entry type="4" type_name="REG_DWORD">
3065         <Key>Software\Policies\Google\Chrome</Key>
3066         <ValueName>ShowAppsShortcutInBookmarkBar</ValueName>
3067         <Value>0</Value>
3068     </Entry>
3069     <Entry type="4" type_name="REG_DWORD">
3070         <Key>Software\Policies\Google\Chrome</Key>
3071         <ValueName>ShowCastIconInToolbar</ValueName>
3072         <Value>0</Value>
3073     </Entry>
3074     <Entry type="4" type_name="REG_DWORD">
3075         <Key>Software\Policies\Google\Chrome</Key>
3076         <ValueName>ShowFullUrlsInAddressBar</ValueName>
3077         <Value>0</Value>
3078     </Entry>
3079     <Entry type="4" type_name="REG_DWORD">
3080         <Key>Software\Policies\Google\Chrome</Key>
3081         <ValueName>ShowHomeButton</ValueName>
3082         <Value>1</Value>
3083     </Entry>
3084     <Entry type="4" type_name="REG_DWORD">
3085         <Key>Software\Policies\Google\Chrome</Key>
3086         <ValueName>SignedHTTPExchangeEnabled</ValueName>
3087         <Value>1</Value>
3088     </Entry>
3089     <Entry type="4" type_name="REG_DWORD">
3090         <Key>Software\Policies\Google\Chrome</Key>
3091         <ValueName>SigninInterceptionEnabled</ValueName>
3092         <Value>1</Value>
3093     </Entry>
3094     <Entry type="4" type_name="REG_DWORD">
3095         <Key>Software\Policies\Google\Chrome</Key>
3096         <ValueName>SitePerProcess</ValueName>
3097         <Value>1</Value>
3098     </Entry>
3099     <Entry type="4" type_name="REG_DWORD">
3100         <Key>Software\Policies\Google\Chrome</Key>
3101         <ValueName>SpellCheckServiceEnabled</ValueName>
3102         <Value>0</Value>
3103     </Entry>
3104     <Entry type="4" type_name="REG_DWORD">
3105         <Key>Software\Policies\Google\Chrome</Key>
3106         <ValueName>SpellcheckEnabled</ValueName>
3107         <Value>0</Value>
3108     </Entry>
3109     <Entry type="4" type_name="REG_DWORD">
3110         <Key>Software\Policies\Google\Chrome</Key>
3111         <ValueName>SuppressDifferentOriginSubframeDialogs</ValueName>
3112         <Value>1</Value>
3113     </Entry>
3114     <Entry type="4" type_name="REG_DWORD">
3115         <Key>Software\Policies\Google\Chrome</Key>
3116         <ValueName>SuppressUnsupportedOSWarning</ValueName>
3117         <Value>1</Value>
3118     </Entry>
3119     <Entry type="4" type_name="REG_DWORD">
3120         <Key>Software\Policies\Google\Chrome</Key>
3121         <ValueName>SyncDisabled</ValueName>
3122         <Value>1</Value>
3123     </Entry>
3124     <Entry type="4" type_name="REG_DWORD">
3125         <Key>Software\Policies\Google\Chrome</Key>
3126         <ValueName>TargetBlankImpliesNoOpener</ValueName>
3127         <Value>0</Value>
3128     </Entry>
3129     <Entry type="4" type_name="REG_DWORD">
3130         <Key>Software\Policies\Google\Chrome</Key>
3131         <ValueName>TaskManagerEndProcessEnabled</ValueName>
3132         <Value>1</Value>
3133     </Entry>
3134     <Entry type="4" type_name="REG_DWORD">
3135         <Key>Software\Policies\Google\Chrome</Key>
3136         <ValueName>ThirdPartyBlockingEnabled</ValueName>
3137         <Value>0</Value>
3138     </Entry>
3139     <Entry type="4" type_name="REG_DWORD">
3140         <Key>Software\Policies\Google\Chrome</Key>
3141         <ValueName>TotalMemoryLimitMb</ValueName>
3142         <Value>2048</Value>
3143     </Entry>
3144     <Entry type="4" type_name="REG_DWORD">
3145         <Key>Software\Policies\Google\Chrome</Key>
3146         <ValueName>TranslateEnabled</ValueName>
3147         <Value>1</Value>
3148     </Entry>
3149     <Entry type="4" type_name="REG_DWORD">
3150         <Key>Software\Policies\Google\Chrome</Key>
3151         <ValueName>TripleDESEnabled</ValueName>
3152         <Value>0</Value>
3153     </Entry>
3154     <Entry type="4" type_name="REG_DWORD">
3155         <Key>Software\Policies\Google\Chrome</Key>
3156         <ValueName>UrlKeyedAnonymizedDataCollectionEnabled</ValueName>
3157         <Value>1</Value>
3158     </Entry>
3159     <Entry type="4" type_name="REG_DWORD">
3160         <Key>Software\Policies\Google\Chrome</Key>
3161         <ValueName>UserAgentClientHintsEnabled</ValueName>
3162         <Value>1</Value>
3163     </Entry>
3164     <Entry type="1" type_name="REG_SZ">
3165         <Key>Software\Policies\Google\Chrome</Key>
3166         <ValueName>UserDataDir</ValueName>
3167         <Value>${users}/${user_name}/Chrome</Value>
3168     </Entry>
3169     <Entry type="4" type_name="REG_DWORD">
3170         <Key>Software\Policies\Google\Chrome</Key>
3171         <ValueName>UserDataSnapshotRetentionLimit</ValueName>
3172         <Value>3</Value>
3173     </Entry>
3174     <Entry type="4" type_name="REG_DWORD">
3175         <Key>Software\Policies\Google\Chrome</Key>
3176         <ValueName>UserFeedbackAllowed</ValueName>
3177         <Value>1</Value>
3178     </Entry>
3179     <Entry type="4" type_name="REG_DWORD">
3180         <Key>Software\Policies\Google\Chrome</Key>
3181         <ValueName>VideoCaptureAllowed</ValueName>
3182         <Value>0</Value>
3183     </Entry>
3184     <Entry type="4" type_name="REG_DWORD">
3185         <Key>Software\Policies\Google\Chrome</Key>
3186         <ValueName>WPADQuickCheckEnabled</ValueName>
3187         <Value>1</Value>
3188     </Entry>
3189     <Entry type="1" type_name="REG_SZ">
3190         <Key>Software\Policies\Google\Chrome</Key>
3191         <ValueName>WebAppInstallForceList</ValueName>
3192         <Value>[{&quot;create_desktop_shortcut&quot;: true, &quot;default_launch_container&quot;: &quot;window&quot;, &quot;url&quot;: &quot;https://www.google.com/maps&quot;}, {&quot;default_launch_container&quot;: &quot;tab&quot;, &quot;url&quot;: &quot;https://docs.google.com&quot;}, {&quot;default_launch_container&quot;: &quot;window&quot;, &quot;fallback_app_name&quot;: &quot;Editor&quot;, &quot;url&quot;: &quot;https://docs.google.com/editor&quot;}]</Value>
3193     </Entry>
3194     <Entry type="4" type_name="REG_DWORD">
3195         <Key>Software\Policies\Google\Chrome</Key>
3196         <ValueName>WebRtcAllowLegacyTLSProtocols</ValueName>
3197         <Value>0</Value>
3198     </Entry>
3199     <Entry type="4" type_name="REG_DWORD">
3200         <Key>Software\Policies\Google\Chrome</Key>
3201         <ValueName>WebRtcEventLogCollectionAllowed</ValueName>
3202         <Value>1</Value>
3203     </Entry>
3204     <Entry type="1" type_name="REG_SZ">
3205         <Key>Software\Policies\Google\Chrome</Key>
3206         <ValueName>WebRtcIPHandling</ValueName>
3207         <Value>default</Value>
3208     </Entry>
3209     <Entry type="1" type_name="REG_SZ">
3210         <Key>Software\Policies\Google\Chrome</Key>
3211         <ValueName>WebRtcUdpPortRange</ValueName>
3212         <Value>10000-11999</Value>
3213     </Entry>
3214     <Entry type="1" type_name="REG_SZ">
3215         <Key>Software\Policies\Google\Chrome</Key>
3216         <ValueName>WebUsbAllowDevicesForUrls</ValueName>
3217         <Value>[{&quot;devices&quot;: [{&quot;product_id&quot;: 5678, &quot;vendor_id&quot;: 1234}], &quot;urls&quot;: [&quot;https://google.com&quot;]}]</Value>
3218     </Entry>
3219     <Entry type="4" type_name="REG_DWORD">
3220         <Key>Software\Policies\Google\Chrome</Key>
3221         <ValueName>WindowOcclusionEnabled</ValueName>
3222         <Value>1</Value>
3223     </Entry>
3224     <Entry type="1" type_name="REG_SZ">
3225         <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3226         <ValueName>1</ValueName>
3227         <Value>-foreground</Value>
3228     </Entry>
3229     <Entry type="1" type_name="REG_SZ">
3230         <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3231         <ValueName>2</ValueName>
3232         <Value>-new-window</Value>
3233     </Entry>
3234     <Entry type="1" type_name="REG_SZ">
3235         <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3236         <ValueName>3</ValueName>
3237         <Value>${url}</Value>
3238     </Entry>
3239     <Entry type="1" type_name="REG_SZ">
3240         <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3241         <ValueName>4</ValueName>
3242         <Value>-profile</Value>
3243     </Entry>
3244     <Entry type="1" type_name="REG_SZ">
3245         <Key>Software\Policies\Google\Chrome\AlternativeBrowserParameters</Key>
3246         <ValueName>5</ValueName>
3247         <Value>%HOME%\\browser_profile</Value>
3248     </Entry>
3249     <Entry type="1" type_name="REG_SZ">
3250         <Key>Software\Policies\Google\Chrome\AudioCaptureAllowedUrls</Key>
3251         <ValueName>1</ValueName>
3252         <Value>https://www.example.com/</Value>
3253     </Entry>
3254     <Entry type="1" type_name="REG_SZ">
3255         <Key>Software\Policies\Google\Chrome\AudioCaptureAllowedUrls</Key>
3256         <ValueName>2</ValueName>
3257         <Value>https://[*.]example.edu/</Value>
3258     </Entry>
3259     <Entry type="1" type_name="REG_SZ">
3260         <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3261         <ValueName>1</ValueName>
3262         <Value>example.com</Value>
3263     </Entry>
3264     <Entry type="1" type_name="REG_SZ">
3265         <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3266         <ValueName>2</ValueName>
3267         <Value>https://ssl.server.com</Value>
3268     </Entry>
3269     <Entry type="1" type_name="REG_SZ">
3270         <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3271         <ValueName>3</ValueName>
3272         <Value>hosting.com/good_path</Value>
3273     </Entry>
3274     <Entry type="1" type_name="REG_SZ">
3275         <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3276         <ValueName>4</ValueName>
3277         <Value>https://server:8080/path</Value>
3278     </Entry>
3279     <Entry type="1" type_name="REG_SZ">
3280         <Key>Software\Policies\Google\Chrome\AutoOpenAllowedForURLs</Key>
3281         <ValueName>5</ValueName>
3282         <Value>.exact.hostname.com</Value>
3283     </Entry>
3284     <Entry type="1" type_name="REG_SZ">
3285         <Key>Software\Policies\Google\Chrome\AutoOpenFileTypes</Key>
3286         <ValueName>1</ValueName>
3287         <Value>exe</Value>
3288     </Entry>
3289     <Entry type="1" type_name="REG_SZ">
3290         <Key>Software\Policies\Google\Chrome\AutoOpenFileTypes</Key>
3291         <ValueName>2</ValueName>
3292         <Value>txt</Value>
3293     </Entry>
3294     <Entry type="1" type_name="REG_SZ">
3295         <Key>Software\Policies\Google\Chrome\AutoSelectCertificateForUrls</Key>
3296         <ValueName>1</ValueName>
3297         <Value>{&quot;pattern&quot;:&quot;https://www.example.com&quot;,&quot;filter&quot;:{&quot;ISSUER&quot;:{&quot;CN&quot;:&quot;certificate issuer name&quot;, &quot;L&quot;: &quot;certificate issuer location&quot;, &quot;O&quot;: &quot;certificate issuer org&quot;, &quot;OU&quot;: &quot;certificate issuer org unit&quot;}, &quot;SUBJECT&quot;:{&quot;CN&quot;:&quot;certificate subject name&quot;, &quot;L&quot;: &quot;certificate subject location&quot;, &quot;O&quot;: &quot;certificate subject org&quot;, &quot;OU&quot;: &quot;certificate subject org unit&quot;}}}</Value>
3298     </Entry>
3299     <Entry type="1" type_name="REG_SZ">
3300         <Key>Software\Policies\Google\Chrome\AutoplayAllowlist</Key>
3301         <ValueName>1</ValueName>
3302         <Value>https://www.example.com</Value>
3303     </Entry>
3304     <Entry type="1" type_name="REG_SZ">
3305         <Key>Software\Policies\Google\Chrome\AutoplayAllowlist</Key>
3306         <ValueName>2</ValueName>
3307         <Value>[*.]example.edu</Value>
3308     </Entry>
3309     <Entry type="1" type_name="REG_SZ">
3310         <Key>Software\Policies\Google\Chrome\BrowserSwitcherChromeParameters</Key>
3311         <ValueName>1</ValueName>
3312         <Value>--force-dark-mode</Value>
3313     </Entry>
3314     <Entry type="1" type_name="REG_SZ">
3315         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3316         <ValueName>1</ValueName>
3317         <Value>ie.com</Value>
3318     </Entry>
3319     <Entry type="1" type_name="REG_SZ">
3320         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3321         <ValueName>2</ValueName>
3322         <Value>!open-in-chrome.ie.com</Value>
3323     </Entry>
3324     <Entry type="1" type_name="REG_SZ">
3325         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlGreylist</Key>
3326         <ValueName>3</ValueName>
3327         <Value>foobar.com/ie-only/</Value>
3328     </Entry>
3329     <Entry type="1" type_name="REG_SZ">
3330         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3331         <ValueName>1</ValueName>
3332         <Value>ie.com</Value>
3333     </Entry>
3334     <Entry type="1" type_name="REG_SZ">
3335         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3336         <ValueName>2</ValueName>
3337         <Value>!open-in-chrome.ie.com</Value>
3338     </Entry>
3339     <Entry type="1" type_name="REG_SZ">
3340         <Key>Software\Policies\Google\Chrome\BrowserSwitcherUrlList</Key>
3341         <ValueName>3</ValueName>
3342         <Value>foobar.com/ie-only/</Value>
3343     </Entry>
3344     <Entry type="1" type_name="REG_SZ">
3345         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas</Key>
3346         <ValueName>1</ValueName>
3347         <Value>sha256/AAAAAAAAAAAAAAAAAAAAAA==</Value>
3348     </Entry>
3349     <Entry type="1" type_name="REG_SZ">
3350         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas</Key>
3351         <ValueName>2</ValueName>
3352         <Value>sha256//////////////////////w==</Value>
3353     </Entry>
3354     <Entry type="1" type_name="REG_SZ">
3355         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForLegacyCas</Key>
3356         <ValueName>1</ValueName>
3357         <Value>sha256/AAAAAAAAAAAAAAAAAAAAAA==</Value>
3358     </Entry>
3359     <Entry type="1" type_name="REG_SZ">
3360         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForLegacyCas</Key>
3361         <ValueName>2</ValueName>
3362         <Value>sha256//////////////////////w==</Value>
3363     </Entry>
3364     <Entry type="1" type_name="REG_SZ">
3365         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls</Key>
3366         <ValueName>1</ValueName>
3367         <Value>example.com</Value>
3368     </Entry>
3369     <Entry type="1" type_name="REG_SZ">
3370         <Key>Software\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForUrls</Key>
3371         <ValueName>2</ValueName>
3372         <Value>.example.com</Value>
3373     </Entry>
3374     <Entry type="1" type_name="REG_SZ">
3375         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3376         <ValueName>1</ValueName>
3377         <Value>browsing_history</Value>
3378     </Entry>
3379     <Entry type="1" type_name="REG_SZ">
3380         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3381         <ValueName>2</ValueName>
3382         <Value>download_history</Value>
3383     </Entry>
3384     <Entry type="1" type_name="REG_SZ">
3385         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3386         <ValueName>3</ValueName>
3387         <Value>cookies_and_other_site_data</Value>
3388     </Entry>
3389     <Entry type="1" type_name="REG_SZ">
3390         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3391         <ValueName>4</ValueName>
3392         <Value>cached_images_and_files</Value>
3393     </Entry>
3394     <Entry type="1" type_name="REG_SZ">
3395         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3396         <ValueName>5</ValueName>
3397         <Value>password_signin</Value>
3398     </Entry>
3399     <Entry type="1" type_name="REG_SZ">
3400         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3401         <ValueName>6</ValueName>
3402         <Value>autofill</Value>
3403     </Entry>
3404     <Entry type="1" type_name="REG_SZ">
3405         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3406         <ValueName>7</ValueName>
3407         <Value>site_settings</Value>
3408     </Entry>
3409     <Entry type="1" type_name="REG_SZ">
3410         <Key>Software\Policies\Google\Chrome\ClearBrowsingDataOnExitList</Key>
3411         <ValueName>8</ValueName>
3412         <Value>hosted_app_data</Value>
3413     </Entry>
3414     <Entry type="1" type_name="REG_SZ">
3415         <Key>Software\Policies\Google\Chrome\CookiesAllowedForUrls</Key>
3416         <ValueName>1</ValueName>
3417         <Value>https://www.example.com</Value>
3418     </Entry>
3419     <Entry type="1" type_name="REG_SZ">
3420         <Key>Software\Policies\Google\Chrome\CookiesAllowedForUrls</Key>
3421         <ValueName>2</ValueName>
3422         <Value>[*.]example.edu</Value>
3423     </Entry>
3424     <Entry type="1" type_name="REG_SZ">
3425         <Key>Software\Policies\Google\Chrome\CookiesBlockedForUrls</Key>
3426         <ValueName>1</ValueName>
3427         <Value>https://www.example.com</Value>
3428     </Entry>
3429     <Entry type="1" type_name="REG_SZ">
3430         <Key>Software\Policies\Google\Chrome\CookiesBlockedForUrls</Key>
3431         <ValueName>2</ValueName>
3432         <Value>[*.]example.edu</Value>
3433     </Entry>
3434     <Entry type="1" type_name="REG_SZ">
3435         <Key>Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls</Key>
3436         <ValueName>1</ValueName>
3437         <Value>https://www.example.com</Value>
3438     </Entry>
3439     <Entry type="1" type_name="REG_SZ">
3440         <Key>Software\Policies\Google\Chrome\CookiesSessionOnlyForUrls</Key>
3441         <ValueName>2</ValueName>
3442         <Value>[*.]example.edu</Value>
3443     </Entry>
3444     <Entry type="1" type_name="REG_SZ">
3445         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs</Key>
3446         <ValueName>1</ValueName>
3447         <Value>https://search.my.company/suggest#q={searchTerms}</Value>
3448     </Entry>
3449     <Entry type="1" type_name="REG_SZ">
3450         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderAlternateURLs</Key>
3451         <ValueName>2</ValueName>
3452         <Value>https://search.my.company/suggest/search#q={searchTerms}</Value>
3453     </Entry>
3454     <Entry type="1" type_name="REG_SZ">
3455         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3456         <ValueName>1</ValueName>
3457         <Value>UTF-8</Value>
3458     </Entry>
3459     <Entry type="1" type_name="REG_SZ">
3460         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3461         <ValueName>2</ValueName>
3462         <Value>UTF-16</Value>
3463     </Entry>
3464     <Entry type="1" type_name="REG_SZ">
3465         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3466         <ValueName>3</ValueName>
3467         <Value>GB2312</Value>
3468     </Entry>
3469     <Entry type="1" type_name="REG_SZ">
3470         <Key>Software\Policies\Google\Chrome\DefaultSearchProviderEncodings</Key>
3471         <ValueName>4</ValueName>
3472         <Value>ISO-8859-1</Value>
3473     </Entry>
3474     <Entry type="1" type_name="REG_SZ">
3475         <Key>Software\Policies\Google\Chrome\EnableExperimentalPolicies</Key>
3476         <ValueName>1</ValueName>
3477         <Value>ExtensionInstallAllowlist</Value>
3478     </Entry>
3479     <Entry type="1" type_name="REG_SZ">
3480         <Key>Software\Policies\Google\Chrome\EnableExperimentalPolicies</Key>
3481         <ValueName>2</ValueName>
3482         <Value>ExtensionInstallBlocklist</Value>
3483     </Entry>
3484     <Entry type="1" type_name="REG_SZ">
3485         <Key>Software\Policies\Google\Chrome\ExplicitlyAllowedNetworkPorts</Key>
3486         <ValueName>1</ValueName>
3487         <Value>10080</Value>
3488     </Entry>
3489     <Entry type="1" type_name="REG_SZ">
3490         <Key>Software\Policies\Google\Chrome\ExtensionAllowedTypes</Key>
3491         <ValueName>1</ValueName>
3492         <Value>hosted_app</Value>
3493     </Entry>
3494     <Entry type="1" type_name="REG_SZ">
3495         <Key>Software\Policies\Google\Chrome\ExtensionInstallAllowlist</Key>
3496         <ValueName>1</ValueName>
3497         <Value>extension_id1</Value>
3498     </Entry>
3499     <Entry type="1" type_name="REG_SZ">
3500         <Key>Software\Policies\Google\Chrome\ExtensionInstallAllowlist</Key>
3501         <ValueName>2</ValueName>
3502         <Value>extension_id2</Value>
3503     </Entry>
3504     <Entry type="1" type_name="REG_SZ">
3505         <Key>Software\Policies\Google\Chrome\ExtensionInstallBlocklist</Key>
3506         <ValueName>1</ValueName>
3507         <Value>extension_id1</Value>
3508     </Entry>
3509     <Entry type="1" type_name="REG_SZ">
3510         <Key>Software\Policies\Google\Chrome\ExtensionInstallBlocklist</Key>
3511         <ValueName>2</ValueName>
3512         <Value>extension_id2</Value>
3513     </Entry>
3514     <Entry type="1" type_name="REG_SZ">
3515         <Key>Software\Policies\Google\Chrome\ExtensionInstallForcelist</Key>
3516         <ValueName>1</ValueName>
3517         <Value>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx</Value>
3518     </Entry>
3519     <Entry type="1" type_name="REG_SZ">
3520         <Key>Software\Policies\Google\Chrome\ExtensionInstallForcelist</Key>
3521         <ValueName>2</ValueName>
3522         <Value>abcdefghijklmnopabcdefghijklmnop</Value>
3523     </Entry>
3524     <Entry type="1" type_name="REG_SZ">
3525         <Key>Software\Policies\Google\Chrome\ExtensionInstallSources</Key>
3526         <ValueName>1</ValueName>
3527         <Value>https://corp.mycompany.com/*</Value>
3528     </Entry>
3529     <Entry type="1" type_name="REG_SZ">
3530         <Key>Software\Policies\Google\Chrome\FileHandlingAllowedForUrls</Key>
3531         <ValueName>1</ValueName>
3532         <Value>https://www.example.com</Value>
3533     </Entry>
3534     <Entry type="1" type_name="REG_SZ">
3535         <Key>Software\Policies\Google\Chrome\FileHandlingAllowedForUrls</Key>
3536         <ValueName>2</ValueName>
3537         <Value>[*.]example.edu</Value>
3538     </Entry>
3539     <Entry type="1" type_name="REG_SZ">
3540         <Key>Software\Policies\Google\Chrome\FileHandlingBlockedForUrls</Key>
3541         <ValueName>1</ValueName>
3542         <Value>https://www.example.com</Value>
3543     </Entry>
3544     <Entry type="1" type_name="REG_SZ">
3545         <Key>Software\Policies\Google\Chrome\FileHandlingBlockedForUrls</Key>
3546         <ValueName>2</ValueName>
3547         <Value>[*.]example.edu</Value>
3548     </Entry>
3549     <Entry type="1" type_name="REG_SZ">
3550         <Key>Software\Policies\Google\Chrome\FileSystemReadAskForUrls</Key>
3551         <ValueName>1</ValueName>
3552         <Value>https://www.example.com</Value>
3553     </Entry>
3554     <Entry type="1" type_name="REG_SZ">
3555         <Key>Software\Policies\Google\Chrome\FileSystemReadAskForUrls</Key>
3556         <ValueName>2</ValueName>
3557         <Value>[*.]example.edu</Value>
3558     </Entry>
3559     <Entry type="1" type_name="REG_SZ">
3560         <Key>Software\Policies\Google\Chrome\FileSystemReadBlockedForUrls</Key>
3561         <ValueName>1</ValueName>
3562         <Value>https://www.example.com</Value>
3563     </Entry>
3564     <Entry type="1" type_name="REG_SZ">
3565         <Key>Software\Policies\Google\Chrome\FileSystemReadBlockedForUrls</Key>
3566         <ValueName>2</ValueName>
3567         <Value>[*.]example.edu</Value>
3568     </Entry>
3569     <Entry type="1" type_name="REG_SZ">
3570         <Key>Software\Policies\Google\Chrome\FileSystemWriteAskForUrls</Key>
3571         <ValueName>1</ValueName>
3572         <Value>https://www.example.com</Value>
3573     </Entry>
3574     <Entry type="1" type_name="REG_SZ">
3575         <Key>Software\Policies\Google\Chrome\FileSystemWriteAskForUrls</Key>
3576         <ValueName>2</ValueName>
3577         <Value>[*.]example.edu</Value>
3578     </Entry>
3579     <Entry type="1" type_name="REG_SZ">
3580         <Key>Software\Policies\Google\Chrome\FileSystemWriteBlockedForUrls</Key>
3581         <ValueName>1</ValueName>
3582         <Value>https://www.example.com</Value>
3583     </Entry>
3584     <Entry type="1" type_name="REG_SZ">
3585         <Key>Software\Policies\Google\Chrome\FileSystemWriteBlockedForUrls</Key>
3586         <ValueName>2</ValueName>
3587         <Value>[*.]example.edu</Value>
3588     </Entry>
3589     <Entry type="1" type_name="REG_SZ">
3590         <Key>Software\Policies\Google\Chrome\ForcedLanguages</Key>
3591         <ValueName>1</ValueName>
3592         <Value>en-US</Value>
3593     </Entry>
3594     <Entry type="1" type_name="REG_SZ">
3595         <Key>Software\Policies\Google\Chrome\HSTSPolicyBypassList</Key>
3596         <ValueName>1</ValueName>
3597         <Value>meet</Value>
3598     </Entry>
3599     <Entry type="1" type_name="REG_SZ">
3600         <Key>Software\Policies\Google\Chrome\ImagesAllowedForUrls</Key>
3601         <ValueName>1</ValueName>
3602         <Value>https://www.example.com</Value>
3603     </Entry>
3604     <Entry type="1" type_name="REG_SZ">
3605         <Key>Software\Policies\Google\Chrome\ImagesAllowedForUrls</Key>
3606         <ValueName>2</ValueName>
3607         <Value>[*.]example.edu</Value>
3608     </Entry>
3609     <Entry type="1" type_name="REG_SZ">
3610         <Key>Software\Policies\Google\Chrome\ImagesBlockedForUrls</Key>
3611         <ValueName>1</ValueName>
3612         <Value>https://www.example.com</Value>
3613     </Entry>
3614     <Entry type="1" type_name="REG_SZ">
3615         <Key>Software\Policies\Google\Chrome\ImagesBlockedForUrls</Key>
3616         <ValueName>2</ValueName>
3617         <Value>[*.]example.edu</Value>
3618     </Entry>
3619     <Entry type="1" type_name="REG_SZ">
3620         <Key>Software\Policies\Google\Chrome\InsecureContentAllowedForUrls</Key>
3621         <ValueName>1</ValueName>
3622         <Value>https://www.example.com</Value>
3623     </Entry>
3624     <Entry type="1" type_name="REG_SZ">
3625         <Key>Software\Policies\Google\Chrome\InsecureContentAllowedForUrls</Key>
3626         <ValueName>2</ValueName>
3627         <Value>[*.]example.edu</Value>
3628     </Entry>
3629     <Entry type="1" type_name="REG_SZ">
3630         <Key>Software\Policies\Google\Chrome\InsecureContentBlockedForUrls</Key>
3631         <ValueName>1</ValueName>
3632         <Value>https://www.example.com</Value>
3633     </Entry>
3634     <Entry type="1" type_name="REG_SZ">
3635         <Key>Software\Policies\Google\Chrome\InsecureContentBlockedForUrls</Key>
3636         <ValueName>2</ValueName>
3637         <Value>[*.]example.edu</Value>
3638     </Entry>
3639     <Entry type="1" type_name="REG_SZ">
3640         <Key>Software\Policies\Google\Chrome\InsecurePrivateNetworkRequestsAllowedForUrls</Key>
3641         <ValueName>1</ValueName>
3642         <Value>http://www.example.com:8080</Value>
3643     </Entry>
3644     <Entry type="1" type_name="REG_SZ">
3645         <Key>Software\Policies\Google\Chrome\InsecurePrivateNetworkRequestsAllowedForUrls</Key>
3646         <ValueName>2</ValueName>
3647         <Value>[*.]example.edu</Value>
3648     </Entry>
3649     <Entry type="1" type_name="REG_SZ">
3650         <Key>Software\Policies\Google\Chrome\JavaScriptAllowedForUrls</Key>
3651         <ValueName>1</ValueName>
3652         <Value>https://www.example.com</Value>
3653     </Entry>
3654     <Entry type="1" type_name="REG_SZ">
3655         <Key>Software\Policies\Google\Chrome\JavaScriptAllowedForUrls</Key>
3656         <ValueName>2</ValueName>
3657         <Value>[*.]example.edu</Value>
3658     </Entry>
3659     <Entry type="1" type_name="REG_SZ">
3660         <Key>Software\Policies\Google\Chrome\JavaScriptBlockedForUrls</Key>
3661         <ValueName>1</ValueName>
3662         <Value>https://www.example.com</Value>
3663     </Entry>
3664     <Entry type="1" type_name="REG_SZ">
3665         <Key>Software\Policies\Google\Chrome\JavaScriptBlockedForUrls</Key>
3666         <ValueName>2</ValueName>
3667         <Value>[*.]example.edu</Value>
3668     </Entry>
3669     <Entry type="1" type_name="REG_SZ">
3670         <Key>Software\Policies\Google\Chrome\LegacySameSiteCookieBehaviorEnabledForDomainList</Key>
3671         <ValueName>1</ValueName>
3672         <Value>www.example.com</Value>
3673     </Entry>
3674     <Entry type="1" type_name="REG_SZ">
3675         <Key>Software\Policies\Google\Chrome\LegacySameSiteCookieBehaviorEnabledForDomainList</Key>
3676         <ValueName>2</ValueName>
3677         <Value>[*.]example.edu</Value>
3678     </Entry>
3679     <Entry type="1" type_name="REG_SZ">
3680         <Key>Software\Policies\Google\Chrome\LookalikeWarningAllowlistDomains</Key>
3681         <ValueName>1</ValueName>
3682         <Value>foo.example.com</Value>
3683     </Entry>
3684     <Entry type="1" type_name="REG_SZ">
3685         <Key>Software\Policies\Google\Chrome\LookalikeWarningAllowlistDomains</Key>
3686         <ValueName>2</ValueName>
3687         <Value>example.org</Value>
3688     </Entry>
3689     <Entry type="1" type_name="REG_SZ">
3690         <Key>Software\Policies\Google\Chrome\NativeMessagingAllowlist</Key>
3691         <ValueName>1</ValueName>
3692         <Value>com.native.messaging.host.name1</Value>
3693     </Entry>
3694     <Entry type="1" type_name="REG_SZ">
3695         <Key>Software\Policies\Google\Chrome\NativeMessagingAllowlist</Key>
3696         <ValueName>2</ValueName>
3697         <Value>com.native.messaging.host.name2</Value>
3698     </Entry>
3699     <Entry type="1" type_name="REG_SZ">
3700         <Key>Software\Policies\Google\Chrome\NativeMessagingBlocklist</Key>
3701         <ValueName>1</ValueName>
3702         <Value>com.native.messaging.host.name1</Value>
3703     </Entry>
3704     <Entry type="1" type_name="REG_SZ">
3705         <Key>Software\Policies\Google\Chrome\NativeMessagingBlocklist</Key>
3706         <ValueName>2</ValueName>
3707         <Value>com.native.messaging.host.name2</Value>
3708     </Entry>
3709     <Entry type="1" type_name="REG_SZ">
3710         <Key>Software\Policies\Google\Chrome\NotificationsAllowedForUrls</Key>
3711         <ValueName>1</ValueName>
3712         <Value>https://www.example.com</Value>
3713     </Entry>
3714     <Entry type="1" type_name="REG_SZ">
3715         <Key>Software\Policies\Google\Chrome\NotificationsAllowedForUrls</Key>
3716         <ValueName>2</ValueName>
3717         <Value>[*.]example.edu</Value>
3718     </Entry>
3719     <Entry type="1" type_name="REG_SZ">
3720         <Key>Software\Policies\Google\Chrome\NotificationsBlockedForUrls</Key>
3721         <ValueName>1</ValueName>
3722         <Value>https://www.example.com</Value>
3723     </Entry>
3724     <Entry type="1" type_name="REG_SZ">
3725         <Key>Software\Policies\Google\Chrome\NotificationsBlockedForUrls</Key>
3726         <ValueName>2</ValueName>
3727         <Value>[*.]example.edu</Value>
3728     </Entry>
3729     <Entry type="1" type_name="REG_SZ">
3730         <Key>Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin</Key>
3731         <ValueName>1</ValueName>
3732         <Value>http://testserver.example.com/</Value>
3733     </Entry>
3734     <Entry type="1" type_name="REG_SZ">
3735         <Key>Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin</Key>
3736         <ValueName>2</ValueName>
3737         <Value>*.example.org</Value>
3738     </Entry>
3739     <Entry type="1" type_name="REG_SZ">
3740         <Key>Software\Policies\Google\Chrome\PasswordProtectionLoginURLs</Key>
3741         <ValueName>1</ValueName>
3742         <Value>https://mydomain.com/login.html</Value>
3743     </Entry>
3744     <Entry type="1" type_name="REG_SZ">
3745         <Key>Software\Policies\Google\Chrome\PasswordProtectionLoginURLs</Key>
3746         <ValueName>2</ValueName>
3747         <Value>https://login.mydomain.com</Value>
3748     </Entry>
3749     <Entry type="1" type_name="REG_SZ">
3750         <Key>Software\Policies\Google\Chrome\PolicyDictionaryMultipleSourceMergeList</Key>
3751         <ValueName>1</ValueName>
3752         <Value>ExtensionSettings</Value>
3753     </Entry>
3754     <Entry type="1" type_name="REG_SZ">
3755         <Key>Software\Policies\Google\Chrome\PolicyListMultipleSourceMergeList</Key>
3756         <ValueName>1</ValueName>
3757         <Value>ExtensionInstallAllowlist</Value>
3758     </Entry>
3759     <Entry type="1" type_name="REG_SZ">
3760         <Key>Software\Policies\Google\Chrome\PolicyListMultipleSourceMergeList</Key>
3761         <ValueName>2</ValueName>
3762         <Value>ExtensionInstallBlocklist</Value>
3763     </Entry>
3764     <Entry type="1" type_name="REG_SZ">
3765         <Key>Software\Policies\Google\Chrome\PopupsAllowedForUrls</Key>
3766         <ValueName>1</ValueName>
3767         <Value>https://www.example.com</Value>
3768     </Entry>
3769     <Entry type="1" type_name="REG_SZ">
3770         <Key>Software\Policies\Google\Chrome\PopupsAllowedForUrls</Key>
3771         <ValueName>2</ValueName>
3772         <Value>[*.]example.edu</Value>
3773     </Entry>
3774     <Entry type="1" type_name="REG_SZ">
3775         <Key>Software\Policies\Google\Chrome\PopupsBlockedForUrls</Key>
3776         <ValueName>1</ValueName>
3777         <Value>https://www.example.com</Value>
3778     </Entry>
3779     <Entry type="1" type_name="REG_SZ">
3780         <Key>Software\Policies\Google\Chrome\PopupsBlockedForUrls</Key>
3781         <ValueName>2</ValueName>
3782         <Value>[*.]example.edu</Value>
3783     </Entry>
3784     <Entry type="1" type_name="REG_SZ">
3785         <Key>Software\Policies\Google\Chrome\PrinterTypeDenyList</Key>
3786         <ValueName>1</ValueName>
3787         <Value>cloud</Value>
3788     </Entry>
3789     <Entry type="1" type_name="REG_SZ">
3790         <Key>Software\Policies\Google\Chrome\PrinterTypeDenyList</Key>
3791         <ValueName>2</ValueName>
3792         <Value>privet</Value>
3793     </Entry>
3794     <Entry type="1" type_name="REG_SZ">
3795         <Key>Software\Policies\Google\Chrome\RemoteAccessHostClientDomainList</Key>
3796         <ValueName>1</ValueName>
3797         <Value>my-awesome-domain.com</Value>
3798     </Entry>
3799     <Entry type="1" type_name="REG_SZ">
3800         <Key>Software\Policies\Google\Chrome\RemoteAccessHostClientDomainList</Key>
3801         <ValueName>2</ValueName>
3802         <Value>my-auxiliary-domain.com</Value>
3803     </Entry>
3804     <Entry type="1" type_name="REG_SZ">
3805         <Key>Software\Policies\Google\Chrome\RemoteAccessHostDomainList</Key>
3806         <ValueName>1</ValueName>
3807         <Value>my-awesome-domain.com</Value>
3808     </Entry>
3809     <Entry type="1" type_name="REG_SZ">
3810         <Key>Software\Policies\Google\Chrome\RemoteAccessHostDomainList</Key>
3811         <ValueName>2</ValueName>
3812         <Value>my-auxiliary-domain.com</Value>
3813     </Entry>
3814     <Entry type="1" type_name="REG_SZ">
3815         <Key>Software\Policies\Google\Chrome\RestoreOnStartupURLs</Key>
3816         <ValueName>1</ValueName>
3817         <Value>https://example.com</Value>
3818     </Entry>
3819     <Entry type="1" type_name="REG_SZ">
3820         <Key>Software\Policies\Google\Chrome\RestoreOnStartupURLs</Key>
3821         <ValueName>2</ValueName>
3822         <Value>https://www.chromium.org</Value>
3823     </Entry>
3824     <Entry type="1" type_name="REG_SZ">
3825         <Key>Software\Policies\Google\Chrome\SSLErrorOverrideAllowedForOrigins</Key>
3826         <ValueName>1</ValueName>
3827         <Value>https://www.example.com</Value>
3828     </Entry>
3829     <Entry type="1" type_name="REG_SZ">
3830         <Key>Software\Policies\Google\Chrome\SSLErrorOverrideAllowedForOrigins</Key>
3831         <ValueName>2</ValueName>
3832         <Value>[*.]example.edu</Value>
3833     </Entry>
3834     <Entry type="1" type_name="REG_SZ">
3835         <Key>Software\Policies\Google\Chrome\SafeBrowsingAllowlistDomains</Key>
3836         <ValueName>1</ValueName>
3837         <Value>mydomain.com</Value>
3838     </Entry>
3839     <Entry type="1" type_name="REG_SZ">
3840         <Key>Software\Policies\Google\Chrome\SafeBrowsingAllowlistDomains</Key>
3841         <ValueName>2</ValueName>
3842         <Value>myuniversity.edu</Value>
3843     </Entry>
3844     <Entry type="1" type_name="REG_SZ">
3845         <Key>Software\Policies\Google\Chrome\SecurityKeyPermitAttestation</Key>
3846         <ValueName>1</ValueName>
3847         <Value>https://example.com</Value>
3848     </Entry>
3849     <Entry type="1" type_name="REG_SZ">
3850         <Key>Software\Policies\Google\Chrome\SensorsAllowedForUrls</Key>
3851         <ValueName>1</ValueName>
3852         <Value>https://www.example.com</Value>
3853     </Entry>
3854     <Entry type="1" type_name="REG_SZ">
3855         <Key>Software\Policies\Google\Chrome\SensorsAllowedForUrls</Key>
3856         <ValueName>2</ValueName>
3857         <Value>[*.]example.edu</Value>
3858     </Entry>
3859     <Entry type="1" type_name="REG_SZ">
3860         <Key>Software\Policies\Google\Chrome\SensorsBlockedForUrls</Key>
3861         <ValueName>1</ValueName>
3862         <Value>https://www.example.com</Value>
3863     </Entry>
3864     <Entry type="1" type_name="REG_SZ">
3865         <Key>Software\Policies\Google\Chrome\SensorsBlockedForUrls</Key>
3866         <ValueName>2</ValueName>
3867         <Value>[*.]example.edu</Value>
3868     </Entry>
3869     <Entry type="1" type_name="REG_SZ">
3870         <Key>Software\Policies\Google\Chrome\SerialAskForUrls</Key>
3871         <ValueName>1</ValueName>
3872         <Value>https://www.example.com</Value>
3873     </Entry>
3874     <Entry type="1" type_name="REG_SZ">
3875         <Key>Software\Policies\Google\Chrome\SerialAskForUrls</Key>
3876         <ValueName>2</ValueName>
3877         <Value>[*.]example.edu</Value>
3878     </Entry>
3879     <Entry type="1" type_name="REG_SZ">
3880         <Key>Software\Policies\Google\Chrome\SerialBlockedForUrls</Key>
3881         <ValueName>1</ValueName>
3882         <Value>https://www.example.com</Value>
3883     </Entry>
3884     <Entry type="1" type_name="REG_SZ">
3885         <Key>Software\Policies\Google\Chrome\SerialBlockedForUrls</Key>
3886         <ValueName>2</ValueName>
3887         <Value>[*.]example.edu</Value>
3888     </Entry>
3889     <Entry type="1" type_name="REG_SZ">
3890         <Key>Software\Policies\Google\Chrome\SpellcheckLanguage</Key>
3891         <ValueName>1</ValueName>
3892         <Value>fr</Value>
3893     </Entry>
3894     <Entry type="1" type_name="REG_SZ">
3895         <Key>Software\Policies\Google\Chrome\SpellcheckLanguage</Key>
3896         <ValueName>2</ValueName>
3897         <Value>es</Value>
3898     </Entry>
3899     <Entry type="1" type_name="REG_SZ">
3900         <Key>Software\Policies\Google\Chrome\SpellcheckLanguageBlocklist</Key>
3901         <ValueName>1</ValueName>
3902         <Value>fr</Value>
3903     </Entry>
3904     <Entry type="1" type_name="REG_SZ">
3905         <Key>Software\Policies\Google\Chrome\SpellcheckLanguageBlocklist</Key>
3906         <ValueName>2</ValueName>
3907         <Value>es</Value>
3908     </Entry>
3909     <Entry type="1" type_name="REG_SZ">
3910         <Key>Software\Policies\Google\Chrome\SyncTypesListDisabled</Key>
3911         <ValueName>1</ValueName>
3912         <Value>bookmarks</Value>
3913     </Entry>
3914     <Entry type="1" type_name="REG_SZ">
3915         <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3916         <ValueName>1</ValueName>
3917         <Value>example.com</Value>
3918     </Entry>
3919     <Entry type="1" type_name="REG_SZ">
3920         <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3921         <ValueName>2</ValueName>
3922         <Value>https://ssl.server.com</Value>
3923     </Entry>
3924     <Entry type="1" type_name="REG_SZ">
3925         <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3926         <ValueName>3</ValueName>
3927         <Value>hosting.com/good_path</Value>
3928     </Entry>
3929     <Entry type="1" type_name="REG_SZ">
3930         <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3931         <ValueName>4</ValueName>
3932         <Value>https://server:8080/path</Value>
3933     </Entry>
3934     <Entry type="1" type_name="REG_SZ">
3935         <Key>Software\Policies\Google\Chrome\URLAllowlist</Key>
3936         <ValueName>5</ValueName>
3937         <Value>.exact.hostname.com</Value>
3938     </Entry>
3939     <Entry type="1" type_name="REG_SZ">
3940         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3941         <ValueName>1</ValueName>
3942         <Value>example.com</Value>
3943     </Entry>
3944     <Entry type="1" type_name="REG_SZ">
3945         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3946         <ValueName>2</ValueName>
3947         <Value>https://ssl.server.com</Value>
3948     </Entry>
3949     <Entry type="1" type_name="REG_SZ">
3950         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3951         <ValueName>3</ValueName>
3952         <Value>hosting.com/bad_path</Value>
3953     </Entry>
3954     <Entry type="1" type_name="REG_SZ">
3955         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3956         <ValueName>4</ValueName>
3957         <Value>https://server:8080/path</Value>
3958     </Entry>
3959     <Entry type="1" type_name="REG_SZ">
3960         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3961         <ValueName>5</ValueName>
3962         <Value>.exact.hostname.com</Value>
3963     </Entry>
3964     <Entry type="1" type_name="REG_SZ">
3965         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3966         <ValueName>6</ValueName>
3967         <Value>file://*</Value>
3968     </Entry>
3969     <Entry type="1" type_name="REG_SZ">
3970         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3971         <ValueName>7</ValueName>
3972         <Value>custom_scheme:*</Value>
3973     </Entry>
3974     <Entry type="1" type_name="REG_SZ">
3975         <Key>Software\Policies\Google\Chrome\URLBlocklist</Key>
3976         <ValueName>8</ValueName>
3977         <Value>*</Value>
3978     </Entry>
3979     <Entry type="1" type_name="REG_SZ">
3980         <Key>Software\Policies\Google\Chrome\VideoCaptureAllowedUrls</Key>
3981         <ValueName>1</ValueName>
3982         <Value>https://www.example.com/</Value>
3983     </Entry>
3984     <Entry type="1" type_name="REG_SZ">
3985         <Key>Software\Policies\Google\Chrome\VideoCaptureAllowedUrls</Key>
3986         <ValueName>2</ValueName>
3987         <Value>https://[*.]example.edu/</Value>
3988     </Entry>
3989     <Entry type="1" type_name="REG_SZ">
3990         <Key>Software\Policies\Google\Chrome\WebRtcLocalIpsAllowedUrls</Key>
3991         <ValueName>1</ValueName>
3992         <Value>https://www.example.com</Value>
3993     </Entry>
3994     <Entry type="1" type_name="REG_SZ">
3995         <Key>Software\Policies\Google\Chrome\WebRtcLocalIpsAllowedUrls</Key>
3996         <ValueName>2</ValueName>
3997         <Value>*example.com*</Value>
3998     </Entry>
3999     <Entry type="1" type_name="REG_SZ">
4000         <Key>Software\Policies\Google\Chrome\WebUsbAskForUrls</Key>
4001         <ValueName>1</ValueName>
4002         <Value>https://www.example.com</Value>
4003     </Entry>
4004     <Entry type="1" type_name="REG_SZ">
4005         <Key>Software\Policies\Google\Chrome\WebUsbAskForUrls</Key>
4006         <ValueName>2</ValueName>
4007         <Value>[*.]example.edu</Value>
4008     </Entry>
4009     <Entry type="1" type_name="REG_SZ">
4010         <Key>Software\Policies\Google\Chrome\WebUsbBlockedForUrls</Key>
4011         <ValueName>1</ValueName>
4012         <Value>https://www.example.com</Value>
4013     </Entry>
4014     <Entry type="1" type_name="REG_SZ">
4015         <Key>Software\Policies\Google\Chrome\WebUsbBlockedForUrls</Key>
4016         <ValueName>2</ValueName>
4017         <Value>[*.]example.edu</Value>
4018     </Entry>
4019     <Entry type="4" type_name="REG_DWORD">
4020         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4021         <ValueName>AlternateErrorPagesEnabled</ValueName>
4022         <Value>1</Value>
4023     </Entry>
4024     <Entry type="1" type_name="REG_SZ">
4025         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4026         <ValueName>ApplicationLocaleValue</ValueName>
4027         <Value>en</Value>
4028     </Entry>
4029     <Entry type="4" type_name="REG_DWORD">
4030         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4031         <ValueName>AutofillAddressEnabled</ValueName>
4032         <Value>0</Value>
4033     </Entry>
4034     <Entry type="4" type_name="REG_DWORD">
4035         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4036         <ValueName>AutofillCreditCardEnabled</ValueName>
4037         <Value>0</Value>
4038     </Entry>
4039     <Entry type="4" type_name="REG_DWORD">
4040         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4041         <ValueName>BackgroundModeEnabled</ValueName>
4042         <Value>1</Value>
4043     </Entry>
4044     <Entry type="4" type_name="REG_DWORD">
4045         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4046         <ValueName>BlockThirdPartyCookies</ValueName>
4047         <Value>0</Value>
4048     </Entry>
4049     <Entry type="4" type_name="REG_DWORD">
4050         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4051         <ValueName>BookmarkBarEnabled</ValueName>
4052         <Value>1</Value>
4053     </Entry>
4054     <Entry type="1" type_name="REG_SZ">
4055         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4056         <ValueName>DefaultDownloadDirectory</ValueName>
4057         <Value>/home/${user_name}/Downloads</Value>
4058     </Entry>
4059     <Entry type="1" type_name="REG_SZ">
4060         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4061         <ValueName>DownloadDirectory</ValueName>
4062         <Value>/home/${user_name}/Downloads</Value>
4063     </Entry>
4064     <Entry type="4" type_name="REG_DWORD">
4065         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4066         <ValueName>DownloadRestrictions</ValueName>
4067         <Value>2</Value>
4068     </Entry>
4069     <Entry type="4" type_name="REG_DWORD">
4070         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4071         <ValueName>HomepageIsNewTabPage</ValueName>
4072         <Value>1</Value>
4073     </Entry>
4074     <Entry type="1" type_name="REG_SZ">
4075         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4076         <ValueName>HomepageLocation</ValueName>
4077         <Value>https://www.chromium.org</Value>
4078     </Entry>
4079     <Entry type="4" type_name="REG_DWORD">
4080         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4081         <ValueName>ImportAutofillFormData</ValueName>
4082         <Value>1</Value>
4083     </Entry>
4084     <Entry type="4" type_name="REG_DWORD">
4085         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4086         <ValueName>ImportBookmarks</ValueName>
4087         <Value>1</Value>
4088     </Entry>
4089     <Entry type="4" type_name="REG_DWORD">
4090         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4091         <ValueName>ImportHistory</ValueName>
4092         <Value>1</Value>
4093     </Entry>
4094     <Entry type="4" type_name="REG_DWORD">
4095         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4096         <ValueName>ImportSavedPasswords</ValueName>
4097         <Value>1</Value>
4098     </Entry>
4099     <Entry type="4" type_name="REG_DWORD">
4100         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4101         <ValueName>ImportSearchEngine</ValueName>
4102         <Value>1</Value>
4103     </Entry>
4104     <Entry type="4" type_name="REG_DWORD">
4105         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4106         <ValueName>MetricsReportingEnabled</ValueName>
4107         <Value>1</Value>
4108     </Entry>
4109     <Entry type="4" type_name="REG_DWORD">
4110         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4111         <ValueName>NetworkPredictionOptions</ValueName>
4112         <Value>1</Value>
4113     </Entry>
4114     <Entry type="4" type_name="REG_DWORD">
4115         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4116         <ValueName>PasswordLeakDetectionEnabled</ValueName>
4117         <Value>1</Value>
4118     </Entry>
4119     <Entry type="4" type_name="REG_DWORD">
4120         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4121         <ValueName>PasswordManagerEnabled</ValueName>
4122         <Value>1</Value>
4123     </Entry>
4124     <Entry type="4" type_name="REG_DWORD">
4125         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4126         <ValueName>PrintHeaderFooter</ValueName>
4127         <Value>0</Value>
4128     </Entry>
4129     <Entry type="4" type_name="REG_DWORD">
4130         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4131         <ValueName>PrintPreviewUseSystemDefaultPrinter</ValueName>
4132         <Value>0</Value>
4133     </Entry>
4134     <Entry type="1" type_name="REG_SZ">
4135         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4136         <ValueName>RegisteredProtocolHandlers</ValueName>
4137         <Value>[{&quot;default&quot;: true, &quot;protocol&quot;: &quot;mailto&quot;, &quot;url&quot;: &quot;https://mail.google.com/mail/?extsrc=mailto&amp;url=%s&quot;}]</Value>
4138     </Entry>
4139     <Entry type="4" type_name="REG_DWORD">
4140         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4141         <ValueName>RestoreOnStartup</ValueName>
4142         <Value>4</Value>
4143     </Entry>
4144     <Entry type="4" type_name="REG_DWORD">
4145         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4146         <ValueName>SafeBrowsingForTrustedSourcesEnabled</ValueName>
4147         <Value>0</Value>
4148     </Entry>
4149     <Entry type="4" type_name="REG_DWORD">
4150         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4151         <ValueName>SafeBrowsingProtectionLevel</ValueName>
4152         <Value>2</Value>
4153     </Entry>
4154     <Entry type="4" type_name="REG_DWORD">
4155         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4156         <ValueName>SearchSuggestEnabled</ValueName>
4157         <Value>1</Value>
4158     </Entry>
4159     <Entry type="4" type_name="REG_DWORD">
4160         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4161         <ValueName>ShowFullUrlsInAddressBar</ValueName>
4162         <Value>0</Value>
4163     </Entry>
4164     <Entry type="4" type_name="REG_DWORD">
4165         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4166         <ValueName>ShowHomeButton</ValueName>
4167         <Value>1</Value>
4168     </Entry>
4169     <Entry type="4" type_name="REG_DWORD">
4170         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4171         <ValueName>SpellCheckServiceEnabled</ValueName>
4172         <Value>0</Value>
4173     </Entry>
4174     <Entry type="4" type_name="REG_DWORD">
4175         <Key>Software\Policies\Google\Chrome\Recommended</Key>
4176         <ValueName>TranslateEnabled</ValueName>
4177         <Value>1</Value>
4178     </Entry>
4179     <Entry type="1" type_name="REG_SZ">
4180         <Key>Software\Policies\Google\Chrome\Recommended\RestoreOnStartupURLs</Key>
4181         <ValueName>1</ValueName>
4182         <Value>https://example.com</Value>
4183     </Entry>
4184     <Entry type="1" type_name="REG_SZ">
4185         <Key>Software\Policies\Google\Chrome\Recommended\RestoreOnStartupURLs</Key>
4186         <ValueName>2</ValueName>
4187         <Value>https://www.chromium.org</Value>
4188     </Entry>
4189 </PolFile>
4190 """
4191
4192 chromium_json_expected_managed = \
4193 b"""
4194 {
4195   "FileSystemWriteAskForUrls": [
4196     "https://www.example.com",
4197     "[*.]example.edu"
4198   ],
4199   "InsecureContentBlockedForUrls": [
4200     "https://www.example.com",
4201     "[*.]example.edu"
4202   ],
4203   "DefaultSearchProviderImageURLPostParams": "content={imageThumbnail},url={imageURL},sbisrc={SearchSource}",
4204   "BrowserAddPersonEnabled": true,
4205   "DefaultSearchProviderImageURL": "https://search.my.company/searchbyimage/upload",
4206   "ShowHomeButton": true,
4207   "ClearBrowsingDataOnExitList": [
4208     "browsing_history",
4209     "download_history",
4210     "cookies_and_other_site_data",
4211     "cached_images_and_files",
4212     "password_signin",
4213     "autofill",
4214     "site_settings",
4215     "hosted_app_data"
4216   ],
4217   "JavaScriptAllowedForUrls": [
4218     "https://www.example.com",
4219     "[*.]example.edu"
4220   ],
4221   "AmbientAuthenticationInPrivateModesEnabled": 0,
4222   "AllowFileSelectionDialogs": true,
4223   "PrintingAllowedBackgroundGraphicsModes": "enabled",
4224   "DnsOverHttpsTemplates": "https://dns.example.net/dns-query{?dns}",
4225   "ComponentUpdatesEnabled": true,
4226   "RemoteAccessHostAllowRemoteAccessConnections": false,
4227   "WindowOcclusionEnabled": true,
4228   "PrintPreviewUseSystemDefaultPrinter": false,
4229   "AutoLaunchProtocolsFromOrigins": [
4230     {
4231       "allowed_origins": [
4232         "example.com",
4233         "http://www.example.com:8080"
4234       ],
4235       "protocol": "spotify"
4236     },
4237     {
4238       "allowed_origins": [
4239         "https://example.com",
4240         "https://.mail.example.com"
4241       ],
4242       "protocol": "teams"
4243     },
4244     {
4245       "allowed_origins": [
4246         "*"
4247       ],
4248       "protocol": "outlook"
4249     }
4250   ],
4251   "ManagedConfigurationPerOrigin": [
4252     {
4253       "origin": "https://www.google.com",
4254       "managed_configuration_hash": "asd891jedasd12ue9h",
4255       "managed_configuration_url": "https://gstatic.google.com/configuration.json"
4256     },
4257     {
4258       "origin": "https://www.example.com",
4259       "managed_configuration_hash": "djio12easd89u12aws",
4260       "managed_configuration_url": "https://gstatic.google.com/configuration2.json"
4261     }
4262   ],
4263   "SyncTypesListDisabled": [
4264     "bookmarks"
4265   ],
4266   "SecurityKeyPermitAttestation": [
4267     "https://example.com"
4268   ],
4269   "DefaultSearchProviderSearchURL": "https://search.my.company/search?q={searchTerms}",
4270   "MetricsReportingEnabled": true,
4271   "MaxInvalidationFetchDelay": 10000,
4272   "AudioProcessHighPriorityEnabled": true,
4273   "ExtensionInstallForcelist": [
4274     "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx",
4275     "abcdefghijklmnopabcdefghijklmnop"
4276   ],
4277   "ExternalProtocolDialogShowAlwaysOpenCheckbox": true,
4278   "CookiesBlockedForUrls": [
4279     "https://www.example.com",
4280     "[*.]example.edu"
4281   ],
4282   "BrowserSwitcherExternalSitelistUrl": "http://example.com/sitelist.xml",
4283   "AudioCaptureAllowedUrls": [
4284     "https://www.example.com/",
4285     "https://[*.]example.edu/"
4286   ],
4287   "NTPCustomBackgroundEnabled": true,
4288   "BlockExternalExtensions": true,
4289   "BrowserSwitcherChromeParameters": [
4290     "--force-dark-mode"
4291   ],
4292   "SafeSitesFilterBehavior": 0,
4293   "EnableOnlineRevocationChecks": false,
4294   "ImagesBlockedForUrls": [
4295     "https://www.example.com",
4296     "[*.]example.edu"
4297   ],
4298   "InsecureFormsWarningsEnabled": true,
4299   "RelaunchNotificationPeriod": 604800000,
4300   "TotalMemoryLimitMb": 2048,
4301   "CloudManagementEnrollmentMandatory": true,
4302   "ClickToCallEnabled": true,
4303   "AppCacheForceEnabled": false,
4304   "UrlKeyedAnonymizedDataCollectionEnabled": true,
4305   "FullscreenAllowed": true,
4306   "AuthSchemes": "basic,digest,ntlm,negotiate",
4307   "PasswordLeakDetectionEnabled": true,
4308   "AuthServerAllowlist": "*.example.com,example.com",
4309   "AllowSyncXHRInPageDismissal": false,
4310   "PasswordProtectionChangePasswordURL": "https://mydomain.com/change_password.html",
4311   "MaxConnectionsPerProxy": 32,
4312   "RemoteAccessHostMaximumSessionDurationMinutes": 1200,
4313   "RemoteAccessHostAllowFileTransfer": false,
4314   "PrintRasterizationMode": 1,
4315   "CertificateTransparencyEnforcementDisabledForLegacyCas": [
4316     "sha256/AAAAAAAAAAAAAAAAAAAAAA==",
4317     "sha256//////////////////////w=="
4318   ],
4319   "DefaultWebBluetoothGuardSetting": 2,
4320   "AutoplayAllowed": true,
4321   "BrowserSwitcherUrlList": [
4322     "ie.com",
4323     "!open-in-chrome.ie.com",
4324     "foobar.com/ie-only/"
4325   ],
4326   "CertificateTransparencyEnforcementDisabledForUrls": [
4327     "example.com",
4328     ".example.com"
4329   ],
4330   "SpellcheckLanguageBlocklist": [
4331     "fr",
4332     "es"
4333   ],
4334   "PrintHeaderFooter": false,
4335   "ShowAppsShortcutInBookmarkBar": false,
4336   "SerialAskForUrls": [
4337     "https://www.example.com",
4338     "[*.]example.edu"
4339   ],
4340   "ImagesAllowedForUrls": [
4341     "https://www.example.com",
4342     "[*.]example.edu"
4343   ],
4344   "ProfilePickerOnStartupAvailability": 0,
4345   "CommandLineFlagSecurityWarningsEnabled": true,
4346   "QuicAllowed": true,
4347   "IntensiveWakeUpThrottlingEnabled": true,
4348   "WPADQuickCheckEnabled": true,
4349   "SensorsAllowedForUrls": [
4350     "https://www.example.com",
4351     "[*.]example.edu"
4352   ],
4353   "NTPCardsVisible": true,
4354   "DefaultSearchProviderAlternateURLs": [
4355     "https://search.my.company/suggest#q={searchTerms}",
4356     "https://search.my.company/suggest/search#q={searchTerms}"
4357   ],
4358   "DisableSafeBrowsingProceedAnyway": true,
4359   "DefaultFileSystemWriteGuardSetting": 2,
4360   "DefaultSearchProviderSuggestURL": "https://search.my.company/suggest?q={searchTerms}",
4361   "SSLErrorOverrideAllowed": true,
4362   "CloudPrintProxyEnabled": true,
4363   "BrowserSwitcherUrlGreylist": [
4364     "ie.com",
4365     "!open-in-chrome.ie.com",
4366     "foobar.com/ie-only/"
4367   ],
4368   "BrowserNetworkTimeQueriesEnabled": true,
4369   "WebUsbAllowDevicesForUrls": [
4370     {
4371       "urls": [
4372         "https://google.com"
4373       ],
4374       "devices": [
4375         {
4376           "vendor_id": 1234,
4377           "product_id": 5678
4378         }
4379       ]
4380     }
4381   ],
4382   "TaskManagerEndProcessEnabled": true,
4383   "SuppressDifferentOriginSubframeDialogs": true,
4384   "UserDataDir": "${users}/${user_name}/Chrome",
4385   "CookiesAllowedForUrls": [
4386     "https://www.example.com",
4387     "[*.]example.edu"
4388   ],
4389   "SuppressUnsupportedOSWarning": true,
4390   "RequireOnlineRevocationChecksForLocalAnchors": false,
4391   "BrowsingDataLifetime": [
4392     {
4393       "data_types": [
4394         "browsing_history"
4395       ],
4396       "time_to_live_in_hours": 24
4397     },
4398     {
4399       "data_types": [
4400         "password_signin",
4401         "autofill"
4402       ],
4403       "time_to_live_in_hours": 12
4404     }
4405   ],
4406   "FileHandlingBlockedForUrls": [
4407     "https://www.example.com",
4408     "[*.]example.edu"
4409   ],
4410   "AudioCaptureAllowed": false,
4411   "PromotionalTabsEnabled": false,
4412   "ShowFullUrlsInAddressBar": false,
4413   "EnableMediaRouter": true,
4414   "BrowserSwitcherDelay": 10000,
4415   "AllowDinosaurEasterEgg": false,
4416   "ImportSearchEngine": true,
4417   "PrintingBackgroundGraphicsDefault": "enabled",
4418   "TripleDESEnabled": false,
4419   "AutoplayAllowlist": [
4420     "https://www.example.com",
4421     "[*.]example.edu"
4422   ],
4423   "RemoteAccessHostUdpPortRange": "12400-12409",
4424   "DefaultSearchProviderIconURL": "https://search.my.company/favicon.ico",
4425   "BrowserSwitcherChromePath": "${chrome}",
4426   "InsecureContentAllowedForUrls": [
4427     "https://www.example.com",
4428     "[*.]example.edu"
4429   ],
4430   "DefaultSearchProviderSearchURLPostParams": "q={searchTerms},ie=utf-8,oe=utf-8",
4431   "ForceGoogleSafeSearch": false,
4432   "UserFeedbackAllowed": true,
4433   "ForceYouTubeRestrict": 0,
4434   "ApplicationLocaleValue": "en",
4435   "RoamingProfileSupportEnabled": true,
4436   "AlternativeBrowserPath": "${ie}",
4437   "AlternativeBrowserParameters": [
4438     "-foreground",
4439     "-new-window",
4440     "${url}",
4441     "-profile",
4442     "%HOME%\\\\browser_profile"
4443   ],
4444   "AdvancedProtectionAllowed": true,
4445   "EditBookmarksEnabled": false,
4446   "DefaultPrinterSelection": "{ \\"kind\\": \\"cloud\\", \\"idPattern\\": \\".*public\\", \\"namePattern\\": \\".*Color\\" }",
4447   "SSLVersionMin": "tls1",
4448   "SharedArrayBufferUnrestrictedAccessAllowed": true,
4449   "DefaultSerialGuardSetting": 2,
4450   "DefaultPopupsSetting": 1,
4451   "IntranetRedirectBehavior": 1,
4452   "RendererCodeIntegrityEnabled": false,
4453   "BrowserGuestModeEnforced": true,
4454   "HSTSPolicyBypassList": [
4455     "meet"
4456   ],
4457   "DefaultWebUsbGuardSetting": 2,
4458   "CECPQ2Enabled": true,
4459   "RemoteAccessHostDomainList": [
4460     "my-awesome-domain.com",
4461     "my-auxiliary-domain.com"
4462   ],
4463   "URLBlocklist": [
4464     "example.com",
4465     "https://ssl.server.com",
4466     "hosting.com/bad_path",
4467     "https://server:8080/path",
4468     ".exact.hostname.com",
4469     "file://*",
4470     "custom_scheme:*",
4471     "*"
4472   ],
4473   "IsolateOrigins": "https://example.com/,https://othersite.org/",
4474   "ExtensionAllowedTypes": [
4475     "hosted_app"
4476   ],
4477   "NativeMessagingBlocklist": [
4478     "com.native.messaging.host.name1",
4479     "com.native.messaging.host.name2"
4480   ],
4481   "ExtensionSettings": {
4482     "abcdefghijklmnopabcdefghijklmnop": {
4483       "blocked_permissions": [
4484         "history"
4485       ],
4486       "minimum_version_required": "1.0.1",
4487       "toolbar_pin": "force_pinned",
4488       "installation_mode": "allowed"
4489     },
4490     "bcdefghijklmnopabcdefghijklmnopa": {
4491       "runtime_blocked_hosts": [
4492         "*://*.example.com"
4493       ],
4494       "allowed_permissions": [
4495         "downloads"
4496       ],
4497       "update_url": "https://example.com/update_url",
4498       "runtime_allowed_hosts": [
4499         "*://good.example.com"
4500       ],
4501       "installation_mode": "force_installed"
4502     },
4503     "update_url:https://www.example.com/update.xml": {
4504       "allowed_permissions": [
4505         "downloads"
4506       ],
4507       "blocked_permissions": [
4508         "wallpaper"
4509       ],
4510       "installation_mode": "allowed"
4511     },
4512     "cdefghijklmnopabcdefghijklmnopab": {
4513       "blocked_install_message": "Custom error message.",
4514       "installation_mode": "blocked"
4515     },
4516     "*": {
4517       "blocked_permissions": [
4518         "downloads",
4519         "bookmarks"
4520       ],
4521       "installation_mode": "blocked",
4522       "runtime_blocked_hosts": [
4523         "*://*.example.com"
4524       ],
4525       "blocked_install_message": "Custom error message.",
4526       "allowed_types": [
4527         "hosted_app"
4528       ],
4529       "runtime_allowed_hosts": [
4530         "*://good.example.com"
4531       ],
4532       "install_sources": [
4533         "https://company-intranet/chromeapps"
4534       ]
4535     },
4536     "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": {
4537       "blocked_install_message": "Custom error message.",
4538       "installation_mode": "blocked"
4539     },
4540     "fghijklmnopabcdefghijklmnopabcde": {
4541       "blocked_install_message": "Custom removal message.",
4542       "installation_mode": "removed"
4543     },
4544     "ghijklmnopabcdefghijklmnopabcdef": {
4545       "update_url": "https://example.com/update_url",
4546       "override_update_url": true,
4547       "installation_mode": "force_installed"
4548     }
4549   },
4550   "FileSystemReadAskForUrls": [
4551     "https://www.example.com",
4552     "[*.]example.edu"
4553   ],
4554   "SpellCheckServiceEnabled": false,
4555   "ExtensionInstallSources": [
4556     "https://corp.mycompany.com/*"
4557   ],
4558   "PrinterTypeDenyList": [
4559     "cloud",
4560     "privet"
4561   ],
4562   "SharedClipboardEnabled": true,
4563   "BlockThirdPartyCookies": false,
4564   "MediaRouterCastAllowAllIPs": false,
4565   "DnsOverHttpsMode": "off",
4566   "SyncDisabled": true,
4567   "LookalikeWarningAllowlistDomains": [
4568     "foo.example.com",
4569     "example.org"
4570   ],
4571   "UserDataSnapshotRetentionLimit": 3,
4572   "SafeBrowsingProtectionLevel": 2,
4573   "ScrollToTextFragmentEnabled": false,
4574   "ImportBookmarks": true,
4575   "DefaultBrowserSettingEnabled": true,
4576   "DefaultSearchProviderEnabled": true,
4577   "AdditionalDnsQueryTypesEnabled": true,
4578   "PolicyRefreshRate": 3600000,
4579   "PrintingPaperSizeDefault": {
4580     "custom_size": {
4581       "width": 210000,
4582       "height": 297000
4583     },
4584     "name": "custom"
4585   },
4586   "RestoreOnStartup": 4,
4587   "PasswordProtectionWarningTrigger": 1,
4588   "ChromeCleanupEnabled": true,
4589   "AbusiveExperienceInterventionEnforce": true,
4590   "BasicAuthOverHttpEnabled": false,
4591   "EnableAuthNegotiatePort": false,
4592   "DefaultGeolocationSetting": 1,
4593   "PolicyDictionaryMultipleSourceMergeList": [
4594     "ExtensionSettings"
4595   ],
4596   "AllowedDomainsForApps": "managedchrome.com,example.com",
4597   "DisableAuthNegotiateCnameLookup": false,
4598   "IncognitoModeAvailability": 1,
4599   "ChromeVariations": 1,
4600   "DefaultSearchProviderNewTabURL": "https://search.my.company/newtab",
4601   "SavingBrowserHistoryDisabled": true,
4602   "SpellcheckEnabled": false,
4603   "FileSystemWriteBlockedForUrls": [
4604     "https://www.example.com",
4605     "[*.]example.edu"
4606   ],
4607   "BuiltInDnsClientEnabled": true,
4608   "SSLErrorOverrideAllowedForOrigins": [
4609     "https://www.example.com",
4610     "[*.]example.edu"
4611   ],
4612   "WebRtcIPHandling": "default",
4613   "DefaultNotificationsSetting": 2,
4614   "PopupsAllowedForUrls": [
4615     "https://www.example.com",
4616     "[*.]example.edu"
4617   ],
4618   "TranslateEnabled": true,
4619   "DefaultSearchProviderEncodings": [
4620     "UTF-8",
4621     "UTF-16",
4622     "GB2312",
4623     "ISO-8859-1"
4624   ],
4625   "DownloadRestrictions": 2,
4626   "PromptForDownloadLocation": false,
4627   "DisablePrintPreview": false,
4628   "NetworkPredictionOptions": 1,
4629   "FileSystemReadBlockedForUrls": [
4630     "https://www.example.com",
4631     "[*.]example.edu"
4632   ],
4633   "AutoOpenFileTypes": [
4634     "exe",
4635     "txt"
4636   ],
4637   "DownloadDirectory": "/home/${user_name}/Downloads",
4638   "ImportHomepage": true,
4639   "GloballyScopeHTTPAuthCacheEnabled": false,
4640   "CloudManagementEnrollmentToken": "37185d02-e055-11e7-80c1-9a214cf093ae",
4641   "ThirdPartyBlockingEnabled": false,
4642   "AdsSettingForIntrusiveAdsSites": 1,
4643   "FetchKeepaliveDurationSecondsOnShutdown": 1,
4644   "BookmarkBarEnabled": true,
4645   "DisableScreenshots": true,
4646   "AccessibilityImageLabelsEnabled": false,
4647   "RemoteAccessHostAllowUiAccessForRemoteAssistance": true,
4648   "PopupsBlockedForUrls": [
4649     "https://www.example.com",
4650     "[*.]example.edu"
4651   ],
4652   "DefaultFileSystemReadGuardSetting": 2,
4653   "BrowserSignin": 2,
4654   "WebRtcAllowLegacyTLSProtocols": false,
4655   "PasswordManagerEnabled": true,
4656   "SafeBrowsingExtendedReportingEnabled": true,
4657   "CloudPolicyOverridesPlatformPolicy": false,
4658   "InsecurePrivateNetworkRequestsAllowedForUrls": [
4659     "http://www.example.com:8080",
4660     "[*.]example.edu"
4661   ],
4662   "RelaunchNotification": 1,
4663   "AlwaysOpenPdfExternally": true,
4664   "DefaultFileHandlingGuardSetting": 2,
4665   "ForceEphemeralProfiles": true,
4666   "PasswordProtectionLoginURLs": [
4667     "https://mydomain.com/login.html",
4668     "https://login.mydomain.com"
4669   ],
4670   "BrowserSwitcherExternalGreylistUrl": "http://example.com/greylist.xml",
4671   "BrowserGuestModeEnabled": true,
4672   "MediaRecommendationsEnabled": true,
4673   "WebRtcLocalIpsAllowedUrls": [
4674     "https://www.example.com",
4675     "*example.com*"
4676   ],
4677   "DeveloperToolsAvailability": 2,
4678   "DNSInterceptionChecksEnabled": true,
4679   "DefaultSearchProviderContextMenuAccessAllowed": true,
4680   "RemoteAccessHostRequireCurtain": false,
4681   "PaymentMethodQueryEnabled": true,
4682   "HomepageLocation": "https://www.chromium.org",
4683   "WebUsbAskForUrls": [
4684     "https://www.example.com",
4685     "[*.]example.edu"
4686   ],
4687   "RemoteAccessHostAllowClientPairing": false,
4688   "ProxySettings": {
4689     "ProxyMode": "direct",
4690     "ProxyPacUrl": "https://internal.site/example.pac",
4691     "ProxyServer": "123.123.123.123:8080",
4692     "ProxyServerMode": 2,
4693     "ProxyBypassList": "https://www.example1.com,https://www.example2.com,https://internalsite/"
4694   },
4695   "AutofillCreditCardEnabled": false,
4696   "FileHandlingAllowedForUrls": [
4697     "https://www.example.com",
4698     "[*.]example.edu"
4699   ],
4700   "ChromeCleanupReportingEnabled": true,
4701   "AlternateErrorPagesEnabled": true,
4702   "WebRtcEventLogCollectionAllowed": true,
4703   "AutoSelectCertificateForUrls": [
4704     "{\\"pattern\\":\\"https://www.example.com\\",\\"filter\\":{\\"ISSUER\\":{\\"CN\\":\\"certificate issuer name\\", \\"L\\": \\"certificate issuer location\\", \\"O\\": \\"certificate issuer org\\", \\"OU\\": \\"certificate issuer org unit\\"}, \\"SUBJECT\\":{\\"CN\\":\\"certificate subject name\\", \\"L\\": \\"certificate subject location\\", \\"O\\": \\"certificate subject org\\", \\"OU\\": \\"certificate subject org unit\\"}}}"
4705   ],
4706   "PolicyListMultipleSourceMergeList": [
4707     "ExtensionInstallAllowlist",
4708     "ExtensionInstallBlocklist"
4709   ],
4710   "CertificateTransparencyEnforcementDisabledForCas": [
4711     "sha256/AAAAAAAAAAAAAAAAAAAAAA==",
4712     "sha256//////////////////////w=="
4713   ],
4714   "CookiesSessionOnlyForUrls": [
4715     "https://www.example.com",
4716     "[*.]example.edu"
4717   ],
4718   "SitePerProcess": true,
4719   "RemoteAccessHostFirewallTraversal": false,
4720   "DefaultSearchProviderSuggestURLPostParams": "q={searchTerms},ie=utf-8,oe=utf-8",
4721   "BackgroundModeEnabled": true,
4722   "DefaultJavaScriptSetting": 1,
4723   "ForcedLanguages": [
4724     "en-US"
4725   ],
4726   "ManagedBookmarks": [
4727     {
4728       "toplevel_name": "My managed bookmarks folder"
4729     },
4730     {
4731       "url": "google.com",
4732       "name": "Google"
4733     },
4734     {
4735       "url": "youtube.com",
4736       "name": "Youtube"
4737     },
4738     {
4739       "children": [
4740         {
4741           "url": "chromium.org",
4742           "name": "Chromium"
4743         },
4744         {
4745           "url": "dev.chromium.org",
4746           "name": "Chromium Developers"
4747         }
4748       ],
4749       "name": "Chrome links"
4750     }
4751   ],
4752   "Disable3DAPIs": false,
4753   "CloudPrintSubmitEnabled": true,
4754   "DefaultCookiesSetting": 1,
4755   "ExtensionInstallBlocklist": [
4756     "extension_id1",
4757     "extension_id2"
4758   ],
4759   "URLAllowlist": [
4760     "example.com",
4761     "https://ssl.server.com",
4762     "hosting.com/good_path",
4763     "https://server:8080/path",
4764     ".exact.hostname.com"
4765   ],
4766   "ExplicitlyAllowedNetworkPorts": [
4767     "10080"
4768   ],
4769   "HomepageIsNewTabPage": true,
4770   "SensorsBlockedForUrls": [
4771     "https://www.example.com",
4772     "[*.]example.edu"
4773   ],
4774   "BrowserLabsEnabled": false,
4775   "NotificationsAllowedForUrls": [
4776     "https://www.example.com",
4777     "[*.]example.edu"
4778   ],
4779   "NativeMessagingUserLevelHosts": false,
4780   "AuthNegotiateDelegateAllowlist": "foobar.example.com",
4781   "CloudUserPolicyMerge": true,
4782   "OverrideSecurityRestrictionsOnInsecureOrigin": [
4783     "http://testserver.example.com/",
4784     "*.example.org"
4785   ],
4786   "HideWebStoreIcon": true,
4787   "SafeBrowsingForTrustedSourcesEnabled": false,
4788   "NewTabPageLocation": "https://www.chromium.org",
4789   "DiskCacheSize": 104857600,
4790   "BrowserSwitcherUseIeSitelist": true,
4791   "WebRtcUdpPortRange": "10000-11999",
4792   "EnterpriseHardwarePlatformAPIEnabled": true,
4793   "AutoOpenAllowedForURLs": [
4794     "example.com",
4795     "https://ssl.server.com",
4796     "hosting.com/good_path",
4797     "https://server:8080/path",
4798     ".exact.hostname.com"
4799   ],
4800   "NativeMessagingAllowlist": [
4801     "com.native.messaging.host.name1",
4802     "com.native.messaging.host.name2"
4803   ],
4804   "DefaultSearchProviderName": "My Intranet Search",
4805   "JavaScriptBlockedForUrls": [
4806     "https://www.example.com",
4807     "[*.]example.edu"
4808   ],
4809   "EnableExperimentalPolicies": [
4810     "ExtensionInstallAllowlist",
4811     "ExtensionInstallBlocklist"
4812   ],
4813   "SafeBrowsingAllowlistDomains": [
4814     "mydomain.com",
4815     "myuniversity.edu"
4816   ],
4817   "AutofillAddressEnabled": false,
4818   "AllowCrossOriginAuthPrompt": false,
4819   "SpellcheckLanguage": [
4820     "fr",
4821     "es"
4822   ],
4823   "VideoCaptureAllowed": false,
4824   "ScreenCaptureAllowed": false,
4825   "VideoCaptureAllowedUrls": [
4826     "https://www.example.com/",
4827     "https://[*.]example.edu/"
4828   ],
4829   "ImportHistory": true,
4830   "ShowCastIconInToolbar": false,
4831   "RestoreOnStartupURLs": [
4832     "https://example.com",
4833     "https://www.chromium.org"
4834   ],
4835   "LegacySameSiteCookieBehaviorEnabledForDomainList": [
4836     "www.example.com",
4837     "[*.]example.edu"
4838   ],
4839   "PrintingEnabled": true,
4840   "ImportSavedPasswords": true,
4841   "EnableDeprecatedPrivetPrinting": true,
4842   "InsecurePrivateNetworkRequestsAllowed": false,
4843   "HeadlessMode": 2,
4844   "PolicyAtomicGroupsEnabled": true,
4845   "HardwareAccelerationModeEnabled": true,
4846   "AllowDeletingBrowserHistory": true,
4847   "DefaultSearchProviderKeyword": "mis",
4848   "ExtensionInstallAllowlist": [
4849     "extension_id1",
4850     "extension_id2"
4851   ],
4852   "WebAppInstallForceList": [
4853     {
4854       "url": "https://www.google.com/maps",
4855       "create_desktop_shortcut": true,
4856       "default_launch_container": "window"
4857     },
4858     {
4859       "url": "https://docs.google.com",
4860       "default_launch_container": "tab"
4861     },
4862     {
4863       "url": "https://docs.google.com/editor",
4864       "fallback_app_name": "Editor",
4865       "default_launch_container": "window"
4866     }
4867   ],
4868   "DiskCacheDir": "${user_home}/Chrome_cache",
4869   "SignedHTTPExchangeEnabled": true,
4870   "SearchSuggestEnabled": true,
4871   "BrowserThemeColor": "#FFFFFF",
4872   "RestrictSigninToPattern": ".*@example\\\\.com",
4873   "DefaultInsecureContentSetting": 2,
4874   "DefaultSensorsSetting": 2,
4875   "AudioSandboxEnabled": true,
4876   "RemoteAccessHostAllowRelayedConnection": false,
4877   "RoamingProfileLocation": "${roaming_app_data}\\\\chrome-profile",
4878   "UserAgentClientHintsEnabled": true,
4879   "TargetBlankImpliesNoOpener": false,
4880   "BrowserSwitcherKeepLastChromeTab": false,
4881   "RemoteAccessHostClientDomainList": [
4882     "my-awesome-domain.com",
4883     "my-auxiliary-domain.com"
4884   ],
4885   "NotificationsBlockedForUrls": [
4886     "https://www.example.com",
4887     "[*.]example.edu"
4888   ],
4889   "SerialBlockedForUrls": [
4890     "https://www.example.com",
4891     "[*.]example.edu"
4892   ],
4893   "DefaultImagesSetting": 1,
4894   "SigninInterceptionEnabled": true,
4895   "WebUsbBlockedForUrls": [
4896     "https://www.example.com",
4897     "[*.]example.edu"
4898   ],
4899   "ImportAutofillFormData": true,
4900   "BrowserSwitcherEnabled": true
4901 }
4902 """
4903
4904 chromium_json_expected_recommended = \
4905 b"""
4906 {
4907   "BackgroundModeEnabled": true,
4908   "RestoreOnStartup": 4,
4909   "RegisteredProtocolHandlers": [
4910     {
4911       "default": true,
4912       "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s",
4913       "protocol": "mailto"
4914     }
4915   ],
4916   "ShowHomeButton": true,
4917   "PrintHeaderFooter": false,
4918   "SafeBrowsingForTrustedSourcesEnabled": false,
4919   "ShowFullUrlsInAddressBar": false,
4920   "MetricsReportingEnabled": true,
4921   "SpellCheckServiceEnabled": false,
4922   "ImportSearchEngine": true,
4923   "DownloadRestrictions": 2,
4924   "NetworkPredictionOptions": 1,
4925   "DownloadDirectory": "/home/${user_name}/Downloads",
4926   "TranslateEnabled": true,
4927   "AutofillAddressEnabled": false,
4928   "BookmarkBarEnabled": true,
4929   "PrintPreviewUseSystemDefaultPrinter": false,
4930   "ApplicationLocaleValue": "en",
4931   "ImportHistory": true,
4932   "RestoreOnStartupURLs": [
4933     "https://example.com",
4934     "https://www.chromium.org"
4935   ],
4936   "PasswordManagerEnabled": true,
4937   "ImportSavedPasswords": true,
4938   "DefaultDownloadDirectory": "/home/${user_name}/Downloads",
4939   "PasswordLeakDetectionEnabled": true,
4940   "SearchSuggestEnabled": true,
4941   "AlternateErrorPagesEnabled": true,
4942   "HomepageIsNewTabPage": true,
4943   "ImportAutofillFormData": true,
4944   "BlockThirdPartyCookies": false,
4945   "AutofillCreditCardEnabled": false,
4946   "HomepageLocation": "https://www.chromium.org",
4947   "SafeBrowsingProtectionLevel": 2,
4948   "ImportBookmarks": true
4949 }
4950 """
4951
4952 firewalld_reg_pol = \
4953 b"""
4954 <?xml version="1.0" encoding="utf-8"?>
4955 <PolFile num_entries="6" signature="PReg" version="1">
4956     <Entry type="4" type_name="REG_DWORD">
4957         <Key>Software\Policies\Samba\Unix Settings\Firewalld</Key>
4958         <ValueName>Zones</ValueName>
4959         <Value>1</Value>
4960     </Entry>
4961     <Entry type="4" type_name="REG_DWORD">
4962         <Key>Software\Policies\Samba\Unix Settings\Firewalld</Key>
4963         <ValueName>Rules</ValueName>
4964         <Value>1</Value>
4965     </Entry>
4966     <Entry type="1" type_name="REG_SZ">
4967         <Key>Software\Policies\Samba\Unix Settings\Firewalld\Rules</Key>
4968         <ValueName>Rules</ValueName>
4969         <Value>{&quot;work&quot;: [{&quot;rule&quot;: {&quot;family&quot;: &quot;ipv4&quot;}, &quot;source address&quot;: &quot;172.25.1.7&quot;, &quot;service name&quot;: &quot;ftp&quot;, &quot;reject&quot;: {}}]}</Value>
4970     </Entry>
4971     <Entry type="1" type_name="REG_SZ">
4972         <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
4973         <ValueName>**delvals.</ValueName>
4974         <Value> </Value>
4975     </Entry>
4976     <Entry type="1" type_name="REG_SZ">
4977         <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
4978         <ValueName>work</ValueName>
4979         <Value>work</Value>
4980     </Entry>
4981     <Entry type="1" type_name="REG_SZ">
4982         <Key>Software\Policies\Samba\Unix Settings\Firewalld\Zones</Key>
4983         <ValueName>home</ValueName>
4984         <Value>home</Value>
4985     </Entry>
4986 </PolFile>
4987 """
4988
4989 def days2rel_nttime(val):
4990     seconds = 60
4991     minutes = 60
4992     hours = 24
4993     sam_add = 10000000
4994     return -(val * seconds * minutes * hours * sam_add)
4995
4996 def gpupdate(lp, arg):
4997     gpupdate = lp.get('gpo update command')
4998     gpupdate.append(arg)
4999
5000     p = Popen(gpupdate, stdout=PIPE, stderr=PIPE)
5001     stdoutdata, stderrdata = p.communicate()
5002     print(stderrdata)
5003     return p.returncode
5004
5005 def gpupdate_force(lp):
5006     return gpupdate(lp, '--force')
5007
5008 def gpupdate_unapply(lp):
5009     return gpupdate(lp, '--unapply')
5010
5011 def rsop(lp):
5012     return gpupdate(lp, '--rsop')
5013
5014 def stage_file(path, data):
5015     dirname = os.path.dirname(path)
5016     if not os.path.exists(dirname):
5017         try:
5018             os.makedirs(dirname)
5019         except OSError as e:
5020             if not (e.errno == errno.EEXIST and os.path.isdir(dirname)):
5021                 return False
5022     if os.path.exists(path):
5023         os.rename(path, '%s.bak' % path)
5024     with NamedTemporaryFile(delete=False, dir=os.path.dirname(path)) as f:
5025         f.write(get_bytes(data))
5026         os.rename(f.name, path)
5027         os.chmod(path, 0o644)
5028     return True
5029
5030 def unstage_file(path):
5031     backup = '%s.bak' % path
5032     if os.path.exists(backup):
5033         os.rename(backup, path)
5034     elif os.path.exists(path):
5035         os.remove(path)
5036
5037 class GPOTests(tests.TestCase):
5038     def setUp(self):
5039         super(GPOTests, self).setUp()
5040         self.server = os.environ["SERVER"]
5041         self.dc_account = self.server.upper() + '$'
5042         self.lp = LoadParm()
5043         self.lp.load_default()
5044         self.creds = self.insta_creds(template=self.get_credentials())
5045
5046     def tearDown(self):
5047         super(GPOTests, self).tearDown()
5048
5049     def test_gpo_list(self):
5050         global poldir, dspath
5051         ads = gpo.ADS_STRUCT(self.server, self.lp, self.creds)
5052         if ads.connect():
5053             gpos = ads.get_gpo_list(self.creds.get_username())
5054         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5055         names = ['Local Policy', guid]
5056         file_sys_paths = [None, '%s\\%s' % (poldir, guid)]
5057         ds_paths = [None, 'CN=%s,%s' % (guid, dspath)]
5058         for i in range(0, len(gpos)):
5059             self.assertEqual(gpos[i].name, names[i],
5060                               'The gpo name did not match expected name %s' % gpos[i].name)
5061             self.assertEqual(gpos[i].file_sys_path, file_sys_paths[i],
5062                               'file_sys_path did not match expected %s' % gpos[i].file_sys_path)
5063             self.assertEqual(gpos[i].ds_path, ds_paths[i],
5064                               'ds_path did not match expected %s' % gpos[i].ds_path)
5065
5066     def test_gpo_ads_does_not_segfault(self):
5067         try:
5068             ads = gpo.ADS_STRUCT(self.server, 42, self.creds)
5069         except:
5070             pass
5071
5072     def test_gpt_version(self):
5073         global gpt_data
5074         local_path = self.lp.cache_path('gpo_cache')
5075         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5076         gpo_path = os.path.join(local_path, policies, guid)
5077         old_vers = gpo.gpo_get_sysvol_gpt_version(gpo_path)[1]
5078
5079         with open(os.path.join(gpo_path, 'GPT.INI'), 'w') as gpt:
5080             gpt.write(gpt_data % 42)
5081         self.assertEqual(gpo.gpo_get_sysvol_gpt_version(gpo_path)[1], 42,
5082                           'gpo_get_sysvol_gpt_version() did not return the expected version')
5083
5084         with open(os.path.join(gpo_path, 'GPT.INI'), 'w') as gpt:
5085             gpt.write(gpt_data % old_vers)
5086         self.assertEqual(gpo.gpo_get_sysvol_gpt_version(gpo_path)[1], old_vers,
5087                           'gpo_get_sysvol_gpt_version() did not return the expected version')
5088
5089     def test_check_refresh_gpo_list(self):
5090         cache = self.lp.cache_path('gpo_cache')
5091         ads = gpo.ADS_STRUCT(self.server, self.lp, self.creds)
5092         if ads.connect():
5093             gpos = ads.get_gpo_list(self.creds.get_username())
5094         check_refresh_gpo_list(self.server, self.lp, self.creds, gpos)
5095
5096         self.assertTrue(os.path.exists(cache),
5097                         'GPO cache %s was not created' % cache)
5098
5099         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5100         gpt_ini = os.path.join(cache, policies,
5101                                guid, 'GPT.INI')
5102         self.assertTrue(os.path.exists(gpt_ini),
5103                         'GPT.INI was not cached for %s' % guid)
5104
5105     def test_check_refresh_gpo_list_malicious_paths(self):
5106         # the path cannot contain ..
5107         path = '/usr/local/samba/var/locks/sysvol/../../../../../../root/'
5108         self.assertRaises(OSError, check_safe_path, path)
5109
5110         self.assertEqual(check_safe_path('/etc/passwd'), 'etc/passwd')
5111         self.assertEqual(check_safe_path('\\\\etc/\\passwd'), 'etc/passwd')
5112
5113         # there should be no backslashes used to delineate paths
5114         before = 'sysvol/' + realm + '\\Policies/' \
5115             '{31B2F340-016D-11D2-945F-00C04FB984F9}\\GPT.INI'
5116         after = realm + '/Policies/' \
5117             '{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI'
5118         result = check_safe_path(before)
5119         self.assertEqual(result, after, 'check_safe_path() didn\'t'
5120                           ' correctly convert \\ to /')
5121
5122     def test_check_safe_path_typesafe_name(self):
5123         path = '\\\\toady.suse.de\\SysVol\\toady.suse.de\\Policies\\' \
5124                '{31B2F340-016D-11D2-945F-00C04FB984F9}\\GPT.INI'
5125         expected_path = 'toady.suse.de/Policies/' \
5126                         '{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI'
5127
5128         result = check_safe_path(path)
5129         self.assertEqual(result, expected_path,
5130             'check_safe_path unable to detect variable case sysvol components')
5131
5132     def test_gpt_ext_register(self):
5133         this_path = os.path.dirname(os.path.realpath(__file__))
5134         samba_path = os.path.realpath(os.path.join(this_path, '../../../'))
5135         ext_path = os.path.join(samba_path, 'python/samba/gp/gp_sec_ext.py')
5136         ext_guid = '{827D319E-6EAC-11D2-A4EA-00C04F79F83A}'
5137         ret = register_gp_extension(ext_guid, 'gp_access_ext', ext_path,
5138                                     smb_conf=self.lp.configfile,
5139                                     machine=True, user=False)
5140         self.assertTrue(ret, 'Failed to register a gp ext')
5141         gp_exts = list_gp_extensions(self.lp.configfile)
5142         self.assertTrue(ext_guid in gp_exts.keys(),
5143                         'Failed to list gp exts')
5144         self.assertEqual(gp_exts[ext_guid]['DllName'], ext_path,
5145                           'Failed to list gp exts')
5146
5147         unregister_gp_extension(ext_guid)
5148         gp_exts = list_gp_extensions(self.lp.configfile)
5149         self.assertTrue(ext_guid not in gp_exts.keys(),
5150                         'Failed to unregister gp exts')
5151
5152         self.assertTrue(check_guid(ext_guid), 'Failed to parse valid guid')
5153         self.assertFalse(check_guid('AAAAAABBBBBBBCCC'), 'Parsed invalid guid')
5154
5155         lp, parser = parse_gpext_conf(self.lp.configfile)
5156         self.assertTrue(lp and parser, 'parse_gpext_conf() invalid return')
5157         parser.add_section('test_section')
5158         parser.set('test_section', 'test_var', ext_guid)
5159         atomic_write_conf(lp, parser)
5160
5161         lp, parser = parse_gpext_conf(self.lp.configfile)
5162         self.assertTrue('test_section' in parser.sections(),
5163                         'test_section not found in gpext.conf')
5164         self.assertEqual(parser.get('test_section', 'test_var'), ext_guid,
5165                           'Failed to find test variable in gpext.conf')
5166         parser.remove_section('test_section')
5167         atomic_write_conf(lp, parser)
5168
5169     def test_gp_log_get_applied(self):
5170         local_path = self.lp.get('path', 'sysvol')
5171         guids = ['{31B2F340-016D-11D2-945F-00C04FB984F9}',
5172                  '{6AC1786C-016F-11D2-945F-00C04FB984F9}']
5173         gpofile = '%s/' + realm + '/Policies/%s/MACHINE/Microsoft/' \
5174                   'Windows NT/SecEdit/GptTmpl.inf'
5175         stage = '[System Access]\nMinimumPasswordAge = 998\n'
5176         cache_dir = self.lp.get('cache directory')
5177         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5178         for guid in guids:
5179             gpttmpl = gpofile % (local_path, guid)
5180             ret = stage_file(gpttmpl, stage)
5181             self.assertTrue(ret, 'Could not create the target %s' % gpttmpl)
5182
5183         ret = gpupdate_force(self.lp)
5184         self.assertEqual(ret, 0, 'gpupdate force failed')
5185
5186         gp_db = store.get_gplog(self.dc_account)
5187
5188         applied_guids = gp_db.get_applied_guids()
5189         self.assertEqual(len(applied_guids), 2, 'The guids were not found')
5190         self.assertIn(guids[0], applied_guids,
5191                       '%s not in applied guids' % guids[0])
5192         self.assertIn(guids[1], applied_guids,
5193                       '%s not in applied guids' % guids[1])
5194
5195         applied_settings = gp_db.get_applied_settings(applied_guids)
5196         for policy in applied_settings:
5197             self.assertIn('System Access', policy[1],
5198                           'System Access policies not set')
5199             self.assertIn('minPwdAge', policy[1]['System Access'],
5200                           'minPwdAge policy not set')
5201             if policy[0] == guids[0]:
5202                 self.assertEqual(int(policy[1]['System Access']['minPwdAge']),
5203                                  days2rel_nttime(1),
5204                                  'minPwdAge policy not set')
5205             elif policy[0] == guids[1]:
5206                 self.assertEqual(int(policy[1]['System Access']['minPwdAge']),
5207                                  days2rel_nttime(998),
5208                                  'minPwdAge policy not set')
5209
5210         ads = gpo.ADS_STRUCT(self.server, self.lp, self.creds)
5211         if ads.connect():
5212             gpos = ads.get_gpo_list(self.dc_account)
5213         del_gpos = get_deleted_gpos_list(gp_db, gpos[:-1])
5214         self.assertEqual(len(del_gpos), 1, 'Returned delete gpos is incorrect')
5215         self.assertEqual(guids[-1], del_gpos[0][0],
5216                          'GUID for delete gpo is incorrect')
5217         self.assertIn('System Access', del_gpos[0][1],
5218                       'System Access policies not set for removal')
5219         self.assertIn('minPwdAge', del_gpos[0][1]['System Access'],
5220                       'minPwdAge policy not set for removal')
5221
5222         for guid in guids:
5223             gpttmpl = gpofile % (local_path, guid)
5224             unstage_file(gpttmpl)
5225
5226         ret = gpupdate_unapply(self.lp)
5227         self.assertEqual(ret, 0, 'gpupdate unapply failed')
5228
5229     def test_process_group_policy(self):
5230         local_path = self.lp.cache_path('gpo_cache')
5231         guids = ['{31B2F340-016D-11D2-945F-00C04FB984F9}',
5232                  '{6AC1786C-016F-11D2-945F-00C04FB984F9}']
5233         gpofile = '%s/' + policies + '/%s/MACHINE/MICROSOFT/' \
5234                   'WINDOWS NT/SECEDIT/GPTTMPL.INF'
5235         cache_dir = self.lp.get('cache directory')
5236         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5237
5238         machine_creds = Credentials()
5239         machine_creds.guess(self.lp)
5240         machine_creds.set_machine_account()
5241
5242         # Initialize the group policy extension
5243         ext = gp_krb_ext(self.lp, machine_creds,
5244                          machine_creds.get_username(), store)
5245
5246         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5247         if ads.connect():
5248             gpos = ads.get_gpo_list(machine_creds.get_username())
5249
5250         # Include MaxClockSkew to ensure we don't fail on a key we ignore
5251         stage = '[Kerberos Policy]\nMaxTicketAge = %d\nMaxClockSkew = 5'
5252         opts = [100, 200]
5253         for i in range(0, 2):
5254             gpttmpl = gpofile % (local_path, guids[i])
5255             ret = stage_file(gpttmpl, stage % opts[i])
5256             self.assertTrue(ret, 'Could not create the target %s' % gpttmpl)
5257
5258         # Process all gpos
5259         ext.process_group_policy([], gpos)
5260
5261         ret = store.get_int('kdc:user_ticket_lifetime')
5262         self.assertEqual(ret, opts[1], 'Higher priority policy was not set')
5263
5264         # Remove policy
5265         gp_db = store.get_gplog(machine_creds.get_username())
5266         del_gpos = get_deleted_gpos_list(gp_db, [])
5267         ext.process_group_policy(del_gpos, [])
5268
5269         ret = store.get_int('kdc:user_ticket_lifetime')
5270         self.assertEqual(ret, None, 'MaxTicketAge should not have applied')
5271
5272         # Process just the first gpo
5273         ext.process_group_policy([], gpos[:-1])
5274
5275         ret = store.get_int('kdc:user_ticket_lifetime')
5276         self.assertEqual(ret, opts[0], 'Lower priority policy was not set')
5277
5278         # Remove policy
5279         ext.process_group_policy(del_gpos, [])
5280
5281         for guid in guids:
5282             gpttmpl = gpofile % (local_path, guid)
5283             unstage_file(gpttmpl)
5284
5285     def test_gp_scripts(self):
5286         local_path = self.lp.cache_path('gpo_cache')
5287         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5288         reg_pol = os.path.join(local_path, policies, guid,
5289                                'MACHINE/REGISTRY.POL')
5290         cache_dir = self.lp.get('cache directory')
5291         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5292
5293         machine_creds = Credentials()
5294         machine_creds.guess(self.lp)
5295         machine_creds.set_machine_account()
5296
5297         # Initialize the group policy extension
5298         ext = gp_scripts_ext(self.lp, machine_creds,
5299                              machine_creds.get_username(), store)
5300
5301         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5302         if ads.connect():
5303             gpos = ads.get_gpo_list(machine_creds.get_username())
5304
5305         reg_key = b'Software\\Policies\\Samba\\Unix Settings'
5306         sections = { b'%s\\Daily Scripts' % reg_key : '.cron.daily',
5307                      b'%s\\Monthly Scripts' % reg_key : '.cron.monthly',
5308                      b'%s\\Weekly Scripts' % reg_key : '.cron.weekly',
5309                      b'%s\\Hourly Scripts' % reg_key : '.cron.hourly' }
5310         for keyname in sections.keys():
5311             # Stage the Registry.pol file with test data
5312             stage = preg.file()
5313             e = preg.entry()
5314             e.keyname = keyname
5315             e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5316             e.type = 1
5317             e.data = b'echo hello world'
5318             stage.num_entries = 1
5319             stage.entries = [e]
5320             ret = stage_file(reg_pol, ndr_pack(stage))
5321             self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5322
5323             # Process all gpos, with temp output directory
5324             with TemporaryDirectory(sections[keyname]) as dname:
5325                 ext.process_group_policy([], gpos, dname)
5326                 scripts = os.listdir(dname)
5327                 self.assertEquals(len(scripts), 1,
5328                     'The %s script was not created' % keyname.decode())
5329                 out, _ = Popen([os.path.join(dname, scripts[0])], stdout=PIPE).communicate()
5330                 self.assertIn(b'hello world', out,
5331                     '%s script execution failed' % keyname.decode())
5332
5333                 # Check that a call to gpupdate --rsop also succeeds
5334                 ret = rsop(self.lp)
5335                 self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5336
5337                 # Remove policy
5338                 gp_db = store.get_gplog(machine_creds.get_username())
5339                 del_gpos = get_deleted_gpos_list(gp_db, [])
5340                 ext.process_group_policy(del_gpos, [])
5341                 self.assertEquals(len(os.listdir(dname)), 0,
5342                                   'Unapply failed to cleanup scripts')
5343
5344             # Unstage the Registry.pol file
5345             unstage_file(reg_pol)
5346
5347     def test_gp_sudoers(self):
5348         local_path = self.lp.cache_path('gpo_cache')
5349         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5350         reg_pol = os.path.join(local_path, policies, guid,
5351                                'MACHINE/REGISTRY.POL')
5352         cache_dir = self.lp.get('cache directory')
5353         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5354
5355         machine_creds = Credentials()
5356         machine_creds.guess(self.lp)
5357         machine_creds.set_machine_account()
5358
5359         # Initialize the group policy extension
5360         ext = gp_sudoers_ext(self.lp, machine_creds,
5361                              machine_creds.get_username(), store)
5362
5363         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5364         if ads.connect():
5365             gpos = ads.get_gpo_list(machine_creds.get_username())
5366
5367         # Stage the Registry.pol file with test data
5368         stage = preg.file()
5369         e = preg.entry()
5370         e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5371         e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5372         e.type = 1
5373         e.data = b'fakeu  ALL=(ALL) NOPASSWD: ALL'
5374         stage.num_entries = 1
5375         stage.entries = [e]
5376         ret = stage_file(reg_pol, ndr_pack(stage))
5377         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5378
5379         # Process all gpos, with temp output directory
5380         with TemporaryDirectory() as dname:
5381             ext.process_group_policy([], gpos, dname)
5382             sudoers = os.listdir(dname)
5383             self.assertEquals(len(sudoers), 1, 'The sudoer file was not created')
5384             self.assertIn(e.data,
5385                     open(os.path.join(dname, sudoers[0]), 'r').read(),
5386                     'The sudoers entry was not applied')
5387
5388             # Check that a call to gpupdate --rsop also succeeds
5389             ret = rsop(self.lp)
5390             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5391
5392             # Remove policy
5393             gp_db = store.get_gplog(machine_creds.get_username())
5394             del_gpos = get_deleted_gpos_list(gp_db, [])
5395             ext.process_group_policy(del_gpos, [])
5396             self.assertEquals(len(os.listdir(dname)), 0,
5397                               'Unapply failed to cleanup scripts')
5398
5399         # Unstage the Registry.pol file
5400         unstage_file(reg_pol)
5401
5402     def test_vgp_sudoers(self):
5403         local_path = self.lp.cache_path('gpo_cache')
5404         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5405         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5406             'VGP/VTLA/SUDO/SUDOERSCONFIGURATION/MANIFEST.XML')
5407         cache_dir = self.lp.get('cache directory')
5408         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5409
5410         machine_creds = Credentials()
5411         machine_creds.guess(self.lp)
5412         machine_creds.set_machine_account()
5413
5414         # Initialize the group policy extension
5415         ext = vgp_sudoers_ext(self.lp, machine_creds,
5416                               machine_creds.get_username(), store)
5417
5418         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5419         if ads.connect():
5420             gpos = ads.get_gpo_list(machine_creds.get_username())
5421
5422         # Stage the manifest.xml file with test data
5423         stage = etree.Element('vgppolicy')
5424         policysetting = etree.Element('policysetting')
5425         stage.append(policysetting)
5426         version = etree.Element('version')
5427         version.text = '1'
5428         policysetting.append(version)
5429         data = etree.Element('data')
5430         sudoers_entry = etree.Element('sudoers_entry')
5431         command = etree.Element('command')
5432         command.text = 'ALL'
5433         sudoers_entry.append(command)
5434         user = etree.Element('user')
5435         user.text = 'ALL'
5436         sudoers_entry.append(user)
5437         principal_list = etree.Element('listelement')
5438         principal = etree.Element('principal')
5439         principal.text = 'fakeu'
5440         principal.attrib['type'] = 'user'
5441         group = etree.Element('principal')
5442         group.text = 'fakeg'
5443         group.attrib['type'] = 'group'
5444         principal_list.append(principal)
5445         principal_list.append(group)
5446         sudoers_entry.append(principal_list)
5447         data.append(sudoers_entry)
5448         # Ensure an empty principal doesn't cause a crash
5449         sudoers_entry = etree.SubElement(data, 'sudoers_entry')
5450         command = etree.SubElement(sudoers_entry, 'command')
5451         command.text = 'ALL'
5452         user = etree.SubElement(sudoers_entry, 'user')
5453         user.text = 'ALL'
5454         # Ensure having dispersed principals still works
5455         sudoers_entry = etree.SubElement(data, 'sudoers_entry')
5456         command = etree.SubElement(sudoers_entry, 'command')
5457         command.text = 'ALL'
5458         user = etree.SubElement(sudoers_entry, 'user')
5459         user.text = 'ALL'
5460         listelement = etree.SubElement(sudoers_entry, 'listelement')
5461         principal = etree.SubElement(listelement, 'principal')
5462         principal.text = 'fakeu2'
5463         principal.attrib['type'] = 'user'
5464         listelement = etree.SubElement(sudoers_entry, 'listelement')
5465         group = etree.SubElement(listelement, 'principal')
5466         group.text = 'fakeg2'
5467         group.attrib['type'] = 'group'
5468         policysetting.append(data)
5469         ret = stage_file(manifest, etree.tostring(stage))
5470         self.assertTrue(ret, 'Could not create the target %s' % manifest)
5471
5472         # Process all gpos, with temp output directory
5473         data = 'fakeu,fakeg% ALL=(ALL) NOPASSWD: ALL'
5474         data2 = 'fakeu2,fakeg2% ALL=(ALL) NOPASSWD: ALL'
5475         data_no_principal = 'ALL ALL=(ALL) NOPASSWD: ALL'
5476         with TemporaryDirectory() as dname:
5477             ext.process_group_policy([], gpos, dname)
5478             sudoers = os.listdir(dname)
5479             self.assertEquals(len(sudoers), 3, 'The sudoer file was not created')
5480             output = open(os.path.join(dname, sudoers[0]), 'r').read() + \
5481                      open(os.path.join(dname, sudoers[1]), 'r').read() + \
5482                      open(os.path.join(dname, sudoers[2]), 'r').read()
5483             self.assertIn(data, output,
5484                     'The sudoers entry was not applied')
5485             self.assertIn(data2, output,
5486                     'The sudoers entry was not applied')
5487             self.assertIn(data_no_principal, output,
5488                     'The sudoers entry was not applied')
5489
5490             # Check that a call to gpupdate --rsop also succeeds
5491             ret = rsop(self.lp)
5492             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5493
5494             # Remove policy
5495             gp_db = store.get_gplog(machine_creds.get_username())
5496             del_gpos = get_deleted_gpos_list(gp_db, [])
5497             ext.process_group_policy(del_gpos, [])
5498             self.assertEquals(len(os.listdir(dname)), 0,
5499                               'Unapply failed to cleanup scripts')
5500
5501         # Unstage the Registry.pol file
5502         unstage_file(manifest)
5503
5504     def test_gp_inf_ext_utf(self):
5505         cache_dir = self.lp.get('cache directory')
5506         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5507
5508         machine_creds = Credentials()
5509         machine_creds.guess(self.lp)
5510         machine_creds.set_machine_account()
5511
5512         ext = gp_inf_ext(self.lp, machine_creds,
5513                          machine_creds.get_username(), store)
5514         test_data = '[Kerberos Policy]\nMaxTicketAge = 99\n'
5515
5516         with NamedTemporaryFile() as f:
5517             with codecs.open(f.name, 'w', 'utf-16') as w:
5518                 w.write(test_data)
5519             try:
5520                 inf_conf = ext.read(f.name)
5521             except UnicodeDecodeError:
5522                 self.fail('Failed to parse utf-16')
5523             self.assertIn('Kerberos Policy', inf_conf.keys(),
5524                           'Kerberos Policy was not read from the file')
5525             self.assertEquals(inf_conf.get('Kerberos Policy', 'MaxTicketAge'),
5526                               '99', 'MaxTicketAge was not read from the file')
5527
5528         with NamedTemporaryFile() as f:
5529             with codecs.open(f.name, 'w', 'utf-8') as w:
5530                 w.write(test_data)
5531             inf_conf = ext.read(f.name)
5532             self.assertIn('Kerberos Policy', inf_conf.keys(),
5533                           'Kerberos Policy was not read from the file')
5534             self.assertEquals(inf_conf.get('Kerberos Policy', 'MaxTicketAge'),
5535                               '99', 'MaxTicketAge was not read from the file')
5536
5537     def test_rsop(self):
5538         cache_dir = self.lp.get('cache directory')
5539         local_path = self.lp.cache_path('gpo_cache')
5540         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5541
5542         machine_creds = Credentials()
5543         machine_creds.guess(self.lp)
5544         machine_creds.set_machine_account()
5545
5546         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5547         if ads.connect():
5548             gpos = ads.get_gpo_list(machine_creds.get_username())
5549
5550         gp_extensions = []
5551         gp_extensions.append(gp_krb_ext)
5552         gp_extensions.append(gp_scripts_ext)
5553         gp_extensions.append(gp_sudoers_ext)
5554         gp_extensions.append(gp_smb_conf_ext)
5555         gp_extensions.append(gp_msgs_ext)
5556
5557         # Create registry stage data
5558         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
5559         reg_stage = preg.file()
5560         e = preg.entry()
5561         e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Daily Scripts'
5562         e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5563         e.type = 1
5564         e.data = b'echo hello world'
5565         e2 = preg.entry()
5566         e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5567         e2.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5568         e2.type = 1
5569         e2.data = b'fakeu  ALL=(ALL) NOPASSWD: ALL'
5570         e3 = preg.entry()
5571         e3.keyname = 'Software\\Policies\\Samba\\smb_conf\\apply group policies'
5572         e3.type = 4
5573         e3.data = 1
5574         e3.valuename = 'apply group policies'
5575         e4 = preg.entry()
5576         e4.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5577         e4.valuename = b'issue'
5578         e4.type = 1
5579         e4.data = b'Welcome to \\s \\r \\l'
5580         reg_stage.num_entries = 4
5581         reg_stage.entries = [e, e2, e3, e4]
5582
5583         # Create krb stage date
5584         gpofile = os.path.join(local_path, policies, '%s/MACHINE/MICROSOFT/' \
5585                   'WINDOWS NT/SECEDIT/GPTTMPL.INF')
5586         krb_stage = '[Kerberos Policy]\nMaxTicketAge = 99\n' \
5587                     '[System Access]\nMinimumPasswordAge = 998\n'
5588
5589         for g in [g for g in gpos if g.file_sys_path]:
5590             ret = stage_file(gpofile % g.name, krb_stage)
5591             self.assertTrue(ret, 'Could not create the target %s' %
5592                                  (gpofile % g.name))
5593             ret = stage_file(reg_pol % g.name, ndr_pack(reg_stage))
5594             self.assertTrue(ret, 'Could not create the target %s' %
5595                                  (reg_pol % g.name))
5596             for ext in gp_extensions:
5597                 ext = ext(self.lp, machine_creds,
5598                           machine_creds.get_username(), store)
5599                 ret = ext.rsop(g)
5600                 self.assertEquals(len(ret.keys()), 1,
5601                                   'A single policy should have been displayed')
5602
5603                 # Check the Security Extension
5604                 if type(ext) == gp_krb_ext:
5605                     self.assertIn('Kerberos Policy', ret.keys(),
5606                                   'Kerberos Policy not found')
5607                     self.assertIn('MaxTicketAge', ret['Kerberos Policy'],
5608                                   'MaxTicketAge setting not found')
5609                     self.assertEquals(ret['Kerberos Policy']['MaxTicketAge'], '99',
5610                                       'MaxTicketAge was not set to 99')
5611                 # Check the Scripts Extension
5612                 elif type(ext) == gp_scripts_ext:
5613                     self.assertIn('Daily Scripts', ret.keys(),
5614                                   'Daily Scripts not found')
5615                     self.assertIn('echo hello world', ret['Daily Scripts'],
5616                                   'Daily script was not created')
5617                 # Check the Sudoers Extension
5618                 elif type(ext) == gp_sudoers_ext:
5619                     self.assertIn('Sudo Rights', ret.keys(),
5620                                   'Sudoers not found')
5621                     self.assertIn('fakeu  ALL=(ALL) NOPASSWD: ALL',
5622                                   ret['Sudo Rights'],
5623                                   'Sudoers policy not created')
5624                 # Check the smb.conf Extension
5625                 elif type(ext) == gp_smb_conf_ext:
5626                     self.assertIn('smb.conf', ret.keys(),
5627                                   'apply group policies was not applied')
5628                     self.assertIn(e3.valuename, ret['smb.conf'],
5629                                   'apply group policies was not applied')
5630                     self.assertEquals(ret['smb.conf'][e3.valuename], e3.data,
5631                                       'apply group policies was not set')
5632                 # Check the Messages Extension
5633                 elif type(ext) == gp_msgs_ext:
5634                     self.assertIn('/etc/issue', ret,
5635                                   'Login Prompt Message not applied')
5636                     self.assertEquals(ret['/etc/issue'], e4.data,
5637                                       'Login Prompt Message not set')
5638
5639                 # Check that a call to gpupdate --rsop also succeeds
5640                 ret = rsop(self.lp)
5641                 self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5642
5643             unstage_file(gpofile % g.name)
5644             unstage_file(reg_pol % g.name)
5645
5646     def test_gp_unapply(self):
5647         cache_dir = self.lp.get('cache directory')
5648         local_path = self.lp.cache_path('gpo_cache')
5649         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5650         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5651
5652         machine_creds = Credentials()
5653         machine_creds.guess(self.lp)
5654         machine_creds.set_machine_account()
5655
5656         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5657         if ads.connect():
5658             gpos = ads.get_gpo_list(machine_creds.get_username())
5659
5660         gp_extensions = []
5661         gp_extensions.append(gp_krb_ext)
5662         gp_extensions.append(gp_scripts_ext)
5663         gp_extensions.append(gp_sudoers_ext)
5664
5665         # Create registry stage data
5666         reg_pol = os.path.join(local_path, policies, '%s/MACHINE/REGISTRY.POL')
5667         reg_stage = preg.file()
5668         e = preg.entry()
5669         e.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Daily Scripts'
5670         e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5671         e.type = 1
5672         e.data = b'echo hello world'
5673         e2 = preg.entry()
5674         e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Sudo Rights'
5675         e2.valuename = b'Software\\Policies\\Samba\\Unix Settings'
5676         e2.type = 1
5677         e2.data = b'fakeu  ALL=(ALL) NOPASSWD: ALL'
5678         reg_stage.num_entries = 2
5679         reg_stage.entries = [e, e2]
5680
5681         # Create krb stage date
5682         gpofile = os.path.join(local_path, policies, '%s/MACHINE/MICROSOFT/' \
5683                   'WINDOWS NT/SECEDIT/GPTTMPL.INF')
5684         krb_stage = '[Kerberos Policy]\nMaxTicketAge = 99\n'
5685
5686         ret = stage_file(gpofile % guid, krb_stage)
5687         self.assertTrue(ret, 'Could not create the target %s' %
5688                              (gpofile % guid))
5689         ret = stage_file(reg_pol % guid, ndr_pack(reg_stage))
5690         self.assertTrue(ret, 'Could not create the target %s' %
5691                              (reg_pol % guid))
5692
5693         # Process all gpos, with temp output directory
5694         remove = []
5695         with TemporaryDirectory() as dname:
5696             for ext in gp_extensions:
5697                 ext = ext(self.lp, machine_creds,
5698                           machine_creds.get_username(), store)
5699                 if type(ext) == gp_krb_ext:
5700                     ext.process_group_policy([], gpos)
5701                     ret = store.get_int('kdc:user_ticket_lifetime')
5702                     self.assertEqual(ret, 99, 'Kerberos policy was not set')
5703                 elif type(ext) in [gp_scripts_ext, gp_sudoers_ext]:
5704                     ext.process_group_policy([], gpos, dname)
5705                     gp_db = store.get_gplog(machine_creds.get_username())
5706                     applied_settings = gp_db.get_applied_settings([guid])
5707                     for _, fname in applied_settings[-1][-1][str(ext)].items():
5708                         fname = fname.split(':')[-1]
5709                         self.assertIn(dname, fname,
5710                                       'Test file not created in tmp dir')
5711                         self.assertTrue(os.path.exists(fname),
5712                                         'Test file not created')
5713                         remove.append(fname)
5714
5715             # Unapply policy, and ensure policies are removed
5716             gpupdate_unapply(self.lp)
5717
5718             for fname in remove:
5719                 self.assertFalse(os.path.exists(fname),
5720                                  'Unapply did not remove test file')
5721             ret = store.get_int('kdc:user_ticket_lifetime')
5722             self.assertNotEqual(ret, 99, 'Kerberos policy was not unapplied')
5723
5724         unstage_file(gpofile % guid)
5725         unstage_file(reg_pol % guid)
5726
5727     def test_smb_conf_ext(self):
5728         local_path = self.lp.cache_path('gpo_cache')
5729         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5730         reg_pol = os.path.join(local_path, policies, guid,
5731                                'MACHINE/REGISTRY.POL')
5732         cache_dir = self.lp.get('cache directory')
5733         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5734
5735         machine_creds = Credentials()
5736         machine_creds.guess(self.lp)
5737         machine_creds.set_machine_account()
5738
5739         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5740         if ads.connect():
5741             gpos = ads.get_gpo_list(machine_creds.get_username())
5742
5743         entries = []
5744         e = preg.entry()
5745         e.keyname = 'Software\\Policies\\Samba\\smb_conf\\template homedir'
5746         e.type = 1
5747         e.data = '/home/samba/%D/%U'
5748         e.valuename = 'template homedir'
5749         entries.append(e)
5750         e = preg.entry()
5751         e.keyname = 'Software\\Policies\\Samba\\smb_conf\\apply group policies'
5752         e.type = 4
5753         e.data = 1
5754         e.valuename = 'apply group policies'
5755         entries.append(e)
5756         e = preg.entry()
5757         e.keyname = 'Software\\Policies\\Samba\\smb_conf\\ldap timeout'
5758         e.type = 4
5759         e.data = 9999
5760         e.valuename = 'ldap timeout'
5761         entries.append(e)
5762         stage = preg.file()
5763         stage.num_entries = len(entries)
5764         stage.entries = entries
5765
5766         ret = stage_file(reg_pol, ndr_pack(stage))
5767         self.assertTrue(ret, 'Failed to create the Registry.pol file')
5768
5769         with NamedTemporaryFile(suffix='_smb.conf') as f:
5770             copyfile(self.lp.configfile, f.name)
5771             lp = LoadParm(f.name)
5772
5773             # Initialize the group policy extension
5774             ext = gp_smb_conf_ext(lp, machine_creds,
5775                                   machine_creds.get_username(), store)
5776             ext.process_group_policy([], gpos)
5777             lp = LoadParm(f.name)
5778
5779             template_homedir = lp.get('template homedir')
5780             self.assertEquals(template_homedir, '/home/samba/%D/%U',
5781                               'template homedir was not applied')
5782             apply_group_policies = lp.get('apply group policies')
5783             self.assertTrue(apply_group_policies,
5784                             'apply group policies was not applied')
5785             ldap_timeout = lp.get('ldap timeout')
5786             self.assertEquals(ldap_timeout, 9999, 'ldap timeout was not applied')
5787
5788             # Check that a call to gpupdate --rsop also succeeds
5789             ret = rsop(self.lp)
5790             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5791
5792             # Remove policy
5793             gp_db = store.get_gplog(machine_creds.get_username())
5794             del_gpos = get_deleted_gpos_list(gp_db, [])
5795             ext.process_group_policy(del_gpos, [])
5796
5797             lp = LoadParm(f.name)
5798
5799             template_homedir = lp.get('template homedir')
5800             self.assertEquals(template_homedir, self.lp.get('template homedir'),
5801                               'template homedir was not unapplied')
5802             apply_group_policies = lp.get('apply group policies')
5803             self.assertEquals(apply_group_policies, self.lp.get('apply group policies'),
5804                               'apply group policies was not unapplied')
5805             ldap_timeout = lp.get('ldap timeout')
5806             self.assertEquals(ldap_timeout, self.lp.get('ldap timeout'),
5807                               'ldap timeout was not unapplied')
5808
5809         # Unstage the Registry.pol file
5810         unstage_file(reg_pol)
5811
5812     def test_gp_motd(self):
5813         local_path = self.lp.cache_path('gpo_cache')
5814         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5815         reg_pol = os.path.join(local_path, policies, guid,
5816                                'MACHINE/REGISTRY.POL')
5817         cache_dir = self.lp.get('cache directory')
5818         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5819
5820         machine_creds = Credentials()
5821         machine_creds.guess(self.lp)
5822         machine_creds.set_machine_account()
5823
5824         # Initialize the group policy extension
5825         ext = gp_msgs_ext(self.lp, machine_creds,
5826                           machine_creds.get_username(), store)
5827
5828         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5829         if ads.connect():
5830             gpos = ads.get_gpo_list(machine_creds.get_username())
5831
5832         # Stage the Registry.pol file with test data
5833         stage = preg.file()
5834         e1 = preg.entry()
5835         e1.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5836         e1.valuename = b'motd'
5837         e1.type = 1
5838         e1.data = b'Have a lot of fun!'
5839         stage.num_entries = 2
5840         e2 = preg.entry()
5841         e2.keyname = b'Software\\Policies\\Samba\\Unix Settings\\Messages'
5842         e2.valuename = b'issue'
5843         e2.type = 1
5844         e2.data = b'Welcome to \\s \\r \\l'
5845         stage.entries = [e1, e2]
5846         ret = stage_file(reg_pol, ndr_pack(stage))
5847         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
5848
5849         # Process all gpos, with temp output directory
5850         with TemporaryDirectory() as dname:
5851             ext.process_group_policy([], gpos, dname)
5852             motd_file = os.path.join(dname, 'motd')
5853             self.assertTrue(os.path.exists(motd_file),
5854                             'Message of the day file not created')
5855             data = open(motd_file, 'r').read()
5856             self.assertEquals(data, e1.data, 'Message of the day not applied')
5857             issue_file = os.path.join(dname, 'issue')
5858             self.assertTrue(os.path.exists(issue_file),
5859                             'Login Prompt Message file not created')
5860             data = open(issue_file, 'r').read()
5861             self.assertEquals(data, e2.data, 'Login Prompt Message not applied')
5862
5863             # Check that a call to gpupdate --rsop also succeeds
5864             ret = rsop(self.lp)
5865             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5866
5867             # Unapply policy, and ensure the test files are removed
5868             gp_db = store.get_gplog(machine_creds.get_username())
5869             del_gpos = get_deleted_gpos_list(gp_db, [])
5870             ext.process_group_policy(del_gpos, [], dname)
5871             data = open(motd_file, 'r').read()
5872             self.assertFalse(data, 'Message of the day file not removed')
5873             data = open(issue_file, 'r').read()
5874             self.assertFalse(data, 'Login Prompt Message file not removed')
5875
5876         # Unstage the Registry.pol file
5877         unstage_file(reg_pol)
5878
5879     def test_vgp_symlink(self):
5880         local_path = self.lp.cache_path('gpo_cache')
5881         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5882         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5883             'VGP/VTLA/UNIX/SYMLINK/MANIFEST.XML')
5884         cache_dir = self.lp.get('cache directory')
5885         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5886
5887         machine_creds = Credentials()
5888         machine_creds.guess(self.lp)
5889         machine_creds.set_machine_account()
5890
5891         # Initialize the group policy extension
5892         ext = vgp_symlink_ext(self.lp, machine_creds,
5893                               machine_creds.get_username(), store)
5894
5895         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5896         if ads.connect():
5897             gpos = ads.get_gpo_list(machine_creds.get_username())
5898
5899         with TemporaryDirectory() as dname:
5900             test_source = os.path.join(dname, 'test.source')
5901             test_target = os.path.join(dname, 'test.target')
5902
5903             # Stage the manifest.xml file with test data
5904             stage = etree.Element('vgppolicy')
5905             policysetting = etree.Element('policysetting')
5906             stage.append(policysetting)
5907             version = etree.Element('version')
5908             version.text = '1'
5909             policysetting.append(version)
5910             data = etree.Element('data')
5911             file_properties = etree.Element('file_properties')
5912             source = etree.Element('source')
5913             source.text = test_source
5914             file_properties.append(source)
5915             target = etree.Element('target')
5916             target.text = test_target
5917             file_properties.append(target)
5918             data.append(file_properties)
5919             policysetting.append(data)
5920             ret = stage_file(manifest, etree.tostring(stage))
5921             self.assertTrue(ret, 'Could not create the target %s' % manifest)
5922
5923             # Create test source
5924             test_source_data = 'hello world!'
5925             with open(test_source, 'w') as w:
5926                 w.write(test_source_data)
5927
5928             # Process all gpos, with temp output directory
5929             ext.process_group_policy([], gpos)
5930             self.assertTrue(os.path.exists(test_target),
5931                             'The test symlink was not created')
5932             self.assertTrue(os.path.islink(test_target),
5933                             'The test file is not a symlink')
5934             self.assertIn(test_source_data, open(test_target, 'r').read(),
5935                           'Reading from symlink does not produce source data')
5936
5937             # Unapply the policy, ensure removal
5938             gp_db = store.get_gplog(machine_creds.get_username())
5939             del_gpos = get_deleted_gpos_list(gp_db, [])
5940             ext.process_group_policy(del_gpos, [])
5941             self.assertFalse(os.path.exists(test_target),
5942                             'The test symlink was not delete')
5943
5944             # Verify RSOP
5945             ret = ext.rsop([g for g in gpos if g.name == guid][0])
5946             self.assertIn('ln -s %s %s' % (test_source, test_target),
5947                           list(ret.values())[0])
5948
5949             # Check that a call to gpupdate --rsop also succeeds
5950             ret = rsop(self.lp)
5951             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
5952
5953         # Unstage the manifest.xml file
5954         unstage_file(manifest)
5955
5956     def test_vgp_files(self):
5957         local_path = self.lp.cache_path('gpo_cache')
5958         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
5959         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
5960             'VGP/VTLA/UNIX/FILES/MANIFEST.XML')
5961         source_file = os.path.join(os.path.dirname(manifest), 'TEST.SOURCE')
5962         source_data = '#!/bin/sh\necho hello world'
5963         ret = stage_file(source_file, source_data)
5964         self.assertTrue(ret, 'Could not create the target %s' % source_file)
5965         cache_dir = self.lp.get('cache directory')
5966         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
5967
5968         machine_creds = Credentials()
5969         machine_creds.guess(self.lp)
5970         machine_creds.set_machine_account()
5971
5972         # Initialize the group policy extension
5973         ext = vgp_files_ext(self.lp, machine_creds,
5974                             machine_creds.get_username(), store)
5975
5976         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
5977         if ads.connect():
5978             gpos = ads.get_gpo_list(machine_creds.get_username())
5979
5980         # Stage the manifest.xml file with test data
5981         with TemporaryDirectory() as dname:
5982             stage = etree.Element('vgppolicy')
5983             policysetting = etree.Element('policysetting')
5984             stage.append(policysetting)
5985             version = etree.Element('version')
5986             version.text = '1'
5987             policysetting.append(version)
5988             data = etree.Element('data')
5989             file_properties = etree.SubElement(data, 'file_properties')
5990             source = etree.SubElement(file_properties, 'source')
5991             source.text = os.path.basename(source_file).lower()
5992             target = etree.SubElement(file_properties, 'target')
5993             target.text = os.path.join(dname, 'test.target')
5994             user = etree.SubElement(file_properties, 'user')
5995             user.text = pwd.getpwuid(os.getuid()).pw_name
5996             group = etree.SubElement(file_properties, 'group')
5997             group.text = grp.getgrgid(os.getgid()).gr_name
5998             # Request permissions of 755
5999             permissions = etree.SubElement(file_properties, 'permissions')
6000             permissions.set('type', 'user')
6001             etree.SubElement(permissions, 'read')
6002             etree.SubElement(permissions, 'write')
6003             etree.SubElement(permissions, 'execute')
6004             permissions = etree.SubElement(file_properties, 'permissions')
6005             permissions.set('type', 'group')
6006             etree.SubElement(permissions, 'read')
6007             etree.SubElement(permissions, 'execute')
6008             permissions = etree.SubElement(file_properties, 'permissions')
6009             permissions.set('type', 'other')
6010             etree.SubElement(permissions, 'read')
6011             etree.SubElement(permissions, 'execute')
6012             policysetting.append(data)
6013             ret = stage_file(manifest, etree.tostring(stage))
6014             self.assertTrue(ret, 'Could not create the target %s' % manifest)
6015
6016             # Process all gpos, with temp output directory
6017             ext.process_group_policy([], gpos)
6018             self.assertTrue(os.path.exists(target.text),
6019                             'The target file does not exist')
6020             self.assertEquals(os.stat(target.text).st_mode & 0o777, 0o755,
6021                               'The target file permissions are incorrect')
6022             self.assertEquals(open(target.text).read(), source_data,
6023                               'The target file contents are incorrect')
6024
6025             # Remove policy
6026             gp_db = store.get_gplog(machine_creds.get_username())
6027             del_gpos = get_deleted_gpos_list(gp_db, [])
6028             ext.process_group_policy(del_gpos, [])
6029             self.assertFalse(os.path.exists(target.text),
6030                              'The target file was not removed')
6031
6032             # Test rsop
6033             g = [g for g in gpos if g.name == guid][0]
6034             ret = ext.rsop(g)
6035             self.assertIn(target.text, list(ret.values())[0][0],
6036                           'The target file was not listed by rsop')
6037             self.assertIn('-rwxr-xr-x', list(ret.values())[0][0],
6038                           'The target permissions were not listed by rsop')
6039
6040             # Check that a call to gpupdate --rsop also succeeds
6041             ret = rsop(self.lp)
6042             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6043
6044         # Unstage the manifest and source files
6045         unstage_file(manifest)
6046         unstage_file(source_file)
6047
6048     def test_vgp_openssh(self):
6049         local_path = self.lp.cache_path('gpo_cache')
6050         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6051         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6052             'VGP/VTLA/SSHCFG/SSHD/MANIFEST.XML')
6053         cache_dir = self.lp.get('cache directory')
6054         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6055
6056         machine_creds = Credentials()
6057         machine_creds.guess(self.lp)
6058         machine_creds.set_machine_account()
6059
6060         # Initialize the group policy extension
6061         ext = vgp_openssh_ext(self.lp, machine_creds,
6062                               machine_creds.get_username(), store)
6063
6064         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6065         if ads.connect():
6066             gpos = ads.get_gpo_list(machine_creds.get_username())
6067
6068         # Stage the manifest.xml file with test data
6069         stage = etree.Element('vgppolicy')
6070         policysetting = etree.Element('policysetting')
6071         stage.append(policysetting)
6072         version = etree.Element('version')
6073         version.text = '1'
6074         policysetting.append(version)
6075         data = etree.Element('data')
6076         configfile = etree.Element('configfile')
6077         configsection = etree.Element('configsection')
6078         sectionname = etree.Element('sectionname')
6079         configsection.append(sectionname)
6080         kvpair = etree.Element('keyvaluepair')
6081         key = etree.Element('key')
6082         key.text = 'AddressFamily'
6083         kvpair.append(key)
6084         value = etree.Element('value')
6085         value.text = 'inet6'
6086         kvpair.append(value)
6087         configsection.append(kvpair)
6088         configfile.append(configsection)
6089         data.append(configfile)
6090         policysetting.append(data)
6091         ret = stage_file(manifest, etree.tostring(stage))
6092         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6093
6094         # Process all gpos, with temp output directory
6095         data = 'AddressFamily inet6'
6096         with TemporaryDirectory() as dname:
6097             ext.process_group_policy([], gpos, dname)
6098             conf = os.listdir(dname)
6099             self.assertEquals(len(conf), 1, 'The conf file was not created')
6100             gp_cfg = os.path.join(dname, conf[0])
6101             self.assertIn(data, open(gp_cfg, 'r').read(),
6102                     'The sshd_config entry was not applied')
6103
6104             # Check that a call to gpupdate --rsop also succeeds
6105             ret = rsop(self.lp)
6106             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6107
6108             # Remove policy
6109             gp_db = store.get_gplog(machine_creds.get_username())
6110             del_gpos = get_deleted_gpos_list(gp_db, [])
6111             ext.process_group_policy(del_gpos, [], dname)
6112             self.assertFalse(os.path.exists(gp_cfg),
6113                              'Unapply failed to cleanup config')
6114
6115         # Unstage the Registry.pol file
6116         unstage_file(manifest)
6117
6118     def test_vgp_startup_scripts(self):
6119         local_path = self.lp.cache_path('gpo_cache')
6120         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6121         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6122             'VGP/VTLA/UNIX/SCRIPTS/STARTUP/MANIFEST.XML')
6123         test_script = os.path.join(os.path.dirname(manifest), 'TEST.SH')
6124         test_data = '#!/bin/sh\necho $@ hello world'
6125         ret = stage_file(test_script, test_data)
6126         self.assertTrue(ret, 'Could not create the target %s' % test_script)
6127         cache_dir = self.lp.get('cache directory')
6128         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6129
6130         machine_creds = Credentials()
6131         machine_creds.guess(self.lp)
6132         machine_creds.set_machine_account()
6133
6134         # Initialize the group policy extension
6135         ext = vgp_startup_scripts_ext(self.lp, machine_creds,
6136                                       machine_creds.get_username(), store)
6137
6138         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6139         if ads.connect():
6140             gpos = ads.get_gpo_list(machine_creds.get_username())
6141
6142         # Stage the manifest.xml file with test data
6143         stage = etree.Element('vgppolicy')
6144         policysetting = etree.SubElement(stage, 'policysetting')
6145         version = etree.SubElement(policysetting, 'version')
6146         version.text = '1'
6147         data = etree.SubElement(policysetting, 'data')
6148         listelement = etree.SubElement(data, 'listelement')
6149         script = etree.SubElement(listelement, 'script')
6150         script.text = os.path.basename(test_script).lower()
6151         parameters = etree.SubElement(listelement, 'parameters')
6152         parameters.text = '-n'
6153         hash = etree.SubElement(listelement, 'hash')
6154         hash.text = \
6155             hashlib.md5(open(test_script, 'rb').read()).hexdigest().upper()
6156         run_as = etree.SubElement(listelement, 'run_as')
6157         run_as.text = 'root'
6158         ret = stage_file(manifest, etree.tostring(stage))
6159         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6160
6161         # Process all gpos, with temp output directory
6162         with TemporaryDirectory() as dname:
6163             ext.process_group_policy([], gpos, dname)
6164             files = os.listdir(dname)
6165             self.assertEquals(len(files), 1,
6166                               'The target script was not created')
6167             entry = '@reboot %s %s %s' % (run_as.text, test_script,
6168                                           parameters.text)
6169             self.assertIn(entry,
6170                           open(os.path.join(dname, files[0]), 'r').read(),
6171                           'The test entry was not found')
6172
6173             # Remove policy
6174             gp_db = store.get_gplog(machine_creds.get_username())
6175             del_gpos = get_deleted_gpos_list(gp_db, [])
6176             ext.process_group_policy(del_gpos, [])
6177             files = os.listdir(dname)
6178             self.assertEquals(len(files), 0,
6179                               'The target script was not removed')
6180
6181             # Test rsop
6182             g = [g for g in gpos if g.name == guid][0]
6183             ret = ext.rsop(g)
6184             self.assertIn(entry, list(ret.values())[0][0],
6185                           'The target entry was not listed by rsop')
6186
6187             # Check that a call to gpupdate --rsop also succeeds
6188             ret = rsop(self.lp)
6189             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6190
6191         # Unstage the manifest.xml and script files
6192         unstage_file(manifest)
6193
6194         # Stage the manifest.xml file for run once scripts
6195         etree.SubElement(listelement, 'run_once')
6196         run_as.text = pwd.getpwuid(os.getuid()).pw_name
6197         ret = stage_file(manifest, etree.tostring(stage))
6198         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6199
6200         # Process all gpos, with temp output directory
6201         # A run once script will be executed immediately,
6202         # instead of creating a cron job
6203         with TemporaryDirectory() as dname:
6204             test_file = '%s/TESTING.txt' % dname
6205             test_data = '#!/bin/sh\ntouch %s' % test_file
6206             ret = stage_file(test_script, test_data)
6207             self.assertTrue(ret, 'Could not create the target %s' % test_script)
6208
6209             ext.process_group_policy([], gpos, dname)
6210             files = os.listdir(dname)
6211             self.assertEquals(len(files), 1,
6212                               'The test file was not created')
6213             self.assertEquals(files[0], os.path.basename(test_file),
6214                               'The test file was not created')
6215
6216             # Unlink the test file and ensure that processing
6217             # policy again does not recreate it.
6218             os.unlink(test_file)
6219             ext.process_group_policy([], gpos, dname)
6220             files = os.listdir(dname)
6221             self.assertEquals(len(files), 0,
6222                               'The test file should not have been created')
6223
6224             # Remove policy
6225             gp_db = store.get_gplog(machine_creds.get_username())
6226             del_gpos = get_deleted_gpos_list(gp_db, [])
6227             ext.process_group_policy(del_gpos, [])
6228
6229             # Test rsop
6230             entry = 'Run once as: %s `%s %s`' % (run_as.text, test_script,
6231                                             parameters.text)
6232             g = [g for g in gpos if g.name == guid][0]
6233             ret = ext.rsop(g)
6234             self.assertIn(entry, list(ret.values())[0][0],
6235                           'The target entry was not listed by rsop')
6236
6237             # Check that a call to gpupdate --rsop also succeeds
6238             ret = rsop(self.lp)
6239             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6240
6241         # Unstage the manifest.xml and script files
6242         unstage_file(manifest)
6243
6244         # Stage the manifest.xml file for a script without parameters
6245         stage = etree.Element('vgppolicy')
6246         policysetting = etree.SubElement(stage, 'policysetting')
6247         version = etree.SubElement(policysetting, 'version')
6248         version.text = '1'
6249         data = etree.SubElement(policysetting, 'data')
6250         listelement = etree.SubElement(data, 'listelement')
6251         script = etree.SubElement(listelement, 'script')
6252         script.text = os.path.basename(test_script).lower()
6253         hash = etree.SubElement(listelement, 'hash')
6254         hash.text = \
6255             hashlib.md5(open(test_script, 'rb').read()).hexdigest().upper()
6256         run_as = etree.SubElement(listelement, 'run_as')
6257         run_as.text = 'root'
6258         ret = stage_file(manifest, etree.tostring(stage))
6259         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6260
6261         # Process all gpos, with temp output directory
6262         with TemporaryDirectory() as dname:
6263             try:
6264                 ext.process_group_policy([], gpos, dname)
6265             except Exception as e:
6266                 self.fail(str(e))
6267             files = os.listdir(dname)
6268             self.assertEquals(len(files), 1,
6269                               'The target script was not created')
6270             entry = '@reboot %s %s' % (run_as.text, test_script)
6271             self.assertIn(entry,
6272                           open(os.path.join(dname, files[0]), 'r').read(),
6273                           'The test entry was not found')
6274
6275             # Remove policy
6276             gp_db = store.get_gplog(machine_creds.get_username())
6277             del_gpos = get_deleted_gpos_list(gp_db, [])
6278             ext.process_group_policy(del_gpos, [])
6279             files = os.listdir(dname)
6280             self.assertEquals(len(files), 0,
6281                               'The target script was not removed')
6282
6283             # Test rsop
6284             g = [g for g in gpos if g.name == guid][0]
6285             ret = ext.rsop(g)
6286             self.assertIn(entry, list(ret.values())[0][0],
6287                           'The target entry was not listed by rsop')
6288
6289             # Check that a call to gpupdate --rsop also succeeds
6290             ret = rsop(self.lp)
6291             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6292
6293         # Unstage the manifest.xml and script files
6294         unstage_file(manifest)
6295         unstage_file(test_script)
6296
6297     def test_vgp_motd(self):
6298         local_path = self.lp.cache_path('gpo_cache')
6299         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6300         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6301             'VGP/VTLA/UNIX/MOTD/MANIFEST.XML')
6302         cache_dir = self.lp.get('cache directory')
6303         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6304
6305         machine_creds = Credentials()
6306         machine_creds.guess(self.lp)
6307         machine_creds.set_machine_account()
6308
6309         # Initialize the group policy extension
6310         ext = vgp_motd_ext(self.lp, machine_creds,
6311                            machine_creds.get_username(), store)
6312
6313         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6314         if ads.connect():
6315             gpos = ads.get_gpo_list(machine_creds.get_username())
6316
6317         # Stage the manifest.xml file with test data
6318         stage = etree.Element('vgppolicy')
6319         policysetting = etree.SubElement(stage, 'policysetting')
6320         version = etree.SubElement(policysetting, 'version')
6321         version.text = '1'
6322         data = etree.SubElement(policysetting, 'data')
6323         filename = etree.SubElement(data, 'filename')
6324         filename.text = 'motd'
6325         text = etree.SubElement(data, 'text')
6326         text.text = 'This is the message of the day'
6327         ret = stage_file(manifest, etree.tostring(stage))
6328         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6329
6330         # Process all gpos, with temp output directory
6331         with NamedTemporaryFile() as f:
6332             ext.process_group_policy([], gpos, f.name)
6333             self.assertEquals(open(f.name, 'r').read(), text.text,
6334                               'The motd was not applied')
6335
6336             # Check that a call to gpupdate --rsop also succeeds
6337             ret = rsop(self.lp)
6338             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6339
6340             # Remove policy
6341             gp_db = store.get_gplog(machine_creds.get_username())
6342             del_gpos = get_deleted_gpos_list(gp_db, [])
6343             ext.process_group_policy(del_gpos, [], f.name)
6344             self.assertNotEquals(open(f.name, 'r').read(), text.text,
6345                                  'The motd was not unapplied')
6346
6347         # Unstage the Registry.pol file
6348         unstage_file(manifest)
6349
6350     def test_vgp_issue(self):
6351         local_path = self.lp.cache_path('gpo_cache')
6352         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6353         manifest = os.path.join(local_path, policies, guid, 'MACHINE',
6354             'VGP/VTLA/UNIX/ISSUE/MANIFEST.XML')
6355         cache_dir = self.lp.get('cache directory')
6356         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6357
6358         machine_creds = Credentials()
6359         machine_creds.guess(self.lp)
6360         machine_creds.set_machine_account()
6361
6362         # Initialize the group policy extension
6363         ext = vgp_issue_ext(self.lp, machine_creds,
6364                             machine_creds.get_username(), store)
6365
6366         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6367         if ads.connect():
6368             gpos = ads.get_gpo_list(machine_creds.get_username())
6369
6370         # Stage the manifest.xml file with test data
6371         stage = etree.Element('vgppolicy')
6372         policysetting = etree.SubElement(stage, 'policysetting')
6373         version = etree.SubElement(policysetting, 'version')
6374         version.text = '1'
6375         data = etree.SubElement(policysetting, 'data')
6376         filename = etree.SubElement(data, 'filename')
6377         filename.text = 'issue'
6378         text = etree.SubElement(data, 'text')
6379         text.text = 'Welcome to Samba!'
6380         ret = stage_file(manifest, etree.tostring(stage))
6381         self.assertTrue(ret, 'Could not create the target %s' % manifest)
6382
6383         # Process all gpos, with temp output directory
6384         with NamedTemporaryFile() as f:
6385             ext.process_group_policy([], gpos, f.name)
6386             self.assertEquals(open(f.name, 'r').read(), text.text,
6387                               'The issue was not applied')
6388
6389             # Check that a call to gpupdate --rsop also succeeds
6390             ret = rsop(self.lp)
6391             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6392
6393             # Remove policy
6394             gp_db = store.get_gplog(machine_creds.get_username())
6395             del_gpos = get_deleted_gpos_list(gp_db, [])
6396             ext.process_group_policy(del_gpos, [], f.name)
6397             self.assertNotEquals(open(f.name, 'r').read(), text.text,
6398                                  'The issue was not unapplied')
6399
6400         # Unstage the manifest.xml file
6401         unstage_file(manifest)
6402
6403     def test_vgp_access(self):
6404         local_path = self.lp.cache_path('gpo_cache')
6405         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6406         allow = os.path.join(local_path, policies, guid, 'MACHINE',
6407             'VGP/VTLA/VAS/HOSTACCESSCONTROL/ALLOW/MANIFEST.XML')
6408         deny = os.path.join(local_path, policies, guid, 'MACHINE',
6409             'VGP/VTLA/VAS/HOSTACCESSCONTROL/DENY/MANIFEST.XML')
6410         cache_dir = self.lp.get('cache directory')
6411         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6412
6413         machine_creds = Credentials()
6414         machine_creds.guess(self.lp)
6415         machine_creds.set_machine_account()
6416
6417         # Initialize the group policy extension
6418         ext = vgp_access_ext(self.lp, machine_creds,
6419                              machine_creds.get_username(), store)
6420
6421         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6422         if ads.connect():
6423             gpos = ads.get_gpo_list(machine_creds.get_username())
6424
6425         # Stage the manifest.xml allow file
6426         stage = etree.Element('vgppolicy')
6427         policysetting = etree.SubElement(stage, 'policysetting')
6428         version = etree.SubElement(policysetting, 'version')
6429         version.text = '2'
6430         apply_mode = etree.SubElement(policysetting, 'apply_mode')
6431         apply_mode.text = 'merge'
6432         data = etree.SubElement(policysetting, 'data')
6433         # Add an allowed user
6434         listelement = etree.SubElement(data, 'listelement')
6435         otype = etree.SubElement(listelement, 'type')
6436         otype.text = 'USER'
6437         entry = etree.SubElement(listelement, 'entry')
6438         entry.text = 'goodguy@%s' % realm
6439         adobject = etree.SubElement(listelement, 'adobject')
6440         name = etree.SubElement(adobject, 'name')
6441         name.text = 'goodguy'
6442         domain = etree.SubElement(adobject, 'domain')
6443         domain.text = realm
6444         otype = etree.SubElement(adobject, 'type')
6445         otype.text = 'user'
6446         # Add an allowed group
6447         groupattr = etree.SubElement(data, 'groupattr')
6448         groupattr.text = 'samAccountName'
6449         listelement = etree.SubElement(data, 'listelement')
6450         otype = etree.SubElement(listelement, 'type')
6451         otype.text = 'GROUP'
6452         entry = etree.SubElement(listelement, 'entry')
6453         entry.text = '%s\\goodguys' % realm
6454         dn = etree.SubElement(listelement, 'dn')
6455         dn.text = 'CN=goodguys,CN=Users,%s' % base_dn
6456         adobject = etree.SubElement(listelement, 'adobject')
6457         name = etree.SubElement(adobject, 'name')
6458         name.text = 'goodguys'
6459         domain = etree.SubElement(adobject, 'domain')
6460         domain.text = realm
6461         otype = etree.SubElement(adobject, 'type')
6462         otype.text = 'group'
6463         ret = stage_file(allow, etree.tostring(stage))
6464         self.assertTrue(ret, 'Could not create the target %s' % allow)
6465
6466         # Stage the manifest.xml deny file
6467         stage = etree.Element('vgppolicy')
6468         policysetting = etree.SubElement(stage, 'policysetting')
6469         version = etree.SubElement(policysetting, 'version')
6470         version.text = '2'
6471         apply_mode = etree.SubElement(policysetting, 'apply_mode')
6472         apply_mode.text = 'merge'
6473         data = etree.SubElement(policysetting, 'data')
6474         # Add a denied user
6475         listelement = etree.SubElement(data, 'listelement')
6476         otype = etree.SubElement(listelement, 'type')
6477         otype.text = 'USER'
6478         entry = etree.SubElement(listelement, 'entry')
6479         entry.text = 'badguy@%s' % realm
6480         adobject = etree.SubElement(listelement, 'adobject')
6481         name = etree.SubElement(adobject, 'name')
6482         name.text = 'badguy'
6483         domain = etree.SubElement(adobject, 'domain')
6484         domain.text = realm
6485         otype = etree.SubElement(adobject, 'type')
6486         otype.text = 'user'
6487         # Add a denied group
6488         groupattr = etree.SubElement(data, 'groupattr')
6489         groupattr.text = 'samAccountName'
6490         listelement = etree.SubElement(data, 'listelement')
6491         otype = etree.SubElement(listelement, 'type')
6492         otype.text = 'GROUP'
6493         entry = etree.SubElement(listelement, 'entry')
6494         entry.text = '%s\\badguys' % realm
6495         dn = etree.SubElement(listelement, 'dn')
6496         dn.text = 'CN=badguys,CN=Users,%s' % base_dn
6497         adobject = etree.SubElement(listelement, 'adobject')
6498         name = etree.SubElement(adobject, 'name')
6499         name.text = 'badguys'
6500         domain = etree.SubElement(adobject, 'domain')
6501         domain.text = realm
6502         otype = etree.SubElement(adobject, 'type')
6503         otype.text = 'group'
6504         ret = stage_file(deny, etree.tostring(stage))
6505         self.assertTrue(ret, 'Could not create the target %s' % deny)
6506
6507         # Process all gpos, with temp output directory
6508         with TemporaryDirectory() as dname:
6509             ext.process_group_policy([], gpos, dname)
6510             conf = os.listdir(dname)
6511             # There will be 2 files, the policy file and the deny file
6512             self.assertEquals(len(conf), 2, 'The conf file was not created')
6513             # Ignore the DENY_ALL conf file
6514             gp_cfg = os.path.join(dname,
6515                 [c for c in conf if '_gp_DENY_ALL.conf' not in c][0])
6516
6517             # Check the access config for the correct access.conf entries
6518             print('Config file %s found' % gp_cfg)
6519             data = open(gp_cfg, 'r').read()
6520             self.assertIn('+:%s\\goodguy:ALL' % realm, data)
6521             self.assertIn('+:%s\\goodguys:ALL' % realm, data)
6522             self.assertIn('-:%s\\badguy:ALL' % realm, data)
6523             self.assertIn('-:%s\\badguys:ALL' % realm, data)
6524
6525             # Check that a call to gpupdate --rsop also succeeds
6526             ret = rsop(self.lp)
6527             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6528
6529             # Remove policy
6530             gp_db = store.get_gplog(machine_creds.get_username())
6531             del_gpos = get_deleted_gpos_list(gp_db, [])
6532             ext.process_group_policy(del_gpos, [], dname)
6533             self.assertFalse(os.path.exists(gp_cfg),
6534                              'Unapply failed to cleanup config')
6535
6536         # Unstage the manifest.pol files
6537         unstage_file(allow)
6538         unstage_file(deny)
6539
6540     def test_gnome_settings(self):
6541         local_path = self.lp.cache_path('gpo_cache')
6542         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6543         reg_pol = os.path.join(local_path, policies, guid,
6544                                'MACHINE/REGISTRY.POL')
6545         cache_dir = self.lp.get('cache directory')
6546         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6547
6548         machine_creds = Credentials()
6549         machine_creds.guess(self.lp)
6550         machine_creds.set_machine_account()
6551
6552         # Initialize the group policy extension
6553         ext = gp_gnome_settings_ext(self.lp, machine_creds,
6554                                     machine_creds.get_username(), store)
6555
6556         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6557         if ads.connect():
6558             gpos = ads.get_gpo_list(machine_creds.get_username())
6559
6560         # Stage the Registry.pol file with test data
6561         parser = GPPolParser()
6562         parser.load_xml(etree.fromstring(gnome_test_reg_pol.strip()))
6563         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6564         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6565
6566         with TemporaryDirectory() as dname:
6567             ext.process_group_policy([], gpos, dname)
6568
6569             local_db = os.path.join(dname, 'etc/dconf/db/local.d')
6570             self.assertTrue(os.path.isdir(local_db),
6571                             'Local db dir not created')
6572             def db_check(name, data, count=1):
6573                 db = glob(os.path.join(local_db, '*-%s' % name))
6574                 self.assertEquals(len(db), count, '%s not created' % name)
6575                 file_contents = ConfigParser()
6576                 file_contents.read(db)
6577                 for key in data.keys():
6578                     self.assertTrue(file_contents.has_section(key),
6579                                     'Section %s not found' % key)
6580                     options = data[key]
6581                     for k, v in options.items():
6582                         v_content = file_contents.get(key, k)
6583                         self.assertEqual(v_content, v,
6584                             '%s: %s != %s' % (key, v_content, v))
6585
6586             def del_db_check(name):
6587                 db = glob(os.path.join(local_db, '*-%s' % name))
6588                 self.assertEquals(len(db), 0, '%s not deleted' % name)
6589
6590             locks = os.path.join(local_db, 'locks')
6591             self.assertTrue(os.path.isdir(local_db), 'Locks dir not created')
6592             def lock_check(name, items, count=1):
6593                 lock = glob(os.path.join(locks, '*%s' % name))
6594                 self.assertEquals(len(lock), count,
6595                                   '%s lock not created' % name)
6596                 file_contents = []
6597                 for i in range(count):
6598                     file_contents.extend(open(lock[i], 'r').read().split('\n'))
6599                 for data in items:
6600                     self.assertIn(data, file_contents,
6601                                   '%s lock not created' % data)
6602
6603             def del_lock_check(name):
6604                 lock = glob(os.path.join(locks, '*%s' % name))
6605                 self.assertEquals(len(lock), 0, '%s lock not deleted' % name)
6606
6607             # Check the user profile
6608             user_profile = os.path.join(dname, 'etc/dconf/profile/user')
6609             self.assertTrue(os.path.exists(user_profile),
6610                             'User profile not created')
6611
6612             # Enable the compose key
6613             data = { 'org/gnome/desktop/input-sources':
6614                 { 'xkb-options': '[\'compose:ralt\']' }
6615             }
6616             db_check('input-sources', data)
6617             items = ['/org/gnome/desktop/input-sources/xkb-options']
6618             lock_check('input-sources', items)
6619
6620             # Dim screen when user is idle
6621             data = { 'org/gnome/settings-daemon/plugins/power':
6622                 { 'idle-dim': 'true',
6623                   'idle-brightness': '30'
6624                 }
6625             }
6626             db_check('power', data)
6627             data = { 'org/gnome/desktop/session':
6628                 { 'idle-delay': 'uint32 300' }
6629             }
6630             db_check('session', data)
6631             items = ['/org/gnome/settings-daemon/plugins/power/idle-dim',
6632                      '/org/gnome/settings-daemon/plugins/power/idle-brightness',
6633                      '/org/gnome/desktop/session/idle-delay']
6634             lock_check('power-saving', items)
6635
6636             # Lock down specific settings
6637             bg_locks = ['/org/gnome/desktop/background/picture-uri',
6638                         '/org/gnome/desktop/background/picture-options',
6639                         '/org/gnome/desktop/background/primary-color',
6640                         '/org/gnome/desktop/background/secondary-color']
6641             lock_check('group-policy', bg_locks)
6642
6643             # Lock down enabled extensions
6644             data = { 'org/gnome/shell':
6645                 { 'enabled-extensions':
6646                 '[\'myextension1@myname.example.com\', \'myextension2@myname.example.com\']',
6647                   'development-tools': 'false' }
6648             }
6649             db_check('extensions', data)
6650             items = [ '/org/gnome/shell/enabled-extensions',
6651                       '/org/gnome/shell/development-tools' ]
6652             lock_check('extensions', items)
6653
6654             # Disallow login using a fingerprint
6655             data = { 'org/gnome/login-screen':
6656                 { 'enable-fingerprint-authentication': 'false' }
6657             }
6658             db_check('fingerprintreader', data)
6659             items = ['/org/gnome/login-screen/enable-fingerprint-authentication']
6660             lock_check('fingerprintreader', items)
6661
6662             # Disable user logout and user switching
6663             data = { 'org/gnome/desktop/lockdown':
6664                 { 'disable-log-out': 'true',
6665                   'disable-user-switching': 'true' }
6666             }
6667             db_check('logout', data, 2)
6668             items = ['/org/gnome/desktop/lockdown/disable-log-out',
6669                      '/org/gnome/desktop/lockdown/disable-user-switching']
6670             lock_check('logout', items, 2)
6671
6672             # Disable repartitioning
6673             actions = os.path.join(dname, 'etc/share/polkit-1/actions')
6674             udisk2 = glob(os.path.join(actions,
6675                           'org.freedesktop.[u|U][d|D]isks2.policy'))
6676             self.assertEquals(len(udisk2), 1, 'udisk2 policy not created')
6677             udisk2_tree = etree.fromstring(open(udisk2[0], 'r').read())
6678             actions = udisk2_tree.findall('action')
6679             md = 'org.freedesktop.udisks2.modify-device'
6680             action = [a for a in actions if a.attrib['id'] == md]
6681             self.assertEquals(len(action), 1, 'modify-device not found')
6682             defaults = action[0].find('defaults')
6683             self.assertTrue(defaults is not None,
6684                             'modify-device defaults not found')
6685             allow_any = defaults.find('allow_any').text
6686             self.assertEquals(allow_any, 'no',
6687                               'modify-device allow_any not set to no')
6688             allow_inactive = defaults.find('allow_inactive').text
6689             self.assertEquals(allow_inactive, 'no',
6690                               'modify-device allow_inactive not set to no')
6691             allow_active = defaults.find('allow_active').text
6692             self.assertEquals(allow_active, 'yes',
6693                               'modify-device allow_active not set to yes')
6694
6695             # Disable printing
6696             data = { 'org/gnome/desktop/lockdown':
6697                 { 'disable-printing': 'true' }
6698             }
6699             db_check('printing', data)
6700             items = ['/org/gnome/desktop/lockdown/disable-printing']
6701             lock_check('printing', items)
6702
6703             # Disable file saving
6704             data = { 'org/gnome/desktop/lockdown':
6705                 { 'disable-save-to-disk': 'true' }
6706             }
6707             db_check('filesaving', data)
6708             items = ['/org/gnome/desktop/lockdown/disable-save-to-disk']
6709             lock_check('filesaving', items)
6710
6711             # Disable command-line access
6712             data = { 'org/gnome/desktop/lockdown':
6713                 { 'disable-command-line': 'true' }
6714             }
6715             db_check('cmdline', data)
6716             items = ['/org/gnome/desktop/lockdown/disable-command-line']
6717             lock_check('cmdline', items)
6718
6719             # Allow or disallow online accounts
6720             data = { 'org/gnome/online-accounts':
6721                 { 'whitelisted-providers': '[\'google\']' }
6722             }
6723             db_check('goa', data)
6724             items = ['/org/gnome/online-accounts/whitelisted-providers']
6725             lock_check('goa', items)
6726
6727             # Verify RSOP does not fail
6728             ext.rsop([g for g in gpos if g.name == guid][0])
6729
6730             # Check that a call to gpupdate --rsop also succeeds
6731             ret = rsop(self.lp)
6732             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6733
6734             # Remove policy
6735             gp_db = store.get_gplog(machine_creds.get_username())
6736             del_gpos = get_deleted_gpos_list(gp_db, [])
6737             ext.process_group_policy(del_gpos, [], dname)
6738             del_db_check('input-sources')
6739             del_lock_check('input-sources')
6740             del_db_check('power')
6741             del_db_check('session')
6742             del_lock_check('power-saving')
6743             del_lock_check('group-policy')
6744             del_db_check('extensions')
6745             del_lock_check('extensions')
6746             del_db_check('fingerprintreader')
6747             del_lock_check('fingerprintreader')
6748             del_db_check('logout')
6749             del_lock_check('logout')
6750             actions = os.path.join(dname, 'etc/share/polkit-1/actions')
6751             udisk2 = glob(os.path.join(actions,
6752                           'org.freedesktop.[u|U][d|D]isks2.policy'))
6753             self.assertEquals(len(udisk2), 0, 'udisk2 policy not deleted')
6754             del_db_check('printing')
6755             del_lock_check('printing')
6756             del_db_check('filesaving')
6757             del_lock_check('filesaving')
6758             del_db_check('cmdline')
6759             del_lock_check('cmdline')
6760             del_db_check('goa')
6761             del_lock_check('goa')
6762
6763         # Unstage the Registry.pol file
6764         unstage_file(reg_pol)
6765
6766     def test_gp_cert_auto_enroll_ext(self):
6767         local_path = self.lp.cache_path('gpo_cache')
6768         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6769         reg_pol = os.path.join(local_path, policies, guid,
6770                                'MACHINE/REGISTRY.POL')
6771         cache_dir = self.lp.get('cache directory')
6772         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6773
6774         machine_creds = Credentials()
6775         machine_creds.guess(self.lp)
6776         machine_creds.set_machine_account()
6777
6778         # Initialize the group policy extension
6779         ext = cae.gp_cert_auto_enroll_ext(self.lp, machine_creds,
6780                                           machine_creds.get_username(), store)
6781
6782         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6783         if ads.connect():
6784             gpos = ads.get_gpo_list(machine_creds.get_username())
6785
6786         # Stage the Registry.pol file with test data
6787         parser = GPPolParser()
6788         parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip()))
6789         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6790         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6791
6792         # Write the dummy CA entry, Enrollment Services, and Templates Entries
6793         admin_creds = Credentials()
6794         admin_creds.set_username(os.environ.get('DC_USERNAME'))
6795         admin_creds.set_password(os.environ.get('DC_PASSWORD'))
6796         admin_creds.set_realm(os.environ.get('REALM'))
6797         hostname = get_dc_hostname(machine_creds, self.lp)
6798         url = 'ldap://%s' % hostname
6799         ldb = Ldb(url=url, session_info=system_session(),
6800                   lp=self.lp, credentials=admin_creds)
6801         # Write the dummy CA
6802         confdn = 'CN=Public Key Services,CN=Services,CN=Configuration,%s' % base_dn
6803         ca_cn = '%s-CA' % hostname.replace('.', '-')
6804         certa_dn = 'CN=%s,CN=Certification Authorities,%s' % (ca_cn, confdn)
6805         ldb.add({'dn': certa_dn,
6806                  'objectClass': 'certificationAuthority',
6807                  'authorityRevocationList': ['XXX'],
6808                  'cACertificate': 'XXX',
6809                  'certificateRevocationList': ['XXX'],
6810                 })
6811         # Write the dummy pKIEnrollmentService
6812         enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn)
6813         ldb.add({'dn': enroll_dn,
6814                  'objectClass': 'pKIEnrollmentService',
6815                  'cACertificate': 'XXXX',
6816                  'certificateTemplates': ['Machine'],
6817                  'dNSHostName': hostname,
6818                 })
6819         # Write the dummy pKICertificateTemplate
6820         template_dn = 'CN=Machine,CN=Certificate Templates,%s' % confdn
6821         ldb.add({'dn': template_dn,
6822                  'objectClass': 'pKICertificateTemplate',
6823                 })
6824
6825         with TemporaryDirectory() as dname:
6826             ext.process_group_policy([], gpos, dname, dname)
6827             ca_crt = os.path.join(dname, '%s.crt' % ca_cn)
6828             self.assertTrue(os.path.exists(ca_crt),
6829                             'Root CA certificate was not requested')
6830             machine_crt = os.path.join(dname, '%s.Machine.crt' % ca_cn)
6831             self.assertTrue(os.path.exists(machine_crt),
6832                             'Machine certificate was not requested')
6833             machine_key = os.path.join(dname, '%s.Machine.key' % ca_cn)
6834             self.assertTrue(os.path.exists(machine_crt),
6835                             'Machine key was not generated')
6836
6837             # Verify RSOP does not fail
6838             ext.rsop([g for g in gpos if g.name == guid][0])
6839
6840             # Check that a call to gpupdate --rsop also succeeds
6841             ret = rsop(self.lp)
6842             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6843
6844             # Remove policy
6845             gp_db = store.get_gplog(machine_creds.get_username())
6846             del_gpos = get_deleted_gpos_list(gp_db, [])
6847             ext.process_group_policy(del_gpos, [], dname)
6848             self.assertFalse(os.path.exists(ca_crt),
6849                             'Root CA certificate was not removed')
6850             self.assertFalse(os.path.exists(machine_crt),
6851                             'Machine certificate was not removed')
6852             self.assertFalse(os.path.exists(machine_crt),
6853                             'Machine key was not removed')
6854             out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate()
6855             self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed')
6856             out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate()
6857             self.assertNotIn(b'Machine', out,
6858                              'Machine certificate not removed')
6859
6860         # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate
6861         ldb.delete(certa_dn)
6862         ldb.delete(enroll_dn)
6863         ldb.delete(template_dn)
6864
6865         # Unstage the Registry.pol file
6866         unstage_file(reg_pol)
6867
6868     def test_gp_user_scripts_ext(self):
6869         local_path = self.lp.cache_path('gpo_cache')
6870         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6871         reg_pol = os.path.join(local_path, policies, guid,
6872                                'USER/REGISTRY.POL')
6873         cache_dir = self.lp.get('cache directory')
6874         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6875
6876         machine_creds = Credentials()
6877         machine_creds.guess(self.lp)
6878         machine_creds.set_machine_account()
6879
6880         # Initialize the group policy extension
6881         ext = gp_user_scripts_ext(self.lp, machine_creds,
6882                                   os.environ.get('DC_USERNAME'), store)
6883
6884         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6885         if ads.connect():
6886             gpos = ads.get_gpo_list(machine_creds.get_username())
6887
6888         reg_key = b'Software\\Policies\\Samba\\Unix Settings'
6889         sections = { b'%s\\Daily Scripts' % reg_key : b'@daily',
6890                      b'%s\\Monthly Scripts' % reg_key : b'@monthly',
6891                      b'%s\\Weekly Scripts' % reg_key : b'@weekly',
6892                      b'%s\\Hourly Scripts' % reg_key : b'@hourly' }
6893         for keyname in sections.keys():
6894             # Stage the Registry.pol file with test data
6895             stage = preg.file()
6896             e = preg.entry()
6897             e.keyname = keyname
6898             e.valuename = b'Software\\Policies\\Samba\\Unix Settings'
6899             e.type = 1
6900             e.data = b'echo hello world'
6901             stage.num_entries = 1
6902             stage.entries = [e]
6903             ret = stage_file(reg_pol, ndr_pack(stage))
6904             self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6905
6906             # Process all gpos, intentionally skipping the privilege drop
6907             ext.process_group_policy([], gpos)
6908             # Dump the fake crontab setup for testing
6909             p = Popen(['crontab', '-l'], stdout=PIPE)
6910             crontab, _ = p.communicate()
6911             entry = b'%s %s' % (sections[keyname], e.data.encode())
6912             self.assertIn(entry, crontab,
6913                 'The crontab entry was not installed')
6914
6915             # Check that a call to gpupdate --rsop also succeeds
6916             ret = rsop(self.lp)
6917             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6918
6919             # Remove policy
6920             gp_db = store.get_gplog(os.environ.get('DC_USERNAME'))
6921             del_gpos = get_deleted_gpos_list(gp_db, [])
6922             ext.process_group_policy(del_gpos, [])
6923             # Dump the fake crontab setup for testing
6924             p = Popen(['crontab', '-l'], stdout=PIPE)
6925             crontab, _ = p.communicate()
6926             self.assertNotIn(entry, crontab,
6927                 'Unapply failed to cleanup crontab entry')
6928
6929             # Unstage the Registry.pol file
6930             unstage_file(reg_pol)
6931
6932     def test_gp_firefox_ext(self):
6933         local_path = self.lp.cache_path('gpo_cache')
6934         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6935         reg_pol = os.path.join(local_path, policies, guid,
6936                                'MACHINE/REGISTRY.POL')
6937         cache_dir = self.lp.get('cache directory')
6938         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
6939
6940         machine_creds = Credentials()
6941         machine_creds.guess(self.lp)
6942         machine_creds.set_machine_account()
6943
6944         # Initialize the group policy extension
6945         ext = gp_firefox_ext(self.lp, machine_creds,
6946                              machine_creds.get_username(), store)
6947
6948         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
6949         if ads.connect():
6950             gpos = ads.get_gpo_list(machine_creds.get_username())
6951
6952         # Stage the Registry.pol file with test data
6953         parser = GPPolParser()
6954         parser.load_xml(etree.fromstring(firefox_reg_pol.strip()))
6955         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
6956         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
6957
6958         with TemporaryDirectory() as dname:
6959             ext.process_group_policy([], gpos, dname)
6960             policies_file = os.path.join(dname, 'policies.json')
6961             with open(policies_file, 'r') as r:
6962                 policy_data = json.load(r)
6963             expected_policy_data = json.loads(firefox_json_expected)
6964             self.assertIn('policies', policy_data, 'Policies were not applied')
6965             self.assertEqual(expected_policy_data['policies'].keys(),
6966                              policy_data['policies'].keys(),
6967                              'Firefox policies are missing')
6968             for name in expected_policy_data['policies'].keys():
6969                 self.assertEqual(expected_policy_data['policies'][name],
6970                                  policy_data['policies'][name],
6971                                  'Policies were not applied')
6972
6973             # Verify RSOP does not fail
6974             ext.rsop([g for g in gpos if g.name == guid][0])
6975
6976             # Check that a call to gpupdate --rsop also succeeds
6977             ret = rsop(self.lp)
6978             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
6979
6980             # Unapply the policy
6981             gp_db = store.get_gplog(machine_creds.get_username())
6982             del_gpos = get_deleted_gpos_list(gp_db, [])
6983             ext.process_group_policy(del_gpos, [], dname)
6984             if os.path.exists(policies_file):
6985                 data = json.load(open(policies_file, 'r'))
6986                 if 'policies' in data.keys():
6987                     self.assertEqual(len(data['policies'].keys()), 0,
6988                                      'The policy was not unapplied')
6989
6990         # Unstage the Registry.pol file
6991         unstage_file(reg_pol)
6992
6993     def test_gp_chromium_ext(self):
6994         local_path = self.lp.cache_path('gpo_cache')
6995         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
6996         reg_pol = os.path.join(local_path, policies, guid,
6997                                'MACHINE/REGISTRY.POL')
6998         cache_dir = self.lp.get('cache directory')
6999         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7000
7001         machine_creds = Credentials()
7002         machine_creds.guess(self.lp)
7003         machine_creds.set_machine_account()
7004
7005         # Initialize the group policy extension
7006         ext = gp_chromium_ext(self.lp, machine_creds,
7007                               machine_creds.get_username(), store)
7008
7009         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7010         if ads.connect():
7011             gpos = ads.get_gpo_list(machine_creds.get_username())
7012
7013         # Stage the Registry.pol file with test data
7014         parser = GPPolParser()
7015         parser.load_xml(etree.fromstring(chromium_reg_pol.strip()))
7016         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7017         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7018
7019         with TemporaryDirectory() as dname:
7020             ext.process_group_policy([], gpos, dname)
7021             managed = os.path.join(dname, 'managed')
7022             managed_files = os.listdir(managed)
7023             self.assertEquals(len(managed_files), 1,
7024                               'Chromium policies are missing')
7025             managed_file = os.path.join(managed, managed_files[0])
7026             with open(managed_file, 'r') as r:
7027                 managed_data = json.load(r)
7028             recommended = os.path.join(dname, 'recommended')
7029             recommended_files = os.listdir(recommended)
7030             self.assertEquals(len(recommended_files), 1,
7031                               'Chromium policies are missing')
7032             recommended_file = os.path.join(recommended, recommended_files[0])
7033             with open(recommended_file, 'r') as r:
7034                 recommended_data = json.load(r)
7035             expected_managed_data = json.loads(chromium_json_expected_managed)
7036             expected_recommended_data = \
7037                 json.loads(chromium_json_expected_recommended)
7038             self.maxDiff = None
7039             self.assertEqual(sorted(expected_managed_data.keys()),
7040                              sorted(managed_data.keys()),
7041                              'Chromium policies are missing')
7042             for name in expected_managed_data.keys():
7043                 self.assertEqual(expected_managed_data[name],
7044                                  managed_data[name],
7045                                  'Policies were not applied')
7046             self.assertEqual(expected_recommended_data.keys(),
7047                              recommended_data.keys(),
7048                              'Chromium policies are missing')
7049             for name in expected_recommended_data.keys():
7050                 self.assertEqual(expected_recommended_data[name],
7051                                  recommended_data[name],
7052                                  'Policies were not applied')
7053
7054             # Ensure modifying the policy does not generate extra policy files
7055             unstage_file(reg_pol)
7056             # Change a managed entry:
7057             parser.pol_file.entries[0].data = 0
7058             # Change a recommended entry:
7059             parser.pol_file.entries[-1].data = b'https://google.com'
7060             ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7061             self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7062
7063             ext.process_group_policy([], gpos, dname)
7064             managed_files = os.listdir(managed)
7065             self.assertEquals(len(managed_files), 1,
7066                               'Number of Chromium policies is incorrect')
7067             omanaged_file = managed_file
7068             managed_file = os.path.join(managed, managed_files[0])
7069             self.assertNotEquals(omanaged_file, managed_file,
7070                                  'The managed Chromium file did not change')
7071
7072             recommended_files = os.listdir(recommended)
7073             self.assertEquals(len(recommended_files), 1,
7074                               'Number of Chromium policies is incorrect')
7075             orecommended_file = recommended_file
7076             recommended_file = os.path.join(recommended, recommended_files[0])
7077             self.assertNotEquals(orecommended_file, recommended_file,
7078                                  'The recommended Chromium file did not change')
7079
7080             # Verify RSOP does not fail
7081             ext.rsop([g for g in gpos if g.name == guid][0])
7082
7083             # Check that a call to gpupdate --rsop also succeeds
7084             ret = rsop(self.lp)
7085             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7086
7087             # Unapply the policy
7088             gp_db = store.get_gplog(machine_creds.get_username())
7089             del_gpos = get_deleted_gpos_list(gp_db, [])
7090             ext.process_group_policy(del_gpos, [], dname)
7091             managed = os.path.join(managed, managed_files[0])
7092             if os.path.exists(managed):
7093                 data = json.load(open(managed, 'r'))
7094                 self.assertEqual(len(data.keys()), 0,
7095                                  'The policy was not unapplied')
7096             recommended = os.path.join(recommended, recommended_files[0])
7097             if os.path.exists(recommended):
7098                 data = json.load(open(recommended, 'r'))
7099                 self.assertEqual(len(data.keys()), 0,
7100                                  'The policy was not unapplied')
7101
7102         # Unstage the Registry.pol file
7103         unstage_file(reg_pol)
7104
7105     def test_gp_firewalld_ext(self):
7106         local_path = self.lp.cache_path('gpo_cache')
7107         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7108         reg_pol = os.path.join(local_path, policies, guid,
7109                                'MACHINE/REGISTRY.POL')
7110         cache_dir = self.lp.get('cache directory')
7111         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7112
7113         machine_creds = Credentials()
7114         machine_creds.guess(self.lp)
7115         machine_creds.set_machine_account()
7116
7117         # Initialize the group policy extension
7118         ext = gp_firewalld_ext(self.lp, machine_creds,
7119                                machine_creds.get_username(), store)
7120
7121         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7122         if ads.connect():
7123             gpos = ads.get_gpo_list(machine_creds.get_username())
7124
7125         # Stage the Registry.pol file with test data
7126         parser = GPPolParser()
7127         parser.load_xml(etree.fromstring(firewalld_reg_pol.strip()))
7128         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7129         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7130
7131         ext.process_group_policy([], gpos)
7132
7133         # Check that the policy was applied
7134         firewall_cmd = which('firewall-cmd')
7135         cmd = [firewall_cmd, '--get-zones']
7136         p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7137         out, err = p.communicate()
7138         self.assertIn(b'work', out, 'Failed to apply zones')
7139         self.assertIn(b'home', out, 'Failed to apply zones')
7140
7141         cmd = [firewall_cmd, '--zone=work', '--list-interfaces']
7142         p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7143         out, err = p.communicate()
7144         self.assertIn(b'eth0', out, 'Failed to set interface on zone')
7145
7146         cmd = [firewall_cmd, '--zone=home', '--list-interfaces']
7147         p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7148         out, err = p.communicate()
7149         self.assertIn(b'eth0', out, 'Failed to set interface on zone')
7150
7151         cmd = [firewall_cmd, '--zone=work', '--list-rich-rules']
7152         p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7153         out, err = p.communicate()
7154         rule = b'rule family=ipv4 source address=172.25.1.7 ' + \
7155                b'service name=ftp reject'
7156         self.assertEquals(rule, out.strip(), 'Failed to set rich rule')
7157
7158         # Verify RSOP does not fail
7159         ext.rsop([g for g in gpos if g.name == guid][0])
7160
7161         # Check that a call to gpupdate --rsop also succeeds
7162         ret = rsop(self.lp)
7163         self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7164
7165         # Unapply the policy
7166         gp_db = store.get_gplog(machine_creds.get_username())
7167         del_gpos = get_deleted_gpos_list(gp_db, [])
7168         ext.process_group_policy(del_gpos, [])
7169
7170         # Check that the policy was unapplied
7171         cmd = [firewall_cmd, '--get-zones']
7172         p = Popen(cmd, stdout=PIPE, stderr=PIPE)
7173         out, err = p.communicate()
7174         self.assertNotIn(b'work', out, 'Failed to unapply zones')
7175         self.assertNotIn(b'home', out, 'Failed to unapply zones')
7176
7177         # Unstage the Registry.pol file
7178         unstage_file(reg_pol)
7179
7180     def test_advanced_gp_cert_auto_enroll_ext(self):
7181         local_path = self.lp.cache_path('gpo_cache')
7182         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7183         reg_pol = os.path.join(local_path, policies, guid,
7184                                'MACHINE/REGISTRY.POL')
7185         cache_dir = self.lp.get('cache directory')
7186         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7187
7188         machine_creds = Credentials()
7189         machine_creds.guess(self.lp)
7190         machine_creds.set_machine_account()
7191
7192         # Initialize the group policy extension
7193         ext = cae.gp_cert_auto_enroll_ext(self.lp, machine_creds,
7194                                           machine_creds.get_username(), store)
7195
7196         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7197         if ads.connect():
7198             gpos = ads.get_gpo_list(machine_creds.get_username())
7199
7200         admin_creds = Credentials()
7201         admin_creds.set_username(os.environ.get('DC_USERNAME'))
7202         admin_creds.set_password(os.environ.get('DC_PASSWORD'))
7203         admin_creds.set_realm(os.environ.get('REALM'))
7204         hostname = get_dc_hostname(machine_creds, self.lp)
7205         url = 'ldap://%s' % hostname
7206         ldb = Ldb(url=url, session_info=system_session(),
7207                   lp=self.lp, credentials=admin_creds)
7208
7209         # Stage the Registry.pol file with test data
7210         res = ldb.search('', _ldb.SCOPE_BASE, '(objectClass=*)',
7211                          ['rootDomainNamingContext'])
7212         self.assertTrue(len(res) == 1, 'rootDomainNamingContext not found')
7213         res2 = ldb.search(res[0]['rootDomainNamingContext'][0],
7214                           _ldb.SCOPE_BASE, '(objectClass=*)', ['objectGUID'])
7215         self.assertTrue(len(res2) == 1, 'objectGUID not found')
7216         objectGUID = b'{%s}' % \
7217             cae.octet_string_to_objectGUID(res2[0]['objectGUID'][0]).upper().encode()
7218         parser = GPPolParser()
7219         parser.load_xml(etree.fromstring(advanced_enroll_reg_pol.strip() % \
7220             (objectGUID, objectGUID, objectGUID, objectGUID)))
7221         ret = stage_file(reg_pol, ndr_pack(parser.pol_file))
7222         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7223
7224         # Write the dummy CA entry
7225         confdn = 'CN=Public Key Services,CN=Services,CN=Configuration,%s' % base_dn
7226         ca_cn = '%s-CA' % hostname.replace('.', '-')
7227         certa_dn = 'CN=%s,CN=Certification Authorities,%s' % (ca_cn, confdn)
7228         ldb.add({'dn': certa_dn,
7229                  'objectClass': 'certificationAuthority',
7230                  'authorityRevocationList': ['XXX'],
7231                  'cACertificate': 'XXX',
7232                  'certificateRevocationList': ['XXX'],
7233                 })
7234         # Write the dummy pKIEnrollmentService
7235         enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn)
7236         ldb.add({'dn': enroll_dn,
7237                  'objectClass': 'pKIEnrollmentService',
7238                  'cACertificate': 'XXXX',
7239                  'certificateTemplates': ['Machine'],
7240                  'dNSHostName': hostname,
7241                 })
7242         # Write the dummy pKICertificateTemplate
7243         template_dn = 'CN=Machine,CN=Certificate Templates,%s' % confdn
7244         ldb.add({'dn': template_dn,
7245                  'objectClass': 'pKICertificateTemplate',
7246                 })
7247
7248         with TemporaryDirectory() as dname:
7249             ext.process_group_policy([], gpos, dname, dname)
7250             ca_list = [ca_cn, 'example0-com-CA', 'example1-com-CA',
7251                        'example2-com-CA']
7252             for ca in ca_list:
7253                 ca_crt = os.path.join(dname, '%s.crt' % ca)
7254                 self.assertTrue(os.path.exists(ca_crt),
7255                                 'Root CA certificate was not requested')
7256                 machine_crt = os.path.join(dname, '%s.Machine.crt' % ca)
7257                 self.assertTrue(os.path.exists(machine_crt),
7258                                 'Machine certificate was not requested')
7259                 machine_key = os.path.join(dname, '%s.Machine.key' % ca)
7260                 self.assertTrue(os.path.exists(machine_crt),
7261                                 'Machine key was not generated')
7262
7263             # Verify RSOP does not fail
7264             ext.rsop([g for g in gpos if g.name == guid][0])
7265
7266             # Check that a call to gpupdate --rsop also succeeds
7267             ret = rsop(self.lp)
7268             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7269
7270             # Remove policy
7271             gp_db = store.get_gplog(machine_creds.get_username())
7272             del_gpos = get_deleted_gpos_list(gp_db, [])
7273             ext.process_group_policy(del_gpos, [], dname)
7274             self.assertFalse(os.path.exists(ca_crt),
7275                             'Root CA certificate was not removed')
7276             self.assertFalse(os.path.exists(machine_crt),
7277                             'Machine certificate was not removed')
7278             self.assertFalse(os.path.exists(machine_crt),
7279                             'Machine key was not removed')
7280             out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate()
7281             for ca in ca_list:
7282                 self.assertNotIn(get_bytes(ca), out, 'CA was not removed')
7283             out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate()
7284             self.assertNotIn(b'Machine', out,
7285                              'Machine certificate not removed')
7286
7287         # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate
7288         ldb.delete(certa_dn)
7289         ldb.delete(enroll_dn)
7290         ldb.delete(template_dn)
7291
7292         # Unstage the Registry.pol file
7293         unstage_file(reg_pol)
7294
7295     def test_gp_centrify_sudoers_ext(self):
7296         local_path = self.lp.cache_path('gpo_cache')
7297         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7298         reg_pol = os.path.join(local_path, policies, guid,
7299                                'MACHINE/REGISTRY.POL')
7300         cache_dir = self.lp.get('cache directory')
7301         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7302
7303         machine_creds = Credentials()
7304         machine_creds.guess(self.lp)
7305         machine_creds.set_machine_account()
7306
7307         # Initialize the group policy extension
7308         ext = gp_centrify_sudoers_ext(self.lp, machine_creds,
7309                                       machine_creds.get_username(), store)
7310
7311         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7312         if ads.connect():
7313             gpos = ads.get_gpo_list(machine_creds.get_username())
7314
7315         # Stage the Registry.pol file with test data
7316         stage = preg.file()
7317         e1 = preg.entry()
7318         e1.keyname = b'Software\\Policies\\Centrify\\UnixSettings'
7319         e1.valuename = b'sudo.enabled'
7320         e1.type = 4
7321         e1.data = 1
7322         e2 = preg.entry()
7323         e2.keyname = b'Software\\Policies\\Centrify\\UnixSettings\\SuDo'
7324         e2.valuename = b'1'
7325         e2.type = 1
7326         e2.data = b'fakeu ALL=(ALL) NOPASSWD: ALL'
7327         stage.num_entries = 2
7328         stage.entries = [e1, e2]
7329         ret = stage_file(reg_pol, ndr_pack(stage))
7330         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7331
7332         # Process all gpos, with temp output directory
7333         with TemporaryDirectory() as dname:
7334             ext.process_group_policy([], gpos, dname)
7335             sudoers = os.listdir(dname)
7336             self.assertEquals(len(sudoers), 1, 'The sudoer file was not created')
7337             sudoers_file = os.path.join(dname, sudoers[0])
7338             self.assertIn(e2.data, open(sudoers_file, 'r').read(),
7339                     'The sudoers entry was not applied')
7340
7341             # Remove the sudoers file, and make sure a re-apply puts it back
7342             os.unlink(sudoers_file)
7343             ext.process_group_policy([], gpos, dname)
7344             sudoers = os.listdir(dname)
7345             self.assertEquals(len(sudoers), 1,
7346                               'The sudoer file was not recreated')
7347             sudoers_file = os.path.join(dname, sudoers[0])
7348             self.assertIn(e2.data, open(sudoers_file, 'r').read(),
7349                     'The sudoers entry was not reapplied')
7350
7351             # Check that a call to gpupdate --rsop also succeeds
7352             ret = rsop(self.lp)
7353             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7354
7355             # Remove policy
7356             gp_db = store.get_gplog(machine_creds.get_username())
7357             del_gpos = get_deleted_gpos_list(gp_db, [])
7358             ext.process_group_policy(del_gpos, [])
7359             self.assertEquals(len(os.listdir(dname)), 0,
7360                               'Unapply failed to cleanup scripts')
7361
7362         # Unstage the Registry.pol file
7363         unstage_file(reg_pol)
7364
7365     def test_gp_centrify_crontab_ext(self):
7366         local_path = self.lp.cache_path('gpo_cache')
7367         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7368         reg_pol = os.path.join(local_path, policies, guid,
7369                                'MACHINE/REGISTRY.POL')
7370         cache_dir = self.lp.get('cache directory')
7371         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7372
7373         machine_creds = Credentials()
7374         machine_creds.guess(self.lp)
7375         machine_creds.set_machine_account()
7376
7377         # Initialize the group policy extension
7378         ext = gp_centrify_crontab_ext(self.lp, machine_creds,
7379                                       machine_creds.get_username(), store)
7380
7381         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7382         if ads.connect():
7383             gpos = ads.get_gpo_list(machine_creds.get_username())
7384
7385         # Stage the Registry.pol file with test data
7386         stage = preg.file()
7387         e = preg.entry()
7388         e.keyname = \
7389             b'Software\\Policies\\Centrify\\UnixSettings\\CrontabEntries'
7390         e.valuename = b'Command1'
7391         e.type = 1
7392         e.data = b'17 * * * * root echo hello world'
7393         stage.num_entries = 1
7394         stage.entries = [e]
7395         ret = stage_file(reg_pol, ndr_pack(stage))
7396         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7397
7398         # Process all gpos, with temp output directory
7399         with TemporaryDirectory() as dname:
7400             ext.process_group_policy([], gpos, dname)
7401             cron_entries = os.listdir(dname)
7402             self.assertEquals(len(cron_entries), 1, 'Cron entry not created')
7403             fname = os.path.join(dname, cron_entries[0])
7404             data = open(fname, 'rb').read()
7405             self.assertIn(get_bytes(e.data), data, 'Cron entry is missing')
7406
7407             # Check that a call to gpupdate --rsop also succeeds
7408             ret = rsop(self.lp)
7409             self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7410
7411             # Remove policy
7412             gp_db = store.get_gplog(machine_creds.get_username())
7413             del_gpos = get_deleted_gpos_list(gp_db, [])
7414             ext.process_group_policy(del_gpos, [])
7415             self.assertEquals(len(os.listdir(dname)), 0,
7416                               'Unapply failed to cleanup script')
7417
7418             # Unstage the Registry.pol file
7419             unstage_file(reg_pol)
7420
7421     def test_gp_user_centrify_crontab_ext(self):
7422         local_path = self.lp.cache_path('gpo_cache')
7423         guid = '{31B2F340-016D-11D2-945F-00C04FB984F9}'
7424         reg_pol = os.path.join(local_path, policies, guid,
7425                                'USER/REGISTRY.POL')
7426         cache_dir = self.lp.get('cache directory')
7427         store = GPOStorage(os.path.join(cache_dir, 'gpo.tdb'))
7428
7429         machine_creds = Credentials()
7430         machine_creds.guess(self.lp)
7431         machine_creds.set_machine_account()
7432
7433         # Initialize the group policy extension
7434         ext = gp_user_centrify_crontab_ext(self.lp, machine_creds,
7435                                            os.environ.get('DC_USERNAME'),
7436                                            store)
7437
7438         ads = gpo.ADS_STRUCT(self.server, self.lp, machine_creds)
7439         if ads.connect():
7440             gpos = ads.get_gpo_list(machine_creds.get_username())
7441
7442         # Stage the Registry.pol file with test data
7443         stage = preg.file()
7444         e = preg.entry()
7445         e.keyname = \
7446             b'Software\\Policies\\Centrify\\UnixSettings\\CrontabEntries'
7447         e.valuename = b'Command1'
7448         e.type = 1
7449         e.data = b'17 * * * * echo hello world'
7450         stage.num_entries = 1
7451         stage.entries = [e]
7452         ret = stage_file(reg_pol, ndr_pack(stage))
7453         self.assertTrue(ret, 'Could not create the target %s' % reg_pol)
7454
7455         # Process all gpos, intentionally skipping the privilege drop
7456         ext.process_group_policy([], gpos)
7457         # Dump the fake crontab setup for testing
7458         p = Popen(['crontab', '-l'], stdout=PIPE)
7459         crontab, _ = p.communicate()
7460         self.assertIn(get_bytes(e.data), crontab,
7461             'The crontab entry was not installed')
7462
7463         # Check that a call to gpupdate --rsop also succeeds
7464         ret = rsop(self.lp)
7465         self.assertEquals(ret, 0, 'gpupdate --rsop failed!')
7466
7467         # Remove policy
7468         gp_db = store.get_gplog(os.environ.get('DC_USERNAME'))
7469         del_gpos = get_deleted_gpos_list(gp_db, [])
7470         ext.process_group_policy(del_gpos, [])
7471         # Dump the fake crontab setup for testing
7472         p = Popen(['crontab', '-l'], stdout=PIPE)
7473         crontab, _ = p.communicate()
7474         self.assertNotIn(get_bytes(e.data), crontab,
7475             'Unapply failed to cleanup crontab entry')
7476
7477         # Unstage the Registry.pol file
7478         unstage_file(reg_pol)