Firefox¶

Firefox is the browser on Mint and Debian images (Debian ships firefox-esr, the long-support build; the settings are the same). Its settings live per user in prefs.js under the profile folder, and an image can turn the protections off there. The fix is the Settings page for the user in the README, or a policy file that applies to everyone and can't be changed by the user.

Where the profile is¶

ls ~/.mozilla/firefox/*.default*/prefs.js

Firefox rewrites prefs.js on exit, so close Firefox before reading it, and don't edit it by hand while Firefox runs. about:config inside Firefox shows and changes the same values.

The settings¶

Setting (about:config name)	Value	Settings page	Why
`browser.contentblocking.category`	`strict`	Privacy & Security → Enhanced Tracking Protection → Strict	Blocks trackers, cryptominers, fingerprinters, and third-party cookies
`privacy.donottrackheader.enabled`	true	Privacy & Security → Send websites a "Do Not Track" request: Always
`dom.disable_open_during_load`	true	Privacy & Security → Permissions → Block pop-up windows	Pop-ups are how drive-by installs start
`xpinstall.whitelist.required`	true	Permissions → Warn you when websites try to install add-ons	A site can't install an extension silently
`browser.safebrowsing.malware.enabled`, `browser.safebrowsing.phishing.enabled`	true	Security → Block dangerous and deceptive content	Google Safe Browsing lists
`browser.safebrowsing.downloads.enabled`	true	Security → Block dangerous downloads
`browser.safebrowsing.downloads.remote.block_potentially_unwanted`, `…block_uncommon`	true	Security → Warn you about unwanted and uncommon software
`security.OCSP.enabled`	1	Certificates → Query OCSP responder servers	Revoked certificates are rejected
`dom.security.https_only_mode`	true	HTTPS-Only Mode → Enable in all windows	Every connection is encrypted or the user is warned
`browser.formfill.enable`, `signon.rememberSignons`	false	Privacy & Security → Forms and Autofill, Logins	The browser doesn't store passwords on a shared machine (optional; the README may want the password manager)

Apply for one user¶

Open Firefox as that user and set them in Settings, one row of the table at a time; the third column says where each one lives. That's the way to learn where the settings are. Afterward, close Firefox and read prefs.js to see what the clicks wrote:

grep -E 'contentblocking|safebrowsing|https_only' ~/.mozilla/firefox/*.default*/prefs.js

user_pref("browser.contentblocking.category", "strict");
user_pref("browser.safebrowsing.downloads.enabled", true);
user_pref("dom.security.https_only_mode", true);

Each line is user_pref("name", value);. Once you know that shape you can write the file directly: with Firefox closed, a user.js file in the same folder with one user_pref line per row of the table is re-applied every start, which survives a user changing it back in the UI.

Apply for everyone: a policy file¶

A policy file sets the value for every user and can lock it so the Settings page greys it out. Create it (Mint: /etc/firefox/policies/policies.json; Debian's firefox-esr: /etc/firefox-esr/policies/policies.json):

{
  "policies": {
    "EnableTrackingProtection": { "Value": true, "Locked": true, "Cryptomining": true, "Fingerprinting": true },
    "PopupBlocking": { "Default": true, "Locked": true },
    "Preferences": {
      "browser.contentblocking.category": { "Value": "strict", "Status": "locked" },
      "dom.security.https_only_mode": { "Value": true, "Status": "locked" }
    }
  }
}

The Preferences block takes any about:config name in the form "name": { "Value": …, "Status": "locked" }. Add the remaining rows of the table there yourself, watching the commas: every entry but the last in a block ends with one, and a stray or missing comma makes Firefox ignore the whole file silently. python3 -m json.tool /etc/firefox/policies/policies.json checks the syntax before you find that out the hard way. Open about:policies in Firefox to confirm it loaded.

Extensions¶

about:addons (or Add-ons and themes in the menu). An extension the user didn't install can read every page; remove anything the README doesn't explain. The policy ExtensionSettings with "*": {"installation_mode": "blocked"} stops new ones.

Verify¶

Close Firefox, then:

grep -E 'contentblocking.category|donottrackheader|disable_open_during_load|xpinstall.whitelist|safebrowsing|OCSP|https_only' ~/.mozilla/firefox/*.default*/prefs.js

Or open about:policies and about:config and read them.

Example¶

grep safebrowsing prefs.js for bob shows browser.safebrowsing.malware.enabled false, phishing.enabled false, downloads.enabled false, and xpinstall.whitelist.required false. Someone turned every warning off. Write the policy file so it's fixed for every user and locked, then check about:addons for bob: an extension called "Video Helper" with permission to read all sites. Remove it.

Try it¶

Turn off Safe Browsing in Settings, close Firefox, find the change in prefs.js.
Write a two-setting policies.json, check about:policies, then add a third with a deliberate missing comma and check again.

Build it¶

Your policies.json, kept and copied into place with a firefox.sh that also validates it with python3 -m json.tool.

Next¶

Apache