The Firefox New Tab page must not show Top Sites, Sponsored Top sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.

An XCCDF Rule

Description

Display of top sites may be disabled in an administrative policy by setting the following items under FirefoxHome to false and by setting the locked key to true. Search TopSites SponsoredTopSites Pocket SponsoredPocket Highlights Snippets

Rationale

The New Tab page by default shows a list of built-in top sites, as well as the top sites the user has visited. It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins that are not related to requirements or provide a wide array of functionality not required for every mission but that cannot be disabled. The new tab page must not actively show user activity.

ID: xccdf_org.ssgproject.content_rule_firefox_policy-nonessential_capabilities
Severity: Medium
References: CCI-000381

CM-7

FFOX-00-000029
Updated: about 1 year ago


firefox_cfg="policies.json"
# Default to /etc/firefox/policies to use for remediations.
firefox_dirs="/etc/firefox/policies"
permissions=644
declare __REMEDIATE_PYTHON
if [ -x /usr/bin/python ]; then
    __REMEDIATE_PYTHON=/usr/bin/python
elif [ -x /usr/bin/python3 ]; then
    __REMEDIATE_PYTHON=/usr/bin/python3
elif [ -x /usr/bin/python2 ]; then
    __REMEDIATE_PYTHON=/usr/bin/python2
else
    echo "Python required and no python interpreter found."
    exit 1
fi
declare __FIREFOX_DISTRIBUTION
if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
   __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
fi
# If there's a policies file in the distribution directory already, modify it.
if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
        firefox_dirs="${__FIREFOX_DISTRIBUTION}"
fi
# Check the possible Firefox install directories
for firefox_dir in ${firefox_dirs}; do
    if ! [ -d "${firefox_dir}" ]; then
        mkdir -p "${firefox_dir}"
        chmod 755 "${firefox_dir}"
    fi
    # Make sure the Firefox .cfg file exists and has the appropriate permissions
    if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
        echo "{" > "${firefox_dir}/${firefox_cfg}"
        echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
        echo "    }" >> "${firefox_dir}/${firefox_cfg}"
        echo "}" >> "${firefox_dir}/${firefox_cfg}"
        chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
    fi
    # If the key exists, change it. Otherwise, add it to the config_file.
    if [ -x ${__REMEDIATE_PYTHON} ]; then
        echo """
import json
_file=open('${firefox_dir}/${firefox_cfg}', 'r')
_tree=json.load(_file)
_file.close()


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['Search'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['TopSites'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['SponsoredTopSites'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['Pocket'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['SponsoredPocket'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['Highlights'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['Snippets'] = False


if 'FirefoxHome' in _tree['policies']:
   pass
else:
   _tree['policies']['FirefoxHome'] = dict()

_tree['policies']['FirefoxHome']['locked'] = True

_file=open('${firefox_dir}/${firefox_cfg}', 'w')
json.dump(_tree, _file, indent=4, sort_keys=True)
_file.close()
""" | ${__REMEDIATE_PYTHON}
        chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
    fi
done

The Firefox New Tab page must not show Top Sites, Sponsored Top sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.

Description

Rationale

Remediation - Shell Script