## Guide to the Secure Configuration of Firefox

> with profile CUSP - Common User Security Profile for Mozilla Firefox
> This profile contains rules to harden Mozilla Firefox according to rule 6.1 in the Common User Security Guide for Fedora Workstation.

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide
This guide presents a catalog of security-relevant configuration settings for Firefox. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the `scap-security-guide` package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for Firefox, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

## Profile Information

Profile Title | CUSP - Common User Security Profile for Mozilla Firefox
Profile ID | xccdf_org.ssgproject.content_profile_cusp_firefox

#### CPE Platforms

- cpe:/a:mozilla:firefox

## Revision History

Current version: 0.1.79

- draft (as of 2025-12-05)

## Table of Contents

1. Firefox

## Checklist

Group Guide to the Secure Configuration of Firefox Group contains 1 group and 9 rules
Group Firefox Group contains 9 rules

[ref] Firefox is an open-source web browser and developed by Mozilla. Web browsers such as Firefox are used for a number of reasons. This section provides settings for configuring Firefox policies to meet compliance settings for Firefox running on Red Hat Enterprise Linux systems.

Refer to
- http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries
for a list of currently supported Firefox settings.

#### Rule Firefox autoplay must be disabled. [ref]

Audio/Video autoplay may be disabled in an administrative policy by setting the `Default` key under `Permissions`, `Autoplay` to `"block-audio-video"`.
Rationale: | Autoplay allows the user to control whether videos can play automatically (without user consent) with audio content. The user must be able to select content that is run within the browser window.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-autoplay_video

References:

nist | CM-7
stigid | FFOX-00-000021

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Permissions' in _tree['policies']:
       pass
    else:
       _tree['policies']['Permissions'] = dict()

    if 'Autoplay' in _tree['policies']['Permissions']:
       pass
    else:
       _tree['policies']['Permissions']['Autoplay'] = dict()

    _tree['policies']['Permissions']['Autoplay']['Default'] = 'block-audio-video'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Ensure the Content Blocker uBlock Origin is Installed [ref]

The uBlock Origin will be installed automatically by configuring Firefox policy, and updates will be enabled. It can also be installed through the Mozilla Add-Ons store at https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/.

Rationale:

The content blocking feature of uBlock Origin stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the lists uBlock Origin uses, then the content will not be loaded from that site. This may prevent malicious ads from confusing users and concealing the page contents, as well as the loading of content that may contain malware.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-content_blocker

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'ExtensionSettings' in _tree['policies']:
       pass
    else:
       _tree['policies']['ExtensionSettings'] = dict()

    if 'uBlock0@raymondhill.net' in _tree['policies']['ExtensionSettings']:
       pass
    else:
       _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net'] = dict()

    _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net']['installation_mode'] = 'normal_installed'

    if 'ExtensionSettings' in _tree['policies']:
       pass
    else:
       _tree['policies']['ExtensionSettings'] = dict()

    if 'uBlock0@raymondhill.net' in _tree['policies']['ExtensionSettings']:
       pass
    else:
       _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net'] = dict()

    _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net']['install_url'] = 'https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi'

    if 'ExtensionSettings' in _tree['policies']:
       pass
    else:
       _tree['policies']['ExtensionSettings'] = dict()

    if 'uBlock0@raymondhill.net' in _tree['policies']['ExtensionSettings']:
       pass
    else:
       _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net'] = dict()

    _tree['policies']['ExtensionSettings']['uBlock0@raymondhill.net']['updates_disabled'] = False

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Cryptomining protection [ref]

Cryptomining protection may be enabled by setting `privacy.trackingprotection.cryptomining.enabled` to `true`.

Rationale:

The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. Cryptomining scripts use your computer’s central processing unit (CPU) to invisibly mine cryptocurrency.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-cryptomining

References:

nist | CM-7
stigid | FFOX-00-000024

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'EnableTrackingProtection' in _tree['policies']:
       pass
    else:
       _tree['policies']['EnableTrackingProtection'] = dict()

    _tree['policies']['EnableTrackingProtection']['Cryptomining'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Enhanced Tracking Protection [ref]

Enhanced Tracking Protection may be enabled by setting `browser.contentblocking.category` to `strict`.
Rationale: | Tracking generally refers to content, cookies, or scripts that can collect your browsing data across multiple sites.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-enhanced_tracking

References:

nist | CM-7
stigid | FFOX-00-000025

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.contentblocking.category' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.contentblocking.category'] = dict()

    _tree['policies']['Preferences']['browser.contentblocking.category']['Value'] = 'strict'

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'browser.contentblocking.category' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['browser.contentblocking.category'] = dict()

    _tree['policies']['Preferences']['browser.contentblocking.category']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enabled Firefox Fingerprinting Protection [ref]

Fingerprinting protection may be enabled by setting `Fingerprinting` to `true` under `EnableTrackingProtection` in the policies file.

Rationale:

The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. Fingerprinting scripts collect information about your browser and device configuration, such as your operating system, screen resolution, and other settings. By compiling these pieces of data, fingerprinters create a unique profile of you that can be used to track you around the Web.

Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-fingerprinting_protection

References:

nist | CM-7
stigid | FFOX-00-000023

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'EnableTrackingProtection' in _tree['policies']:
       pass
    else:
       _tree['policies']['EnableTrackingProtection'] = dict()

    _tree['policies']['EnableTrackingProtection']['Fingerprinting'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable JavaScript's Raise Or Lower Windows Capability [ref]

JavaScript can configure and make changes to the web browser's appearance by specifically raising and lowering windows. This can be disabled by setting `dom.disable_window_flip` to `true` in the policy file.
Rationale: | JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-javascript_window_changes

References:

nist | CM-7
stigid | FFOX-00-000011

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_flip' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_flip'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_flip']['Value'] = True

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_flip' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_flip'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_flip']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Disable JavaScript's Moving Or Resizing Windows Capability [ref]

JavaScript can configure and make changes to the web browser's appearance by specifically moving and resizing browser windows. This can be disabled by setting `dom.disable_window_move_resize` to `true` in the policy file.
Rationale: | JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-javascript_window_resizing

References:

nist | CM-7
stigid | FFOX-00-000010

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_move_resize' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_move_resize'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_move_resize']['Value'] = True

    if 'Preferences' in _tree['policies']:
       pass
    else:
       _tree['policies']['Preferences'] = dict()

    if 'dom.disable_window_move_resize' in _tree['policies']['Preferences']:
       pass
    else:
       _tree['policies']['Preferences']['dom.disable_window_move_resize'] = dict()

    _tree['policies']['Preferences']['dom.disable_window_move_resize']['Status'] = 'locked'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Enable Firefox Pop-up Blocker [ref]

The pop-up blocker can be enabled by setting `Default` key under `PopupBlocking` to `true` in `policies.json`. `Allowed` may be set to a list of sites allowed to use popups.
Rationale: | Popup windows may be used to launch an attack within a new browser window with altered settings.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-pop-up_windows

References:

nist | CM-7
stigid | FFOX-00-000009

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    if 'PopupBlocking' in _tree['policies']:
       pass
    else:
       _tree['policies']['PopupBlocking'] = dict()

    _tree['policies']['PopupBlocking']['Default'] = True

    if 'PopupBlocking' in _tree['policies']:
       pass
    else:
       _tree['policies']['PopupBlocking'] = dict()

    _tree['policies']['PopupBlocking']['Locked'] = True

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

#### Rule Firefox must be configured to allow only TLS 1.2 or above. [ref]

Firefox may be configured via administrative policy to allow TLS 1.2 at minimum by setting `SSLVersionMin` to `tls1.2`.
Rationale: | Use of versions prior to TLS 1.2 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.
Severity: | medium
Rule ID: | xccdf_org.ssgproject.content_rule_firefox_policy-ssl_minimum_version

References:

nist | AC-17 (2)
stigid | FFOX-00-000002

Remediation Shell script ⇲

Strategy: | policy

    firefox_cfg="policies.json"
    # Default to /etc/firefox/policies to use for remediations.
    firefox_dirs="/etc/firefox/policies"
    permissions=644

    declare __REMEDIATE_PYTHON
    if [ -x /usr/bin/python ]; then
        __REMEDIATE_PYTHON=/usr/bin/python
    elif [ -x /usr/bin/python3 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python3
    elif [ -x /usr/bin/python2 ]; then
        __REMEDIATE_PYTHON=/usr/bin/python2
    else
        echo "Python required and no python interpreter found."
        exit 1
    fi
    declare __FIREFOX_DISTRIBUTION
    if find /usr -iname firefox\* -type f -print | grep -qe "firefox.sh$\|firefox-bin$"; then
       __FIREFOX_DISTRIBUTION=$(dirname "$(find /usr -iname firefox\* -type f -print | grep -e "firefox.sh$\|firefox-bin$" | head -n1)")/distribution
    fi
    # If there's a policies file in the distribution directory already, modify it.
    if [ -f ${__FIREFOX_DISTRIBUTION}/policies.json ]; then
            firefox_dirs="${__FIREFOX_DISTRIBUTION}"
    fi
    # Check the possible Firefox install directories
    for firefox_dir in ${firefox_dirs}; do
        if ! [ -d "${firefox_dir}" ]; then
            mkdir -p "${firefox_dir}"
            chmod 755 "${firefox_dir}"
        fi
        # Make sure the Firefox .cfg file exists and has the appropriate permissions
        if ! [ -f "${firefox_dir}/${firefox_cfg}" ] ; then
            echo "{" > "${firefox_dir}/${firefox_cfg}"
            echo "    \"policies\": {" >> "${firefox_dir}/${firefox_cfg}"
            echo "    }" >> "${firefox_dir}/${firefox_cfg}"
            echo "}" >> "${firefox_dir}/${firefox_cfg}"
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
        # If the key exists, change it. Otherwise, add it to the config_file.
        if [ -x ${__REMEDIATE_PYTHON} ]; then
            echo """
    import json
    _file=open('${firefox_dir}/${firefox_cfg}', 'r')
    _tree=json.load(_file)
    _file.close()

    _tree['policies']['SSLVersionMin'] = 'tls1.2'

    _file=open('${firefox_dir}/${firefox_cfg}', 'w')
    json.dump(_tree, _file, indent=4, sort_keys=True)
    _file.close()
    """ | ${__REMEDIATE_PYTHON}
            chmod ${permissions} "${firefox_dir}/${firefox_cfg}"
        fi
    done

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.