Create group policy options for Shields #25394

spylogsster · 2022-09-14T05:44:49Z

Description

Add group policy support for Shields (up/down). This will support individual URLs and patterns

Added BraveShieldsDisabledForUrls to disable shields urls
Added BraveShieldsEnabledForUrls to enable shields urls

For the design, see Figma:
https://www.figma.com/file/3A6F6VrxVahiZFxLr7j7FO/Desktop-Shields?node-id=2695%3A49651

Behavior notes

This is an overview of what the user should expect when the policy is set.

Behavior when DISABLED

When the site being visited matches the URL or the pattern:

shields should be DISABLED
when clicking shields (to open advanced panel), person should see shields disabled
shields itself should NOT be toggleable
the other settings will never show up because shields are down

Behavior when ENABLED

When the site being visited matches the URL or the pattern:

shields should be ENABLED
when clicking shields (to open advanced panel), person should see shields enabled
shields itself should NOT be toggleable (should be grayed out)
none of the sub-values (block ads, https upgrade, block script, block fingerprint, block cookie) should be toggleable. It should be grayed out.

Example of how to add the group policy (Windows)

Open regedit.exe
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Create the key (folders) BraveSoftware\Brave\ if they don't already exist

How to add the shields DISABLE policy

Create a new key (folder) BraveShieldsDisabledForUrls inside the root (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave\)
You can now add REG_SZ (string value) for any sites you wish to mark as disabled.

The entries need to created in a numbered fashion. Let's say you want to add two values. You would create:

REG_SZ value 1 set to https://www.example.com
REG_SZ value 2 set to [*.]brave.com

This would DISABLE shields on brave.com and all subdomains. It would also DISABLE shields on https://www.example.com - but NOT on other subdomains (or if you leave www. out for example).

How to add the shields ENABLE policy

Create a new key (folder) BraveShieldsEnabledForUrls inside the root (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave\)
You can now add REG_SZ (string value) for any sites you wish to mark as enabled.

The entries need to created in a numbered fashion. Let's say you want to add two values. You would create:

REG_SZ value 1 set to [*.]twitter.com
REG_SZ value 2 set to https://www.example.com

This would ENABLE shields on brave.com and all subdomains. It would also ENABLE shields on https://www.example.com - but NOT on other subdomains (or if you leave www. out for example).

Adding using a `.reg` file (also on Windows)

Create a new empty file called shields-policy.reg
Open it in Notepad and put this for the content:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave\BraveShieldsEnabledForUrls]
"1"="[*.]twitter.com"
"2"="https://www.example.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave\BraveShieldsDisabledForUrls]
"1"="https://www.example.com"
"2"="[*.]brave.com"

Save the file and close it
Double click the shields-policy.reg file
You can use regedit.exe to confirm it was added

Test plan

Go through above - download/run the registry key.
Verify that

install is showing as managed (in hamburger menu)
behavior matches expected behavior above

The text was updated successfully, but these errors were encountered:

bridiver · 2022-10-25T02:03:45Z

what should actually display in the shields popup when shields is enabled/disabled by policy? How are we displaying to the user that shields is managed and cannot be changed there? This ticket needs more detail for review and QA

spylogsster · 2022-10-25T08:20:56Z

@bridiver there is follow up (with picture) to add a tooltip for this case #26187

LaurenWags · 2022-12-02T13:39:42Z

@spylogsster @bsclifton

Is this only for Windows, or is this applicable to macOS and Linux as well? Only Windows is mentioned in #25394 (comment).

If this is only for Windows, please add OS/Windows label.

If this is applicable for macOS and Linux as well, please add instructions on how to enable on those OSes also.

Labelling as QA/Blocked until the above is sorted out.

cc @kjozwiak @rebron

bsclifton · 2022-12-05T07:03:08Z

This is available on macOS and Linux - but I'm not sure offhand how to test actually. Let me dig in on that and then I'll share an update

bsclifton · 2022-12-05T07:24:08Z

Example of how to add the group policy (macOS)

You can set via the command line. Here's a general example for EnableSha1ForLocalAnchors in Chrome:
defaults write com.google.Chrome EnableSha1ForLocalAnchors -bool true

For Brave, you'd use a bundle ID of com.brave.Browser, com.brave.Browser.beta, or com.brave.Browser.nightly (depending on your channel.
The key names are BraveShieldsDisabledForUrls and BraveShieldsEnabledForUrls which are array types
The value would be an array of strings (example using XML; actual syntax is different)

    <array>
      <string>[*.]twitter.com</string>
      <string>https://www.example.com</string>
    </array>

Example of how to enable shields for a list of origins

Run the following from command line:

defaults write com.brave.Browser BraveShieldsEnabledForUrls -array "[*.]twitter.com" "https://www.example.com"

Load Brave; verify it shows under brave://policy/

Example of how to disable shields for a list of origins

Run the following from command line:

defaults write com.brave.Browser BraveShieldsDisabledForUrls -array "https://www.example.com/" "[*.]brave.com"

Load Brave; verify it shows under brave://policy/

bsclifton · 2022-12-05T07:34:53Z

Example of how to add the group policy (Linux)

You can set the options via /etc/brave/policies/managed

Basically, you will make a file with JSON matching the keys/values you'd like to set. Full overview here:
https://source.chromium.org/chromium/chromium/src/+/main:docs/website/site/administrators/linux-quick-start/index.md

Example of how to enable shields for a list of origins

create a file

vim /etc/brave/policies/managed/shields_enabled_policy.json

paste in:

{
    "BraveShieldsEnabledForUrls": [
        "[*.]twitter.com",
        "https://www.example.com"
    ]
}

Save the file and exit (escape; :wq, enter)
Load Brave; verify it shows under brave://policy/
Delete the file after testing is complete

Example of how to disable shields for a list of origins

create a file

vim /etc/brave/policies/managed/shields_disabled_policy.json

paste in:

{
    "BraveShieldsDisabledForUrls": [
        "https://www.example.com",
        "[*.]brave.com"
    ]
}

Save the file and exit (escape; :wq, enter)
Load Brave; verify it shows under brave://policy/
Delete the file after testing is complete

LaurenWags · 2022-12-05T13:52:36Z

thanks @bsclifton!

btlechowski · 2022-12-06T13:11:05Z

Verification passed on

Brave	1.47.115 Chromium: 108.0.5359.94 (Official Build) beta (64-bit)
Revision	713576b895246504ccc6b92c2fb8ce2d60194074-refs/branch-heads/5359_71@{#3}
OS	Windows 10 Version 21H2 (Build 19044.2251)

Verified test plan from the description

DISABLE policy

Verified Brave is shown as managed in hamburger menu

Verified Brave Shields are disabled by default for the disabled page

Verified unable to enable Brave Shields for disabled page

ENABLE policy

Verified Brave is shown as managed in hamburger menu

Verified Brave Shields are enabled by default for the enabled page

Verified unable to disable Brave Shields for enabled page

ENABLE & DISABLE policy for the same domain

Verified the policies have 'OK' status

Verified Brave Shields enabled policy takes precedent over disabled policy

Wildcard policy

Policy used:

Verified policy was applied to https://www.example.com

Verified policy was applied to https://example.com

btlechowski · 2022-12-08T22:22:35Z

Verification passed on

Brave	1.47.115 Chromium: 108.0.5359.94 (Official Build) beta (64-bit)
Revision	713576b895246504ccc6b92c2fb8ce2d60194074-refs/branch-heads/5359_71@{#3}
OS	Ubuntu 18.04 LTS

Verified test plan from the description

DISABLE policy

Verified Brave is shown as managed in hamburger menu

Verified Brave Shields are disabled by default for the disabled page

Verified unable to enable Brave Shields for disabled page

ENABLE policy

Verified Brave is shown as managed in hamburger menu

Verified Brave Shields are enabled by default for the enabled page

Verified unable to disable Brave Shields for enabled page

ENABLE & DISABLE policy for the same domain

Verified the policies have 'OK' status

Verified Brave Shields enabled policy takes precedent over disabled policy

Wildcard policy

Policy used:

Verified policy was applied to https://www.example.com

Verified policy was applied to https://example.com

stephendonner · 2022-12-20T23:28:07Z

Verification `IN-PROGRESS` using

Brave	1.47.136 Chromium: 108.0.5359.128 (Official Build) beta (x86_64)
Revision	1cd27afdb8e5d057070c0961e04c490d2aca1aa0-refs/branch-heads/5359@{#1185}
OS	macOS Version 11.7.2 (Build 20G1020)

NOTE: Ran the following in-between tests, to clean up the keys:

defaults delete com.brave.Browser

Case 1: Disable policy - `PASSED`

installed 1.47.136
ran the following snippets from the commandline/Terminal window:

defaults write com.brave.Browser BraveShieldsDisabledForUrls -array "https://www.example.com/" "https://brave.com"

launched Brave
clicked on the "hamburger" menu
confirmed This browser is managed by your organization message on the bottom
opened brave://policy
confirmed BraveShieldsDisabledForUrls entry with correct domains
loaded https://www.example.com
confirmed Shields were disabled by default
loaded brave.com
confirmed Shields were disabled by default

steps 5 + 7	step 8+9	steps 10 + 11

Case 2: Enable policy - `PASSED`

installed 1.47.136
launched Brave
loaded https://twitter.com
disabled Shields via the toggle
loaded https://www.example.com
disabled Shields via the toggle
quit Brave
ran the following from the commandline:

defaults write com.brave.Browser BraveShieldsEnabledForUrls -array "https://twitter.com" "https://www.example.com"

relaunched Brave
loaded https://twitter.com
confirmed Shields were enabled
loaded https://www.example.com
confirmed Shields were enabled
confirmed entry in brave://policy

step 4	step 6	step 8	step 11	step 13	step 14

Case 3: Enable & disable policy for the same domain - `PASSED`

installed 1.47.136
launched Brave
ran:

defaults write com.brave.Browser BraveShieldsEnabledForUrls -array "https://twitter.com" "https://www.example.com"

ran:

defaults write com.brave.Browser BraveShieldsDisabledForUrls -array "https://twitter.com" "https://www.example.com"

opened brave://policy
loaded https://twitter.com
confirmed Shields were still set to enabled
loaded https://www.example.com
confirmed Shields were still set to enabled

steps 3-4	step 6	step 8	step 10

Case 4: Wildcard policy - `FAILED`

installed 1.47.136
ran:

defaults write com.brave.Browser BraveShieldsDisabledForUrls -array "https://www.example.com/" "[*.]brave.com"

Encountered:

Brave shields toggler is not locked on macos #27691

spylogsster added the OS/Desktop label Sep 14, 2022

spylogsster self-assigned this Sep 14, 2022

bsclifton added feature/shields The overall Shields feature in Brave. QA/Yes release-notes/include enterprise labels Sep 14, 2022

spylogsster added this to the 1.46.x - Nightly milestone Oct 10, 2022

spylogsster mentioned this issue Oct 11, 2022

Added BraveShieldsDisabledForUrls and BraveShieldsEnabledForUrls policies brave/brave-core#15409

Merged

25 tasks

bsclifton changed the title ~~Create policy options for Shields~~ Create group policy options for Shields Oct 25, 2022

mherrmann mentioned this issue Nov 3, 2022

Make Brave-specific options configurable through Windows Group Policy templates #26502

Open

spylogsster closed this as completed in brave/brave-core#15409 Nov 8, 2022

bsclifton added the QA/Test-Plan-Specified label Nov 9, 2022

bsclifton modified the milestones: 1.46.x - Beta, 1.47.x - Nightly Nov 9, 2022

LaurenWags added the QA/Blocked label Dec 2, 2022

LaurenWags added QA/Test-All-Platforms and removed QA/Blocked labels Dec 5, 2022

btlechowski added the QA Pass-Win64 label Dec 6, 2022

btlechowski added the QA Pass-Linux label Dec 8, 2022

stephendonner added the QA/In-Progress Indicates that QA is currently in progress for that particular issue label Dec 20, 2022

stephendonner added QA Pass-macOS and removed QA/In-Progress Indicates that QA is currently in progress for that particular issue labels Jan 9, 2023

LaurenWags mentioned this issue Jan 11, 2023

Desktop Release Notes for 1.47.x - Release #27744

Closed

spylogsster mentioned this issue Jun 26, 2023

Shields Up section in Shields Status settings page should not exist #31230

Closed

bsclifton mentioned this issue Dec 13, 2023

Add a "Disable autoupdate" feature (disable updates) #32648

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create group policy options for Shields #25394

Create group policy options for Shields #25394

spylogsster commented Sep 14, 2022 •

edited by bsclifton

Loading

bridiver commented Oct 25, 2022

spylogsster commented Oct 25, 2022

LaurenWags commented Dec 2, 2022

bsclifton commented Dec 5, 2022

bsclifton commented Dec 5, 2022 •

edited

Loading

bsclifton commented Dec 5, 2022 •

edited

Loading

LaurenWags commented Dec 5, 2022

btlechowski commented Dec 6, 2022 •

edited

Loading

btlechowski commented Dec 8, 2022

stephendonner commented Dec 20, 2022 •

edited

Loading

Create group policy options for Shields #25394

Create group policy options for Shields #25394

Comments

spylogsster commented Sep 14, 2022 • edited by bsclifton Loading

Description

Behavior notes

Behavior when DISABLED

Behavior when ENABLED

Example of how to add the group policy (Windows)

How to add the shields DISABLE policy

How to add the shields ENABLE policy

Adding using a .reg file (also on Windows)

Test plan

bridiver commented Oct 25, 2022

spylogsster commented Oct 25, 2022

LaurenWags commented Dec 2, 2022

bsclifton commented Dec 5, 2022

bsclifton commented Dec 5, 2022 • edited Loading

Example of how to add the group policy (macOS)

Example of how to enable shields for a list of origins

Example of how to disable shields for a list of origins

bsclifton commented Dec 5, 2022 • edited Loading

Example of how to add the group policy (Linux)

Example of how to enable shields for a list of origins

Example of how to disable shields for a list of origins

LaurenWags commented Dec 5, 2022

btlechowski commented Dec 6, 2022 • edited Loading

DISABLE policy

ENABLE policy

ENABLE & DISABLE policy for the same domain

Wildcard policy

btlechowski commented Dec 8, 2022

DISABLE policy

ENABLE policy

ENABLE & DISABLE policy for the same domain

Wildcard policy

stephendonner commented Dec 20, 2022 • edited Loading

Verification IN-PROGRESS using

NOTE: Ran the following in-between tests, to clean up the keys:

Case 1: Disable policy - PASSED

Case 2: Enable policy - PASSED

Case 3: Enable & disable policy for the same domain - PASSED

Case 4: Wildcard policy - FAILED

Encountered:

spylogsster commented Sep 14, 2022 •

edited by bsclifton

Loading

Adding using a `.reg` file (also on Windows)

bsclifton commented Dec 5, 2022 •

edited

Loading

bsclifton commented Dec 5, 2022 •

edited

Loading

btlechowski commented Dec 6, 2022 •

edited

Loading

stephendonner commented Dec 20, 2022 •

edited

Loading

Verification `IN-PROGRESS` using

Case 1: Disable policy - `PASSED`

Case 2: Enable policy - `PASSED`

Case 3: Enable & disable policy for the same domain - `PASSED`

Case 4: Wildcard policy - `FAILED`