Skip to content

Commit 82f0c43

Browse files
bsmthbsmth
authored
feat: Add localnetworkaccess policy (#67)
* feat: Add localnetworkaccess policy * Apply suggestion from review * feat(docs): Add changelog entry * Apply suggestions from code review Co-authored-by: Brian Smith <brian@smith.berlin>
1 parent 9be3326 commit 82f0c43

2 files changed

Lines changed: 171 additions & 0 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@
2323
- `Sync` policy [#70](https://github.com/mozilla/enterprise-admin-reference/pull/70)
2424
- `CrashReportsSubmit` policy: Configure crash report submission settings. [#86](https://github.com/mozilla/enterprise-admin-reference/pull/86)
2525

26+
## fx-150.0.0
27+
28+
### Added
29+
30+
- `LocalNetworkAccess`: Configure local network access security features. ([#67](https://github.com/mozilla/enterprise-admin-reference/pull/67))
31+
2632
## fx-148.0.0
2733

2834
### Added

‎src/content/docs/reference/policies/LocalNetworkAccess.mdx‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
---
2+
title: "LocalNetworkAccess"
3+
description: "Configure local network access security features."
4+
category: "Network security"
5+
---
6+
7+
Configure local network access security features.
8+
The `LocalNetworkAccess` policy controls Firefox's behavior when websites attempt to access local network resources (localhost and local network addresses).
9+
10+
**Compatibility:** Firefox 150\
11+
**CCK2 Equivalent:** N/A\
12+
**Preferences Affected:** `network.lna.enabled`, `network.lna.block_trackers`, `network.lna.blocking`, `network.lna.skip-domains`
13+
14+
## Values
15+
16+
- `Enabled`: a Boolean that enables or disables the policy.
17+
- When `true` (default), Firefox enforces local network access security checks.
18+
This is the base flag without which none of the local network access checks below would be enforced.
19+
- When `false`, all local network access checks are disabled and websites can freely access local network resources.
20+
- `BlockTrackers`: a Boolean that controls blocking third-party trackers. When `true`, third-party trackers are directly blocked from accessing localhost and local network resources.
21+
This is an experimental feature that helps prevent tracking scripts from scanning your local network.
22+
- `EnablePrompting`: a Boolean to gate user permission prompts.
23+
When `true`, access to local network resources will be explicitly gated via user permission prompts.
24+
Users will be asked to grant permission before a website can access local resources.
25+
- `SkipDomains`: an array of domain names for which local network access checks should be skipped. This allows administrators to create exceptions for trusted domains.
26+
- `Locked`: if set to true, users cannot change the local network access settings.
27+
28+
## Description
29+
30+
When providing a list of exceptions for trusted domains, the `SkipDomains` array can contain both **source domains** (the website making the request) and **target domains** (the local resource being accessed).
31+
32+
When a **source domain** is listed, that website is allowed to access local network resources without restrictions.
33+
For example, if `"trusted-app.example.com"` is listed, that website can freely make requests to any local network resources.
34+
35+
When a **target domain** is listed, any website can access that specific local network resource without restrictions.
36+
For example, if `"printer.local"` is listed, all websites can access the printer device.
37+
38+
Suffix wildcard patterns for are supported using the `*.` prefix to match all subdomains:
39+
40+
- `"*.company.com"` - Skips checks for all subdomains of company.com (matches `app.company.com`, `portal.company.com`, etc.).
41+
- `"*.internal"` - Skips checks for all .internal domains (matches `device.internal`, `printer.internal`, etc.).
42+
- `"web-app.example.com"` - Skips checks for this specific domain only (no subdomain matching).
43+
- `"*.devices.local"` - Allows access to all local devices with `.devices.local` suffix (`printer.devices.local`, `scanner.devices.local`, etc.).
44+
- `"*.corp.internal"` - Allows access to all corporate internal domains.
45+
46+
#### Windows (GPO)
47+
48+
```
49+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Enabled = 0x1 | 0x0
50+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\BlockTrackers = 0x1 | 0x0
51+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\EnablePrompting = 0x1 | 0x0
52+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "intranet.company.com"
53+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\2 = "*.devices.local"
54+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\3 = "*.corp.internal"
55+
Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Locked = 0x1 | 0x0
56+
```
57+
58+
#### Windows (Intune)
59+
60+
OMA-URI:
61+
62+
```
63+
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_Enabled
64+
```
65+
66+
Value (string):
67+
68+
```
69+
<enabled/> or <disabled/>
70+
```
71+
72+
OMA-URI:
73+
74+
```
75+
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_BlockTrackers
76+
```
77+
78+
Value (string):
79+
80+
```
81+
<enabled/> or <disabled/>
82+
```
83+
84+
OMA-URI:
85+
86+
```
87+
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_EnablePrompting
88+
```
89+
90+
Value (string):
91+
92+
```
93+
<enabled/> or <disabled/>
94+
```
95+
96+
OMA-URI:
97+
98+
```
99+
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_SkipDomains
100+
```
101+
102+
Value (string):
103+
104+
```
105+
<enabled/>
106+
<data id="LocalNetworkAccess_SkipDomains" value="1&#xF000;intranet.company.com&#xF000;2&#xF000;*.devices.local&#xF000;3&#xF000;*.corp.internal"/>
107+
```
108+
109+
OMA-URI:
110+
111+
```
112+
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_Locked
113+
```
114+
115+
Value (string):
116+
117+
```
118+
<enabled/> or <disabled/>
119+
```
120+
121+
#### macOS
122+
123+
```
124+
<dict>
125+
<key>LocalNetworkAccess</key>
126+
<dict>
127+
<key>Enabled</key>
128+
<true/> | <false/>
129+
<key>BlockTrackers</key>
130+
<true/> | <false/>
131+
<key>EnablePrompting</key>
132+
<true/> | <false/>
133+
<key>SkipDomains</key>
134+
<array>
135+
<string>intranet.company.com</string>
136+
<string>*.devices.local</string>
137+
<string>admin-portal.enterprise.com</string>
138+
<string>*.corp.internal</string>
139+
</array>
140+
<key>Locked</key>
141+
<true/> | <false/>
142+
</dict>
143+
</dict>
144+
```
145+
146+
#### policies.json
147+
148+
```
149+
{
150+
"policies": {
151+
"LocalNetworkAccess": {
152+
"Enabled": true | false,
153+
"BlockTrackers": true | false,
154+
"EnablePrompting": true | false,
155+
"SkipDomains": [
156+
"intranet.company.com",
157+
"*.devices.local",
158+
"admin-portal.enterprise.com",
159+
"*.corp.internal"
160+
],
161+
"Locked": true | false
162+
}
163+
}
164+
}
165+
```

0 commit comments

Comments
 (0)