View source for Bug 394984: Elevated updates on OSX

'''== Warning =='''
'''The information below is a draft and is superseded by https://mana.mozilla.org/wiki/pages/viewpage.action?pageId=40044185, which describes the end-to-end solution.'''








=== Description of the problem ===
At present (8/2015), Firefox is installed by dragging and dropping the Firefox.app bundle from a .dmg to the a directory on the local system (typically /Applications). By doing so, the ownership of the Firefox.app bundle is set to <username>:staff with permissions drwxr-xr-x. In the event that a different admin user attempts to update Firefox, the update will fail to apply because the user does not have the necessary ownership/permissions to write to the Firefox.app bundle.

=== Proposed solution ===
# Write a new binary that will be used as Privileged Helper Tool on OSX. The only functionality in this binary will be to recursively set group ownership of a directory to "wheel" (aka "root" or "admin") and recursively set "write" permission for the group on said directory after proper elevation.
# In the event that the updater is unable to write to the Firefox.app directory (bug 394984), launch the Privileged Helper Tool.
# Privileged Helper Tool prompts for administrative username and password to run as root.
# If credentials were entered correctly, the Privileged Helper Tool will change the group ownership to "wheel" and add write permission for the group recursively on the Firefox.app bundle as follows:
<username>:'''<big>wheel</big>''' drwxr'''<big>w</big>'''xr-x
# If the ownership and permissions were set successfully, the regular (unelevated) update proceeds.
# Future updates will no longer require the Privileged Helper Tool, unless ownership and/or permissions have changed in such a way that it is needed again.

If the user was unable to enter admin credentials, or if the new ownership/permissions couldn't be set successfully, the update will fail and we will increment a counter in the user's profile. Once a threshold is hit, we will no longer attempt to stage an update and will direct the user to our website for a manual install (existing workflow).

=== FAQ ===
====== '''What's the risk of these additional permissions and/or the new group ownership if Firefox gets owned?''' ======

The new proposal calls for setting the group ownership of Firefox to "wheel" and adding "write" permission for this group. Due to the fact that:
# only an administrator can grant these additional permissions
# the additional permissions are restricted to administrators
# any administrator could already set these additional permissions manually
# most apps installed via a .pkg installer (instead of a .dmg like Firefox) already set these same permissions on their apps
# most users "own" Firefox.app because they installed it, so they already have rwx permissions
there shouldn't be any additional risk in the case that Firefox gets owned.

====== '''What happens when Firefox is updated?''' ======

The ownership/permissions for new or changed files should be inherited from the main Firefox.app bundle, i.e. <username>:wheel and rwxrwxr-x (for executable files) or rw-rw-r--.