Skip to content

Harden macOS uninstall script #404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
metsma wants to merge 1 commit into
base: main
Choose a base branch
from
+48 −8
Open

Harden macOS uninstall script #404

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions debian/web-eid-firefox.postrm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ if [ ! -f ${POLICIES}/policies.json ]; then
else
JQARGS=${POLICIES}/policies.json;
fi
# Block the extension so it can't be reinstalled from AMO without the native app, avoiding a
# dangling, non-functional extension. Reinstalling web-eid-firefox overwrites this back to
# "normal_installed" (see debian/web-eid-firefox.postinst), so this is not a permanent block.
jq '.policies.ExtensionSettings["{e68418bc-f2b0-4459-a9ea-3e72b6751b07}"] = {"installation_mode": "blocked"}' ${JQARGS} > ${POLICIES}/policies.tmp
mv ${POLICIES}/policies.tmp ${POLICIES}/policies.json

Expand Down
31 changes: 25 additions & 6 deletions install/uninstall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,30 @@
#!/bin/bash

set -euo pipefail

echo "This will remove Web eID and its browser integration files. Administrator" \
"privileges are required."
read -r -p "Continue? [y/N] " confirm
case "${confirm}" in
[yY]|[yY][eE][sS]) ;;
*) echo "Aborted."; exit 1 ;;
esac

# Prompt for the admin password once up front; the sudo calls below reuse this ticket.
sudo -v

sudo rm -rf \
/Applications/Utilities/web-eid.app \
/Applications/Utilities/web-eid-safari.app \
/Library/Google/Chrome/NativeMessagingHosts/eu.webeid.json \
/Library/Application\ Support/Mozilla/NativeMessagingHosts/eu.webeid.json \
/Library/Application\ Support/Google/Chrome/External\ Extensions/ncibgoaomkmdpilpocfeponihegamlic.json
"/Applications/Utilities/web-eid.app" \
"/Applications/Utilities/web-eid-safari.app" \
"/Library/Google/Chrome/NativeMessagingHosts/eu.webeid.json" \
"/Library/Application Support/Mozilla/NativeMessagingHosts/eu.webeid.json" \
"/Library/Application Support/Google/Chrome/External Extensions/ncibgoaomkmdpilpocfeponihegamlic.json"

PLIST=/Library/Preferences/org.mozilla.firefox.plist
sudo defaults write ${PLIST} ExtensionSettings \
# Block the extension so it can't be reinstalled from AMO without the native app, avoiding a
# dangling, non-functional extension. Reinstalling Web eID overwrites this back to
# 'normal_installed' (see install/macos-postinstall.in), so this is not a permanent block.
sudo defaults write "${PLIST}" ExtensionSettings \
-dict-add "'{e68418bc-f2b0-4459-a9ea-3e72b6751b07}'" "{ 'installation_mode' = 'blocked'; }"

echo "Web eID has been uninstalled."
22 changes: 20 additions & 2 deletions install/web-eid.wxs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,10 @@
Condition="FIREFOXINSTALL=1 AND NOT REMOVE="ALL"" />
<Custom Action="ExtensionSettingsNoInstall" Before="InstallFinalize"
Condition="FIREFOXINSTALL=0 AND NOT REMOVE=&quot;ALL&quot;" />
<!-- ExtensionSettingsRemove blocks the extension so it can't be reinstalled from AMO
without the native app, avoiding a dangling, non-functional extension. Reinstalling
Web eID runs ExtensionSettingsInstall above, which overwrites this back to allowed, so
this is not a permanent block. -->
<Custom Action="ExtensionSettingsRemove" Before="InstallFinalize"
Condition="REMOVE=&quot;ALL&quot; AND NOT UPGRADINGPRODUCTCODE" />
</InstallExecuteSequence>
Expand Down Expand Up @@ -110,12 +114,23 @@
<RegistryValue Root="HKLM" Type="string" Name="update_url"
Key="SOFTWARE\Google\Chrome\Extensions\ncibgoaomkmdpilpocfeponihegamlic"
Value="https://clients2.google.com/service/update2/crx" />
<!-- Block chrome-token-signing extension to avoid conflicts -->
<!-- Block chrome-token-signing extension to avoid conflicts. Chromium's registry policy
loader (RegistryDict::ConvertToJSON in registry_dict.cc) only reads list-policy
entries whose value NAME is numeric (IsKeyNumeric) - non-numeric names are silently
ignored - so this can't be replaced with a collision-free unique string (e.g. a hash
of the extension ID) as one might expect. The name must stay a bare number, which
means it can theoretically collide with another vendor's installer using the same
number under this list; there's no registry-level namespacing for this policy.
Worst case on collision is that this entry is silently overwritten/ignored, i.e. the
legacy extension isn't blocked - a compatibility nicety, not a security control - so
this is accepted as-is rather than solved with a heavier enumerate-and-pick-next-free-
slot custom action. -->
<RegistryValue Root="HKLM" Type="string" Name="56791"
Key="SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
Value="ckjefchnfjhjfedoccjbhjpbncimppeg" />
</Component>
<Component Id="ChromePolicy" Transitive="yes" Condition="(CHROMEINSTALL = 1 AND CHROMEPOLICY = 1)" Bitness="always32">
<!-- Same hardcoded-numeric-name caveat as the Blocklist entry above applies here. -->
<RegistryValue Root="HKLM" Type="string" Name="56790"
Key="SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
Value="ncibgoaomkmdpilpocfeponihegamlic" />
Expand All @@ -124,12 +139,15 @@
<RegistryValue Root="HKLM" Type="string" Name="update_url"
Key="SOFTWARE\Microsoft\Edge\Extensions\gnmckgbandlkacikdndelhfghdejfido"
Value="https://edge.microsoft.com/extensionwebstorebase/v1/crx" />
<!-- Block chrome-token-signing extension to avoid conflicts -->
<!-- Block chrome-token-signing extension to avoid conflicts. Same hardcoded-numeric-name
caveat as the Chrome Blocklist entry above applies here (Edge's registry policy
loader is Chromium-derived and behaves the same way). -->
<RegistryValue Root="HKLM" Type="string" Name="56791"
Key="SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist"
Value="fofaekogmodbjplbmlbmjiglndceaajh" />
</Component>
<Component Id="EdgePolicy" Transitive="yes" Condition="(EDGEINSTALL = 1 AND EDGEPOLICY = 1)" Bitness="always32">
<!-- Same hardcoded-numeric-name caveat as the Blocklist entries above applies here. -->
<RegistryValue Root="HKLM" Type="string" Name="56790"
Key="SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
Value="gnmckgbandlkacikdndelhfghdejfido" />
Expand Down
Loading