Policies¶

Linux¶

Policies on Linux can vary in location, typically browsers will have their own directories under which to place policy files.

Policies for vanilla Chromium, on most systems, will be located at /etc/chromium/policies/managed/ for mandatory policies and /etc/chromium/policies/recommended/ for recommended policies. Most policies must go in the managed directory, but some can go into recommended, these policies can be overridden in the user preferences. Policies that can be recommended will be labeled as such. Google Chrome policies will be located at /etc/opt/chrome/policies/ with identical folders for mandatory and recommended policies.

The structure of Linux policy files is standard json with each policy represented as a string and its associated value. See below (this is just an example policy, it will not do anything):

{
  "PolicyString": "string_value",
  "PolicyBoolean": true,
  "PolicyInteger": 22,
  "PolicyArray": ["array", "input"],
  "PolicyDictionary": { "BooleanEntry": false, "StringEntry": "dictionary_string", "DictionaryEntry": { "TestEntry": 0 } }
}

Windows¶

Windows policies rely on using the registry. Most browsers, similar to Linux, have different locations for their policies. Google Chrome will use policies from HKEY_LOCAL_MACHINE/SOFTWARE/Policies/Google/Chrome.

To add a policy, you need to make sure to add the right value type. Most often, there are only 2 reg values used, string value and DWORD (32-bit).

For any instance of a boolean value (true or false), use a DWORD and set it to 1 for true and 0 for false. The result under the Data column should look like 0x00000001 or 0x00000000 for true and false respectively.

Any policy using an integer (1, 2, 5, etc.), use a DWORD and set the value to that number. It should look similar to a boolean policy in the Data column but with the number you used at the end.

For strings, just enter them directly without quotes. For example, the policy HttpsOnlyMode has the string value force_enable, enter that as it is. Do not enter "force_enable", it will not work.

Policy arrays and dictionaries also use the string values, they have the same formatting as presented, nothing special.

MacOS¶

Policies for Mac are similar to Linux in the sense that they are formatted files located in a global config directory. Instead of JSON, MacOS uses plist (XML formatted) files to handle prefs and policies.

Aa far as I can tell, mandatory policies always go under /Library/Managed Preferences/ and recommended go under /Library/Preferences/. The variance between browsers would be the file names, since they are related to the application identifier.

For Google Chrome, to apply policies, create a file com.google.Chrome.plist in the respective directory, i.e. managed or recommended. Then add policies in the proper formatting (see below).

MacOS policies follow this format (this policy do nothing, they just demonstrate how to format each policy value type):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>PolicyString</key>
    <string>string_value</string>
    <key>PolicyBoolean</key>
    <true />
    <key>PolicyInteger</key>
    <integer>2</integer>
    <key>PolicyArray</key>
    <array>
      <string>string_value1</string>
      <string>string_value2</string>
    </array>
    <key>PolicyDictionary</key>
    <dict>
      <key>BooleanEntry</key>
      <false />
      <key>StringEntry</key>
      <string>dictionary_string</string>
      <keyDictionaryEntry</key>
      <dict>
        <key>TestEntry<key>
        <integer>0</integer>
      </dict>
    </dict>
  </dict>
</plist>

Persisting Flags¶

explorer.exe "C:Program FilesGoogleChromeApplicationchromewrapper.bat"