Bug 2066822 - Enables enterprise storage encryption by default - #1345
Open
1rneh wants to merge 6 commits into
Open
Bug 2066822 - Enables enterprise storage encryption by default#13451rneh wants to merge 6 commits into
1rneh wants to merge 6 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Enables the enterprise storage encryption feature by default via a pref default change, and removes the now-redundant EnterprisePolicies surface area for the EnterpriseStorageEncryption policy.
Changes:
- Enables
security.storage.encryption.enabledby default for enterprise builds (and removes the test override that is no longer needed). - Removes the
EnterpriseStorageEncryptionpolicy from the policies schema, implementation, descriptions, and xpcshell policy tests. - Removes sample policy JSON files related to enterprise storage encryption.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| security/manager/ssl/tests/unit/test_sdr_enterprise_logout.js | Removes explicit pref override since the feature is enabled by default in targeted builds. |
| modules/libpref/init/StaticPrefList.yaml | Changes the default for security.storage.encryption.enabled (enterprise-only). |
| browser/locales/en-US/browser/enterprise/enterprise-policies-descriptions.ftl | Removes the policy description string for the deleted policy. |
| browser/components/enterprisepolicies/tests/xpcshell/test_simple_pref_policies.js | Removes the policy test case for EnterpriseStorageEncryption. |
| browser/components/enterprisepolicies/schemas/policies-schema.json | Removes the EnterpriseStorageEncryption policy schema entry. |
| browser/components/enterprisepolicies/Policies.sys.mjs | Removes the policy handler and its security-pref allowlisting entry. |
| browser/components/enterprisepolicies/helpers/sample_storage_encryption.json | Deletes the sample JSON that referenced the removed policy. |
| browser/components/enterprisepolicies/helpers/sample_enterprise_storage_encryption.json | Deletes the duplicate/alternate sample JSON that referenced the removed policy. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
lissyx
reviewed
Aug 26, 2026
lissyx
approved these changes
Aug 26, 2026
lissyx
left a comment
lissyx
left a comment
Contributor
There was a problem hiding this comment.
r=me with the suggested changes
Contributor
Author
|
@lissyx You're just too fast. I had removed the requested review just a few seconds after putting it 😄 |
- Flips security.storage.encryption.enabled to true - Removes the policy EnterpriseStorageEncryption
1rneh
force-pushed
the
bug-2066822-enterprise-encryption-default-on
branch
from
August 26, 2026 19:51
d033918 to
942e784
Compare
1rneh
force-pushed
the
bug-2066822-enterprise-encryption-default-on
branch
from
August 26, 2026 19:55
942e784 to
e699841
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
modules/libpref/init/StaticPrefList.yaml:19252
- Grammar in the pref comment: “with a enterprise console” should be “with an enterprise console”, and “console provisioned” should be hyphenated as “console-provisioned”.
# INTERNAL -- DO NOT ENABLE. Master switch for enterprise storage encryption:
# at startup the browser unlocks the internal NSS token with a enterprise console
# provisioned secret, and fails closed (force-quit) if that secret is unavailable.
# Don't enable it on unprovisioned builds.
lissyx
reviewed
Aug 27, 2026
lissyx
approved these changes
Aug 27, 2026
1rneh
force-pushed
the
bug-2066822-enterprise-encryption-default-on
branch
from
August 27, 2026 09:00
e699841 to
6b7643b
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
modules/libpref/init/StaticPrefList.yaml:19251
- Grammar in this pref comment is off: "with a enterprise console" should be "with an enterprise console" (and keeping "console-provisioned" hyphenation improves readability).
# INTERNAL -- DO NOT ENABLE. Master switch for enterprise storage encryption:
# at startup the browser unlocks the internal NSS token with an enterprise console
# provisioned secret, and fails closed (force-quit) if that secret is unavailable.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
Previously missed (1) — in code that hasn't changed since the last review.
toolkit/components/enterprise/tests/xpcshell/xpcshell.toml:4
- This xpcshell manifest only gates on
buildapp == 'browser', but the test imports and exercises enterprise-only behavior (EnterpriseStorageEncryption). On non-enterprise builds this can be inapplicable or even fail to load (depending on packaging). Consider also gating onenterpriseto avoid running it in configurations where the feature is not present.
["test_storage_encryption.js"]
run-if = ["buildapp == 'browser'"]
toolkit/components/passwordmgr/test/mochitest/mochitest.toml:432
- Typo in the skip-if comment: “primpary” → “primary”.
"enterprise", # On enterprise builds the primpary password is provisioned by the console and keeps the token logged in.
Comment on lines
13
to
20
| if ( | ||
| AppConstants.MOZ_ENTERPRISE && | ||
| Services.prefs.getBoolPref( | ||
| "security.storage.encryption.enabled", | ||
| false | ||
| ) && | ||
| !Services.felt?.isFeltUI() | ||
| Services.felt?.isFeltBrowser() | ||
| ) { | ||
| await this.load(); |
…o bug-2066822-enterprise-encryption-default-on
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bugzilla: Bug-2066822
security.storage.encryption.enabledto trueEnterpriseStorageEncryption, and since it's not consumed yet we can remove it entirely.Testing