New issue
Advanced search Search tips

Issue 819704 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Feature



Sign in to add a comment

Feature: Provide ability to block extensions by category

Reported by daniel.g...@gmail.com, Mar 7 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36

Steps to reproduce the problem:
1. Chrome Enterprise Policies only allow blocking extensions by ID.
2. 
3. 

What is the expected behavior?
Feature: Allow Enterprise Admins ability to block extensions by category. 

What went wrong?
Currently, it is impossible for an enterprise to block all VPN extensions without a blacklist-all > whitelist-some approach.

Did this work before? No 

Chrome version: 64.0.3282.186  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: 

Extension Category for VPN apps would be very useful
 
Cc: pastarmovj@chromium.org
Labels: -Type-Bug Type-Feature
Status: Untriaged (was: Unconfirmed)
Status: WontFix (was: Untriaged)
we recently added much more fine grained control for extensions with the ExtensionSettings policy https://www.chromium.org/administrators/policy-list-3#ExtensionSettings (more details here https://www.chromium.org/administrators/policy-list-3/extension-settings-full ). It allows you to filter extensions by permissions for example which should allow you to achieve what you need. In your case simply blacklist all extensions that need the "vpnProvider" API and you should be safe. You can still selectively whitelist VPN extensions you require in your company.
Thank you - Is there a solution relevant to Chrome Browser on Windows? It seems that the vpnProvider API is only relevant for Chrome OS, so Chrome Extensions for Browser don't need to implement that API.  

Otherwise, this would be exactly what I am looking for.
I would guess that a vpn like extension on Windows will need at least the 
"proxy" permission to set the browser to make requests through its tunnel so blocking this API should be sufficient. If not you can share a particular extension you have in mind that needs to be blocked and this should help figure out what else permissions might need to be limited.
Yes! - pastarmovj@chromium.org - proxy setting working perfectly.  I looked for that yesterday but somehow missed it.  Sorry, but thanks for your assistance!

HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionSettings (Reg_SZ)> {"*":{"blocked_permissions": ["proxy"], "installation_mode":"blocked}}

Sign in to add a comment