New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 822088 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 2
Type: Bug



Sign in to add a comment

DeveloperToolsDisabled policy can be bypassed with --remote-debugging-port flag.

Project Member Reported by dpa...@chromium.org, Mar 15 2018

Issue description

Repro (only tried Linux):

1) Disable DevTools via policy https://www.chromium.org/administrators/policy-list-3#DeveloperToolsDisabled.
2) Launch chrome with --remote-debugging-port=9222
3) Open a new tab and navigate on any website.
4) Launch a different Chrome instance (specifically one without the policy)
5) Go to chrome://inspect/#devices
6) Find the entry corresponding to the Chrome instance from 2 and click Inspect.

Expected:
DevTools should not open since host instance has the policy.

Actual:
DevTools opens, ignoring the host's policy.
 

Comment 1 by dpa...@chromium.org, Mar 15 2018

Summary: DeveloperToolsDisabled policy can be bypassed with --remote-debugging-port flag. (was: DeveloperToolsDisabled can be bypassed with --remote-debugging-port flag.)
Cc: kkaluri@chromium.org pastarmovj@chromium.org
Labels: Needs-Feedback OS-Windows
Tested this issue on GPO Test environment(Windows)

Preconditions:
1. Enabled the "Disable devtools policy"
2. Updated the policy in client machine and launched chrome with --remote-debugging-port=9222


Steps Followed:
1. Confirm the devtools are disabled
2. Navigate to test url like "https://duckduckgo.com"
3. In the new tab navigate to "localhost:9222"
4. Click on the url

Observations:
I was able to inspect the test url

Attaching the screen-cast for reference.

dpapad@ Could you confirm this is the issue you are facing???


822088.mp4
2.2 MB View Download

Comment 3 by mad@chromium.org, Mar 23 2018

Owner: dpa...@chromium.org

Comment 4 by dpa...@chromium.org, Mar 23 2018

Cc: dpa...@chromium.org
Owner: ----
@kkaluri: No these are not the steps I followed and described originally.

> 3. In the new tab navigate to "localhost:9222"
> 4. Click on the url

Step 3 is not what I did. Need to go to a new chrome instance (different user-data-dir, and ensure that the policy is not applied for that instance). This can be either on the same or on a different computer entirely.
Step 4: Go to chrome://inspect, not localhost:9222.

I don't know if the steps described here are equivalent to the bug I am observing.
Cc: atwilson@chromium.org blumberg@chromium.org georgesak@chromium.org dskaram@chromium.org robertshield@chromium.org
This is interesting question - whether remote dev tools should be disabled when the policy is in effect. It sounds to me like they should but let's broadcast the question more widely.
Labels: Enterprise-Triaged
Status: Available (was: Untriaged)
Owner: blumberg@chromium.org
Blumberg - you have an opinion here? Not really a cros issue because you have to be in dev mode to enable remote debugging at which point all policies are moot.
Cc: privard@chromium.org
+privard for his input as well.

I think that request makes sense. Could we envision a scenario where an admin would like to disable dev tools but keep the remote (maybe there is a valid usecase for that?). In which case, maybe a separate policy for the remote debugging is more appropriate.
Owner: georgesak@chromium.org
Status: Assigned (was: Available)
Labels: Hotlist-Enterprise-Fixit
Cc: nicolaso@chromium.org

Sign in to add a comment