Implement DisableAppUpdate policy to prevent Firefox from automatically updating during a measurement

[gunesacar]

I found out that local Firefox binary in the OpenWPM/firefox-bin directory was updated from ESR52.9.0 to ESR60.0.5 during a large scale crawl that I was running. The update occurred during a reboot, which is triggered by the OpenWPM itself.

Here are the logs from the firefox-bin/updates directory; the mtime of these log files matches that of reboot:

backup-update.log

Performing a staged update
PATCH DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin/updates/0
INSTALLATION DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin
WORKING DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin/updated
ensure_copy_recursive: path doesn't exist: /home/ubuntu/openwpm-census/OpenWPM/firefox-bin/chrome.manifest, rv: -1, err: 2
calling QuitProgressUI

last-update.log

PATCH DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin/updates/0
INSTALLATION DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin
WORKING DIRECTORY /home/ubuntu/openwpm-census/OpenWPM/firefox-bin
UPDATE TYPE complete
PREPARE REMOVEFILE updater.ini
PREPARE REMOVEFILE updater
PREPARE REMOVEFILE run-mozilla.sh
PREPARE REMOVEFILE removed-files
[...]

So, on every OS reboot, there's a risk of silently updating to an ESR version that is incompatible with OpenWPM. After the update, all new browser spawns started to fail, effectively stalling the crawl.

Could there be a way to turn off these updates?

I wonder if commenting the ACCEPTED_MAR_CHANNEL_IDS line in update-settings.ini could help or not:

; If you modify this file updates may fail.
; Do not modify this file.

[Settings]
ACCEPTED_MAR_CHANNEL_IDS=firefox-mozilla-esr

[turban1988]

I experienced the update issue as well (multiple times).

[gunesacar]

It looks like app.update.enabled is not honored anymore: https://bugzilla.mozilla.org/show_bug.cgi?id=1420514

For Firefox 60+, DisableAppUpdate policy can be used to disable updates. Until OpenWPM moves to ESR60, I'm going to try increasing app.update.interval and disabling app.update.doorhanger (as described in this comment) to prevent auto updates.

[englehardt]

Thanks! We'd gladly accept a PR against master to help those still using the 52 branch. We're likely going to be iterating on the FF 60 support in a separate branch until we're able to iron out some bugs.

[gunesacar]

Increasing the update interval and disabling the update doorhanger didn't help either. The local firefox binary was updated again during a subsequent reboot.

For the record, my changes were in optimize_prefs in automation/DeployBrowsers/configure_firefox.py:

+    fo.set_preference("app.update.interval", 2592000)  # browser
+    fo.set_preference("app.update.doorhanger", False)  # browser

To solve this at the DNS level, I redirected aus5.mozilla.org to 127.0.0.1 in /etc/hosts. I'll keep you posted.

[englehardt]

@gunesacar would you mind to try setting app.update.auto to False? Apparently this means updates will be downloaded automatically, but will not be installed unless the user triggers them.

[gunesacar]

OK, I added this pref and removed the redirection in /etc/hosts. Will share the results.

[gunesacar]

Nope, Firefox was updated again. I'll go back to DNS-level blacklisting.

[englehardt]

Renaming now that we're past Firefox 60