Managing Safari Extensions

[JPDyson]

Looking for your input on a request we have to manage Safari Extensions, specifically to block unwanted Extensions. Best I can tell, there's not a native/supported way to do this, so it's DIY. For now, I could remove & notify, but that doesn't quite satisfy the requirement.

Ideas/experiences?

[RobertHammen]

All I can think of is a LaunchAgent/script combo to check the users' ~/Library/Safari/Extensions folder and remove unwanted ones.

[JPDyson]

^Essentially, yeah. I was hoping I'd missed something far more elegant.

[RobertHammen]

No equivalent to CCK that I'm aware of - anything to restict extensions via MCX (which you could do by config profile)?

[rtrouton]

Now that Safari extensions have moved into the user's keychain (see https://macmule.com/2014/10/15/deploying-installing-safari-extensions-on-safari-6-1-7-2/ ), this task may be unmanageable.

[mm2270]

Are you looking only to block certain Extensions, or any of them from being installed? I'm guessing from what you wrote that you meant only certain ones. If its the latter, there are some kludgy ways to stop any from being installed at all. If its the former you want, your options are limited, almost non existent. The LaunchAgent recommended is probably the only way.

[JPDyson]

@rtrouton Wackadoodle, indeed. However, I'll need to do some more testing around how this breaks the design. Keychain holds the metadata (formerly in plist format), but the bits haven't moved. I'm curious to see how this plays out with extensions being "installed" per Keychain, but missing the requisite bundle.

[JPDyson]

FYI, if root rm's the bundle, the extension is gone on the next launch of Safari.

[bentoms]

@JPDyson nice find.

Alternatively, I have a key that enables extensions.. You might be able to set this to disable extensions too.

https://macmule.com/2012/07/31/enabling-extensions-in-safari-5-x-6-x/

[acdesigntech]

we're disabling extensions using that key too, @bentoms. The only icky thing I've noticed is that the user can still re-enable extensions for the duration of their login session, even when using this as a forced config profile.

[bentoms]

FWIW, Apple have changed how extensions can be installed.. Instead they are put into the users keychain: https://macmule.com/2014/10/15/deploying-installing-safari-extensions-on-safari-6-1-7-2/

That might be a route to clear extensions, else extensions are kept in ~/Library/Safari/Extensions/ once they are installed. So you could maybe locked down that folder too.

[TJseixas]

@JPDyson

I have the same problem, can you share your solution here?

[daniel_ross]

Ditto here would love to see if this solution still works!