Skip to content

Commit e5728b6

Browse files
PaulHiginPaulHigin
authored
Add WDAC Audit logging (#19641)
1 parent b69cae0 commit e5728b6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+963
-228
lines changed

‎src/Microsoft.PowerShell.Commands.Utility/commands/utility/AddType.cs‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -556,15 +556,24 @@ protected override void BeginProcessing()
556556
{
557557
// Prevent code compilation in ConstrainedLanguage mode, or NoLanguage mode under system lock down.
558558
if (SessionState.LanguageMode == PSLanguageMode.ConstrainedLanguage ||
559-
(SessionState.LanguageMode == PSLanguageMode.NoLanguage &&
560-
SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce))
559+
(SessionState.LanguageMode == PSLanguageMode.NoLanguage && SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce))
561560
{
562-
ThrowTerminatingError(
563-
new ErrorRecord(
564-
new PSNotSupportedException(AddTypeStrings.CannotDefineNewType),
565-
nameof(AddTypeStrings.CannotDefineNewType),
566-
ErrorCategory.PermissionDenied,
567-
targetObject: null));
561+
if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
562+
{
563+
ThrowTerminatingError(
564+
new ErrorRecord(
565+
new PSNotSupportedException(AddTypeStrings.CannotDefineNewType),
566+
nameof(AddTypeStrings.CannotDefineNewType),
567+
ErrorCategory.PermissionDenied,
568+
targetObject: null));
569+
}
570+
571+
SystemPolicy.LogWDACAuditMessage(
572+
context: Context,
573+
title: AddTypeStrings.AddTypeLogTitle,
574+
message: AddTypeStrings.AddTypeLogMessage,
575+
fqid: "AddTypeCmdletDisabled",
576+
dropIntoDebugger: true);
568577
}
569578

570579
// 'ConsoleApplication' and 'WindowsApplication' types are currently not working in .NET Core

‎src/Microsoft.PowerShell.Commands.Utility/commands/utility/Import-LocalizedData.cs‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
using System.IO;
88
using System.Management.Automation;
99
using System.Management.Automation.Internal;
10+
using System.Management.Automation.Security;
1011

1112
namespace Microsoft.PowerShell.Commands
1213
{
@@ -146,16 +147,23 @@ protected override void ProcessRecord()
146147
}
147148

148149
// Prevent additional commands in ConstrainedLanguage mode
149-
if (Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
150+
if (_setSupportedCommand && Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
150151
{
151-
if (_setSupportedCommand)
152+
if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
152153
{
153154
NotSupportedException nse =
154155
PSTraceSource.NewNotSupportedException(
155156
ImportLocalizedDataStrings.CannotDefineSupportedCommand);
156157
ThrowTerminatingError(
157158
new ErrorRecord(nse, "CannotDefineSupportedCommand", ErrorCategory.PermissionDenied, null));
158159
}
160+
161+
SystemPolicy.LogWDACAuditMessage(
162+
context: Context,
163+
title: ImportLocalizedDataStrings.WDACLogTitle,
164+
message: ImportLocalizedDataStrings.WDACLogMessage,
165+
fqid: "SupportedCommandsDisabled",
166+
dropIntoDebugger: true);
159167
}
160168

161169
string script = GetScript(path);

‎src/Microsoft.PowerShell.Commands.Utility/commands/utility/InvokeExpressionCommand.cs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
using System;
55
using System.Management.Automation;
66
using System.Management.Automation.Internal;
7+
using System.Management.Automation.Security;
78

89
namespace Microsoft.PowerShell.Commands
910
{
@@ -43,6 +44,16 @@ protected override void ProcessRecord()
4344
myScriptBlock.LanguageMode = PSLanguageMode.ConstrainedLanguage;
4445
}
4546

47+
if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Audit)
48+
{
49+
SystemPolicy.LogWDACAuditMessage(
50+
context: Context,
51+
title: UtilityCommonStrings.IEXWDACLogTitle,
52+
message: UtilityCommonStrings.IEXWDACLogMessage,
53+
fqid: "InvokeExpressionCmdletConstrained",
54+
dropIntoDebugger: true);
55+
}
56+
4657
var emptyArray = Array.Empty<object>();
4758
myScriptBlock.InvokeUsingCmdlet(
4859
contextCmdlet: this,

‎src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs‎

Lines changed: 43 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -187,18 +187,30 @@ protected override void BeginProcessing()
187187
targetObject: null));
188188
}
189189

190-
if (Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
191-
{
192-
if (!CoreTypes.Contains(type))
193-
{
194-
ThrowTerminatingError(
195-
new ErrorRecord(
196-
new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage), "CannotCreateTypeConstrainedLanguage", ErrorCategory.PermissionDenied, null));
197-
}
198-
}
199-
200190
switch (Context.LanguageMode)
201191
{
192+
case PSLanguageMode.ConstrainedLanguage:
193+
if (!CoreTypes.Contains(type))
194+
{
195+
if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
196+
{
197+
ThrowTerminatingError(
198+
new ErrorRecord(
199+
new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage),
200+
"CannotCreateTypeConstrainedLanguage",
201+
ErrorCategory.PermissionDenied,
202+
targetObject: null));
203+
}
204+
205+
SystemPolicy.LogWDACAuditMessage(
206+
context: Context,
207+
title: NewObjectStrings.TypeWDACLogTitle,
208+
message: StringUtil.Format(NewObjectStrings.TypeWDACLogMessage, type.FullName),
209+
fqid: "NewObjectCmdletCannotCreateType",
210+
dropIntoDebugger: true);
211+
}
212+
break;
213+
202214
case PSLanguageMode.NoLanguage:
203215
case PSLanguageMode.RestrictedLanguage:
204216
if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce
@@ -212,8 +224,7 @@ protected override void BeginProcessing()
212224
ErrorCategory.PermissionDenied,
213225
targetObject: null));
214226
}
215-
216-
break;
227+
break;
217228
}
218229

219230
// WinRT does not support creating instances of attribute & delegate WinRT types.
@@ -301,21 +312,31 @@ protected override void BeginProcessing()
301312
bool isAllowed = false;
302313

303314
// If it's a system-wide lockdown, we may allow additional COM types
304-
if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce)
315+
var systemLockdownPolicy = SystemPolicy.GetSystemLockdownPolicy();
316+
if (systemLockdownPolicy == SystemEnforcementMode.Enforce || systemLockdownPolicy == SystemEnforcementMode.Audit)
305317
{
306-
if ((result >= 0) &&
307-
SystemPolicy.IsClassInApprovedList(_comObjectClsId))
308-
{
309-
isAllowed = true;
310-
}
318+
isAllowed = (result >= 0) && SystemPolicy.IsClassInApprovedList(_comObjectClsId);
311319
}
312320

313321
if (!isAllowed)
314322
{
315-
ThrowTerminatingError(
316-
new ErrorRecord(
317-
new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage), "CannotCreateComTypeConstrainedLanguage", ErrorCategory.PermissionDenied, null));
318-
return;
323+
if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
324+
{
325+
ThrowTerminatingError(
326+
new ErrorRecord(
327+
new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage),
328+
"CannotCreateComTypeConstrainedLanguage",
329+
ErrorCategory.PermissionDenied,
330+
targetObject: null));
331+
return;
332+
}
333+
334+
SystemPolicy.LogWDACAuditMessage(
335+
context: Context,
336+
title: NewObjectStrings.ComWDACLogTitle,
337+
message: StringUtil.Format(NewObjectStrings.ComWDACLogMessage, ComObject ?? string.Empty),
338+
fqid: "NewObjectCmdletCannotCreateCOM",
339+
dropIntoDebugger: true);
319340
}
320341
}
321342

‎src/Microsoft.PowerShell.Commands.Utility/resources/AddTypeStrings.resx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,4 +150,10 @@
150150
<data name="AssemblyTypeNotSupported" xml:space="preserve">
151151
<value>Both the assembly types 'ConsoleApplication' and 'WindowsApplication' are not currently supported.</value>
152152
</data>
153+
<data name="AddTypeLogTitle" xml:space="preserve">
154+
<value>Add-Type Cmdlet</value>
155+
</data>
156+
<data name="AddTypeLogMessage" xml:space="preserve">
157+
<value>Add-Type cmdlet will not be allowed in ConstrainedLanguage mode.</value>
158+
</data>
153159
</root>

‎src/Microsoft.PowerShell.Commands.Utility/resources/ImportLocalizedDataStrings.resx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,4 +143,10 @@
143143
<data name="IncorrectVariableName" xml:space="preserve">
144144
<value>The BindingVariable name '{0}' is invalid.</value>
145145
</data>
146+
<data name="WDACLogTitle" xml:space="preserve">
147+
<value>Import-LocalizedData Cmdlet</value>
148+
</data>
149+
<data name="WDACLogMessage" xml:space="preserve">
150+
<value>Additional supported commands (via SupportedCommand parameter) will not be allowed in ConstrainedLanguage mode.</value>
151+
</data>
146152
</root>

‎src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,4 +147,16 @@
147147
<data name="CannotCreateTypeLanguageMode" xml:space="preserve">
148148
<value>Cannot create type. Only core types are supported in {0} language mode on a policy locked down machine.</value>
149149
</data>
150+
<data name="TypeWDACLogTitle" xml:space="preserve">
151+
<value>New-Object Cmdlet Type Creation</value>
152+
</data>
153+
<data name="TypeWDACLogMessage" xml:space="preserve">
154+
<value>The type '{0}' will not be created in ConstrainedLanguage mode.</value>
155+
</data>
156+
<data name="ComWDACLogTitle" xml:space="preserve">
157+
<value>New-Object Cmdlet COM Object Creation</value>
158+
</data>
159+
<data name="ComWDACLogMessage" xml:space="preserve">
160+
<value>The COM object '{0}' will not be created in ConstrainedLanguage mode.</value>
161+
</data>
150162
</root>

‎src/Microsoft.PowerShell.Commands.Utility/resources/UtilityCommonStrings.resx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,4 +168,10 @@
168168
<data name="InvalidSDDL" xml:space="preserve">
169169
<value>Cannot construct a security descriptor from the given SDDL due to the following error: {0}</value>
170170
</data>
171+
<data name="IEXWDACLogTitle" xml:space="preserve">
172+
<value>Invoke-Expression Cmdlet</value>
173+
</data>
174+
<data name="IEXWDACLogMessage" xml:space="preserve">
175+
<value>Invoke-Expression cmdlet script block will be run in ConstrainedLanguage mode.</value>
176+
</data>
171177
</root>

‎src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
using System.Management.Automation.Remoting;
1717
using System.Management.Automation.Remoting.Server;
1818
using System.Management.Automation.Runspaces;
19+
using System.Management.Automation.Security;
1920
using System.Management.Automation.Subsystem.Feedback;
2021
using System.Management.Automation.Tracing;
2122
using System.Reflection;
@@ -1855,7 +1856,14 @@ private void DoRunspaceInitialization(RunspaceCreationEventArgs args)
18551856
switch (languageMode)
18561857
{
18571858
case PSLanguageMode.ConstrainedLanguage:
1858-
s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLMode);
1859+
if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
1860+
{
1861+
s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLMode);
1862+
}
1863+
else
1864+
{
1865+
s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLAuditMode);
1866+
}
18591867
break;
18601868

18611869
case PSLanguageMode.NoLanguage:

‎src/Microsoft.PowerShell.ConsoleHost/resources/ManagedEntranceStrings.resx‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,9 @@
123123
<data name="ShellBannerCLMode" xml:space="preserve">
124124
<value>[Constrained Language Mode]</value>
125125
</data>
126+
<data name="ShellBannerCLAuditMode" xml:space="preserve">
127+
<value>[Constrained Language AUDIT Mode : No Restrictions]</value>
128+
</data>
126129
<data name="ShellBannerNLMode" xml:space="preserve">
127130
<value>[No Language Mode]</value>
128131
</data>

0 commit comments

Comments
 (0)