Move bypass execution policy check after AppLocker Deny check by TravisEz13 · Pull Request #15035 · PowerShell/PowerShell

Travis Plunk (TravisEz13) · 2021-03-15T22:50:59Z

PR Summary

Move bypass execution policy check after AppLocker Deny check

PR Context

This only affects a corner case where you only have Deny rules.

PR Checklist

Paul Higinbotham (PaulHigin)

Minor comment.

Rob Holt (rjmholt) · 2021-03-16T20:45:10Z

Paul Higinbotham (@PaulHigin) can you refresh your review?

Bill Easton (strawgate) · 2021-03-27T03:42:58Z

This seems like it would be a breaking change.... this change appears to make it so you cannot use -executionpolicy bypass to run a script in an applocker environment that is denying script execution

Ilya (iSazonov) · 2021-03-27T05:23:56Z

This seems like it would be a breaking change

It is a bug fix - no one can disable the lock set by a system administrator.

Bill Easton (strawgate) · 2021-03-27T14:54:51Z

Does this being a bugfix effect whether it's a breaking change?

https://github.com/PowerShell/PowerShell/blob/master/docs/dev-process/breaking-change-contract.md

It doesn't matter if the existing behavior is "wrong", we still need to think through the implications. PowerShell has been in broad use for over 10 years so we be must be extremely sensitive to breaking existing users and scripts.

This would seem to me to be a bucket 2/3 change which previously has required a breaking change conversation even when related to bug fixes: #12766 (comment)

Ilya (iSazonov) · 2021-03-27T17:01:25Z

Bill Easton (@strawgate) Any bug fix could be considered as a breaking change :-)

This is a security related bug fix - such things are never discussed publicly (it is Microsoft policy).

Travis Plunk (TravisEz13) · 2021-03-27T18:01:49Z

Bill Easton (@strawgate) I've marked the issue a breaking change. As Ilya (@iSazonov) has said, AppLocker is considered the security feature with the stronger promise here. Execution policy was never intended as a bypass.

See our security policy: https://github.com/PowerShell/PowerShell/security/policy

Security issues are treated very seriously and will, by default, takes precedence over other considerations including usability, performance, etc... Best effort will be used to mitigate side effects of a security change, but PowerShell must be secure by default.

FYI, this scenario was is even a corner case of AppLocker, where you only have Deny rules and constrained language mode is not used to enforce the policy.

Deleted user (ghost) · 2021-04-14T23:59:56Z

🎉v7.2.0-preview.5 has been released which incorporates this pull request.:tada:

Handy links:

Release Notes

@davidBar-On

[7.2.0-preview.5] - 2021-04-14 * Breaking Changes - Make PowerShell Linux deb and RPM packages universal (#15109) - Enforce AppLocker Deny configuration before Execution Policy Bypass configuration (#15035) - Disallow mixed dash and slash in command line parameter prefix (#15142) (Thanks @davidBar-On!) * Experimental Features - `PSNativeCommandArgumentPassing`: Use `ArgumentList` for native executable invocation (breaking change) (#14692) * Engine Updates and Fixes - Add `IArgumentCompleterFactory` for parameterized `ArgumentCompleters` (#12605) (Thanks @powercode!) * General Cmdlet Updates and Fixes - Fix SSH remoting connection never finishing with misconfigured endpoint (#15175) - Respect `TERM` and `NO_COLOR` environment variables for `$PSStyle` rendering (#14969) - Use `ProgressView.Classic` when Virtual Terminal is not supported (#15048) - Fix `Get-Counter` issue with `-Computer` parameter (#15166) (Thanks @krishnayalavarthi!) - Fix redundant iteration while splitting lines (#14851) (Thanks @hez2010!) - Enhance `Remove-Item -Recurse` to work with OneDrive (#14902) (Thanks @iSazonov!) - Change minimum depth to 0 for `ConvertTo-Json` (#14830) (Thanks @kvprasoon!) - Allow `Set-Clipboard` to accept empty string (#14579) - Turn on and off `DECCKM` to modify keyboard mode for Unix native commands to work correctly (#14943) - Fall back to `CopyAndDelete()` when `MoveTo()` fails due to an `IOException` (#15077) * Code Cleanup <details> <summary> We thank the following contributors! @xtqqczze, @iSazonov, @ZhiZe-ZG </summary> <ul> <li>Update .NET to <code>6.0.0-preview.3</code> (#15221)</li> <li>Add space before comma to hosting test to fix error reported by <code>SA1001</code> (#15224)</li> <li>Add <code>SecureStringHelper.FromPlainTextString</code> helper method for efficient secure string creation (#14124) (Thanks @xtqqczze!)</li> <li>Use static lambda keyword (#15154) (Thanks @iSazonov!)</li> <li>Remove unnecessary <code>Array</code> -> <code>List</code> -> <code>Array</code> conversion in <code>ProcessBaseCommand.AllProcesses</code> (#15052) (Thanks @xtqqczze!)</li> <li>Standardize grammar comments in Parser.cs (#15114) (Thanks @ZhiZe-ZG!)</li> <li>Enable <code>SA1001</code>: Commas should be spaced correctly (#14171) (Thanks @xtqqczze!)</li> <li>Refactor <code>MultipleServiceCommandBase.AllServices</code> (#15053) (Thanks @xtqqczze!)</li> </ul> </details> * Tools - Use Unix line endings for shell scripts (#15180) (Thanks @xtqqczze!) * Tests - Add the missing tag in Host Utilities tests (#14983) - Update `copy-props` version in `package.json` (#15124) * Build and Packaging Improvements <details> <summary> We thank the following contributors! @JustinGrote </summary> <ul> <li>Fix <code>yarn-lock</code> for <code>copy-props</code> (#15225)</li> <li>Make package validation regex accept universal Linux packages (#15226)</li> <li>Bump NJsonSchema from 10.4.0 to 10.4.1 (#15190)</li> <li>Make MSI and EXE signing always copy to fix daily build (#15191)</li> <li>Sign internals of EXE package so that it works correctly when signed (#15132)</li> <li>Bump Microsoft.NET.Test.Sdk from 16.9.1 to 16.9.4 (#15141)</li> <li>Update daily release tag format to work with new Microsoft Update work (#15164)</li> <li>Feature: Add Ubuntu 20.04 Support to install-powershell.sh (#15095) (Thanks @JustinGrote!)</li> <li>Treat rebuild branches like release branches (#15099)</li> <li>Update WiX to 3.11.2 (#15097)</li> <li>Bump NJsonSchema from 10.3.11 to 10.4.0 (#15092)</li> <li>Allow patching of preview releases (#15074)</li> <li>Bump Newtonsoft.Json from 12.0.3 to 13.0.1 (#15084, #15085)</li> <li>Update the <code>minSize</code> build package filter to be explicit (#15055)</li> <li>Bump NJsonSchema from 10.3.10 to 10.3.11 (#14965)</li> </ul> </details> * Documentation and Help Content - Merge `7.2.0-preview.4` changes to master (#15056) - Update `README` and `metadata.json` (#15046) - Fix broken links for `dotnet` CLI (#14937) [7.2.0-preview.5]: v7.2.0-preview.4...v7.2.0-preview.5

…hell#15035)

@davidBar-On

[7.2.0-preview.5] - 2021-04-14 * Breaking Changes - Make PowerShell Linux deb and RPM packages universal (PowerShell#15109) - Enforce AppLocker Deny configuration before Execution Policy Bypass configuration (PowerShell#15035) - Disallow mixed dash and slash in command line parameter prefix (PowerShell#15142) (Thanks @davidBar-On!) * Experimental Features - `PSNativeCommandArgumentPassing`: Use `ArgumentList` for native executable invocation (breaking change) (PowerShell#14692) * Engine Updates and Fixes - Add `IArgumentCompleterFactory` for parameterized `ArgumentCompleters` (PowerShell#12605) (Thanks @powercode!) * General Cmdlet Updates and Fixes - Fix SSH remoting connection never finishing with misconfigured endpoint (PowerShell#15175) - Respect `TERM` and `NO_COLOR` environment variables for `$PSStyle` rendering (PowerShell#14969) - Use `ProgressView.Classic` when Virtual Terminal is not supported (PowerShell#15048) - Fix `Get-Counter` issue with `-Computer` parameter (PowerShell#15166) (Thanks @krishnayalavarthi!) - Fix redundant iteration while splitting lines (PowerShell#14851) (Thanks @hez2010!) - Enhance `Remove-Item -Recurse` to work with OneDrive (PowerShell#14902) (Thanks @iSazonov!) - Change minimum depth to 0 for `ConvertTo-Json` (PowerShell#14830) (Thanks @kvprasoon!) - Allow `Set-Clipboard` to accept empty string (PowerShell#14579) - Turn on and off `DECCKM` to modify keyboard mode for Unix native commands to work correctly (PowerShell#14943) - Fall back to `CopyAndDelete()` when `MoveTo()` fails due to an `IOException` (PowerShell#15077) * Code Cleanup <details> <summary> We thank the following contributors! @xtqqczze, @iSazonov, @ZhiZe-ZG </summary> <ul> <li>Update .NET to <code>6.0.0-preview.3</code> (PowerShell#15221)</li> <li>Add space before comma to hosting test to fix error reported by <code>SA1001</code> (PowerShell#15224)</li> <li>Add <code>SecureStringHelper.FromPlainTextString</code> helper method for efficient secure string creation (PowerShell#14124) (Thanks @xtqqczze!)</li> <li>Use static lambda keyword (PowerShell#15154) (Thanks @iSazonov!)</li> <li>Remove unnecessary <code>Array</code> -> <code>List</code> -> <code>Array</code> conversion in <code>ProcessBaseCommand.AllProcesses</code> (PowerShell#15052) (Thanks @xtqqczze!)</li> <li>Standardize grammar comments in Parser.cs (PowerShell#15114) (Thanks @ZhiZe-ZG!)</li> <li>Enable <code>SA1001</code>: Commas should be spaced correctly (PowerShell#14171) (Thanks @xtqqczze!)</li> <li>Refactor <code>MultipleServiceCommandBase.AllServices</code> (PowerShell#15053) (Thanks @xtqqczze!)</li> </ul> </details> * Tools - Use Unix line endings for shell scripts (PowerShell#15180) (Thanks @xtqqczze!) * Tests - Add the missing tag in Host Utilities tests (PowerShell#14983) - Update `copy-props` version in `package.json` (PowerShell#15124) * Build and Packaging Improvements <details> <summary> We thank the following contributors! @JustinGrote </summary> <ul> <li>Fix <code>yarn-lock</code> for <code>copy-props</code> (PowerShell#15225)</li> <li>Make package validation regex accept universal Linux packages (PowerShell#15226)</li> <li>Bump NJsonSchema from 10.4.0 to 10.4.1 (PowerShell#15190)</li> <li>Make MSI and EXE signing always copy to fix daily build (PowerShell#15191)</li> <li>Sign internals of EXE package so that it works correctly when signed (PowerShell#15132)</li> <li>Bump Microsoft.NET.Test.Sdk from 16.9.1 to 16.9.4 (PowerShell#15141)</li> <li>Update daily release tag format to work with new Microsoft Update work (PowerShell#15164)</li> <li>Feature: Add Ubuntu 20.04 Support to install-powershell.sh (PowerShell#15095) (Thanks @JustinGrote!)</li> <li>Treat rebuild branches like release branches (PowerShell#15099)</li> <li>Update WiX to 3.11.2 (PowerShell#15097)</li> <li>Bump NJsonSchema from 10.3.11 to 10.4.0 (PowerShell#15092)</li> <li>Allow patching of preview releases (PowerShell#15074)</li> <li>Bump Newtonsoft.Json from 12.0.3 to 13.0.1 (PowerShell#15084, PowerShell#15085)</li> <li>Update the <code>minSize</code> build package filter to be explicit (PowerShell#15055)</li> <li>Bump NJsonSchema from 10.3.10 to 10.3.11 (PowerShell#14965)</li> </ul> </details> * Documentation and Help Content - Merge `7.2.0-preview.4` changes to master (PowerShell#15056) - Update `README` and `metadata.json` (PowerShell#15046) - Fix broken links for `dotnet` CLI (PowerShell#14937) [7.2.0-preview.5]: PowerShell/PowerShell@v7.2.0-preview.4...v7.2.0-preview.5

move bypass after applocker deny

1b7ccf2

ghost assigned Ilya (iSazonov) Mar 15, 2021

Travis Plunk (TravisEz13) added the WG-Security security related areas such as JEA label Mar 15, 2021

Travis Plunk (TravisEz13) assigned Rob Holt (rjmholt) and unassigned Ilya (iSazonov) Mar 15, 2021

Travis Plunk (TravisEz13) added CL-Engine Indicates that a PR should be marked as an engine change in the Change Log OS-Windows labels Mar 15, 2021

Travis Plunk (TravisEz13) requested a review from Paul Higinbotham (PaulHigin) March 15, 2021 22:53

fix variable rename

1167f27

Paul Higinbotham (PaulHigin) approved these changes Mar 15, 2021

View reviewed changes

Comment thread src/System.Management.Automation/security/SecurityManager.cs Outdated

Fix style issue

b95d5b9

Ilya (iSazonov) approved these changes Mar 16, 2021

View reviewed changes

Travis Plunk (TravisEz13) marked this pull request as ready for review March 16, 2021 18:05

Rob Holt (rjmholt) approved these changes Mar 16, 2021

View reviewed changes

Paul Higinbotham (PaulHigin) self-requested a review March 16, 2021 20:46

Paul Higinbotham (PaulHigin) approved these changes Mar 16, 2021

View reviewed changes

Rob Holt (rjmholt) merged commit f1b8798 into PowerShell:master Mar 22, 2021

Travis Plunk (TravisEz13) deleted the port-applocker-fix branch March 22, 2021 18:39

Travis Plunk (TravisEz13) added the CL-BreakingChange Indicates that a PR should be marked as a breaking change in the Change Log label Mar 27, 2021

Ilya (iSazonov) added this to the 7.2.0-preview.5 milestone Apr 15, 2021

Sean Wheeler (sdwheeler) mentioned this pull request Apr 15, 2021

Enforce AppLocker Deny configuration before Execution Policy Bypass configuration MicrosoftDocs/PowerShell-Docs#7478

Closed

Thatgfsj (Thatgfsj) pushed a commit to Thatgfsj-contribs/PowerShell that referenced this pull request Aug 6, 2026

Move bypass execution policy check after AppLocker Deny check (PowerS…

eea5daf

…hell#15035)

Navigation Menu

Move bypass execution policy check after AppLocker Deny check - #15035

Move bypass execution policy check after AppLocker Deny check#15035
Rob Holt (rjmholt) merged 3 commits into
PowerShell:masterfrom
TravisEz13:port-applocker-fix

Travis Plunk (TravisEz13) commented Mar 15, 2021 •

edited

Loading

Uh oh!

Paul Higinbotham (PaulHigin) left a comment

Uh oh!

Uh oh!

Rob Holt (rjmholt) commented Mar 16, 2021

Uh oh!

Bill Easton (strawgate) commented Mar 27, 2021 •

edited

Loading

Uh oh!

Ilya (iSazonov) commented Mar 27, 2021

Uh oh!

Bill Easton (strawgate) commented Mar 27, 2021 •

edited

Loading

Uh oh!

Ilya (iSazonov) commented Mar 27, 2021 •

edited

Loading

Uh oh!

Travis Plunk (TravisEz13) commented Mar 27, 2021 •

edited

Loading

Uh oh!

Deleted user (ghost) commented Apr 14, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Travis Plunk (TravisEz13) commented Mar 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Paul Higinbotham (PaulHigin) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Rob Holt (rjmholt) commented Mar 16, 2021

Uh oh!

Bill Easton (strawgate) commented Mar 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ilya (iSazonov) commented Mar 27, 2021

Uh oh!

Bill Easton (strawgate) commented Mar 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Ilya (iSazonov) commented Mar 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Travis Plunk (TravisEz13) commented Mar 27, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Deleted user (ghost) commented Apr 14, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Travis Plunk (TravisEz13) commented Mar 15, 2021 •

edited

Loading

Bill Easton (strawgate) commented Mar 27, 2021 •

edited

Loading

Bill Easton (strawgate) commented Mar 27, 2021 •

edited

Loading

Ilya (iSazonov) commented Mar 27, 2021 •

edited

Loading

Travis Plunk (TravisEz13) commented Mar 27, 2021 •

edited

Loading