From c3d4d36f08c9e52c3e625fda8f9971c82bddefc1 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 8 Dec 2020 10:38:23 -0800 Subject: [PATCH 1/3] Fix issue where AppLocker Enforce mode is ignored if UMCI audit mode is enabled --- .../security/wldpNativeMethods.cs | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index 61023787457..28b68d1806c 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -78,36 +78,39 @@ public static SystemEnforcementMode GetSystemLockdownPolicy() /// An EnforcementMode that describes policy. public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle handle) { - // Check the WLDP API - SystemEnforcementMode lockdownPolicy = GetWldpPolicy(path, handle); - if (lockdownPolicy == SystemEnforcementMode.Enforce) + // Check the WLDP File policy via API + var wldpFilePolicy = GetWldpPolicy(path, handle); + if(wldpFilePolicy == SystemEnforcementMode.Enforce) { - return lockdownPolicy; + return wldpFilePolicy; } - // At this point, LockdownPolicy = Audit or Allowed. - // If there was a WLDP policy, but WLDP didn't block it, - // then it was explicitly allowed. Therefore, return the result for the file. - SystemEnforcementMode systemWldpPolicy = s_cachedWldpSystemPolicy.GetValueOrDefault(SystemEnforcementMode.None); - if ((systemWldpPolicy == SystemEnforcementMode.Enforce) || - (systemWldpPolicy == SystemEnforcementMode.Audit)) + // Check the AppLocker File policy via API + // This needs to be checked before WLDP audit policy + // So, that we don't end up in Audit mode, + // when we should be enforce mode. + var appLockerFilePolicy = GetAppLockerPolicy(path, handle); + if (appLockerFilePolicy == SystemEnforcementMode.Enforce) { - return lockdownPolicy; + return appLockerFilePolicy; } - // Check the AppLocker API - lockdownPolicy = GetAppLockerPolicy(path, handle); - if (lockdownPolicy == SystemEnforcementMode.Enforce) + // At this point, LockdownPolicy = Audit or Allowed. + // If there was a WLDP policy, but WLDP didn't block it, + // then it was explicitly allowed. Therefore, return the result for the file. + SystemEnforcementMode systemWldpPolicy = cachedWldpSystemPolicy.GetValueOrDefault(SystemEnforcementMode.None); + if ((systemWldpPolicy == SystemEnforcementMode.Audit) || + (systemWldpPolicy == SystemEnforcementMode.Enforce)) { - return lockdownPolicy; + return wldpFilePolicy; } // If there was a system-wide AppLocker policy, but AppLocker didn't block it, // then return AppLocker's status. - if (s_cachedSaferSystemPolicy.GetValueOrDefault(SaferPolicy.Allowed) == + if (cachedSaferSystemPolicy.GetValueOrDefault(SaferPolicy.Allowed) == SaferPolicy.Disallowed) { - return lockdownPolicy; + return appLockerFilePolicy; } // If it's not set to 'Enforce' by the platform, allow debug overrides From 15406ae7dc1e4d8fc8ffde413bef5862bb20fff4 Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 8 Dec 2020 10:49:55 -0800 Subject: [PATCH 2/3] fix variable names --- .../security/wldpNativeMethods.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index 28b68d1806c..e062a8096f2 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -98,7 +98,7 @@ public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle ha // At this point, LockdownPolicy = Audit or Allowed. // If there was a WLDP policy, but WLDP didn't block it, // then it was explicitly allowed. Therefore, return the result for the file. - SystemEnforcementMode systemWldpPolicy = cachedWldpSystemPolicy.GetValueOrDefault(SystemEnforcementMode.None); + SystemEnforcementMode systemWldpPolicy = s_cachedWldpSystemPolicy.GetValueOrDefault(SystemEnforcementMode.None); if ((systemWldpPolicy == SystemEnforcementMode.Audit) || (systemWldpPolicy == SystemEnforcementMode.Enforce)) { @@ -107,7 +107,7 @@ public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle ha // If there was a system-wide AppLocker policy, but AppLocker didn't block it, // then return AppLocker's status. - if (cachedSaferSystemPolicy.GetValueOrDefault(SaferPolicy.Allowed) == + if (s_cachedSaferSystemPolicy.GetValueOrDefault(SaferPolicy.Allowed) == SaferPolicy.Disallowed) { return appLockerFilePolicy; From 4cb3f4b6d2bb8a6071ea08e7797bc65179d0273a Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Tue, 8 Dec 2020 13:14:57 -0800 Subject: [PATCH 3/3] Update src/System.Management.Automation/security/wldpNativeMethods.cs --- src/System.Management.Automation/security/wldpNativeMethods.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index e062a8096f2..0eb53dbcb3a 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -80,7 +80,7 @@ public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle ha { // Check the WLDP File policy via API var wldpFilePolicy = GetWldpPolicy(path, handle); - if(wldpFilePolicy == SystemEnforcementMode.Enforce) + if (wldpFilePolicy == SystemEnforcementMode.Enforce) { return wldpFilePolicy; }