Visitar URL original
Add support for new WLDP setting `EnableFileOnlyEntry` (#26752) · PowerShell/PowerShell@2ca393d · GitHub
Skip to content

Commit 2ca393d

Browse files
SeeminglyScienceSeeminglyScience
authored
Add support for new WLDP setting EnableFileOnlyEntry (#26752)
1 parent dba85f8 commit 2ca393d

6 files changed

Lines changed: 281 additions & 43 deletions

File tree

‎src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
using System.Management.Automation.Internal;
1515
using System.Management.Automation.Language;
1616
using System.Management.Automation.Runspaces;
17+
using System.Management.Automation.Security;
1718
using System.Security;
1819
using System.Text;
1920

@@ -878,10 +879,27 @@ internal void Parse(string[] args)
878879
ParseHelper(args);
879880
}
880881

882+
internal static bool IsFileOnlyEntryEnabled
883+
{
884+
get
885+
{
886+
#if UNIX
887+
return false;
888+
#else
889+
return SystemPolicy.IsFileOnlyEntryEnabled();
890+
#endif
891+
}
892+
}
893+
881894
private void ParseHelper(string[] args)
882895
{
883896
if (args.Length == 0)
884897
{
898+
if (IsFileOnlyEntryEnabled)
899+
{
900+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
901+
}
902+
885903
return;
886904
}
887905

@@ -927,6 +945,12 @@ private void ParseHelper(string[] args)
927945
_noExit = true;
928946
noexitSeen = true;
929947
ParametersUsed |= ParameterBitmap.NoExit;
948+
949+
if (IsFileOnlyEntryEnabled)
950+
{
951+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryNoExitDisabled);
952+
break;
953+
}
930954
}
931955
else if (MatchSwitch(switchKey, "noprofile", "nop"))
932956
{
@@ -948,32 +972,57 @@ private void ParseHelper(string[] args)
948972
_socketServerMode = true;
949973
_showBanner = false;
950974
ParametersUsed |= ParameterBitmap.SocketServerMode;
975+
if (IsFileOnlyEntryEnabled)
976+
{
977+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
978+
break;
979+
}
951980
}
952981
#if !UNIX
953982
else if (MatchSwitch(switchKey, "v2socketservermode", "v2so"))
954983
{
955984
_v2SocketServerMode = true;
956985
_showBanner = false;
957986
ParametersUsed |= ParameterBitmap.V2SocketServerMode;
987+
if (IsFileOnlyEntryEnabled)
988+
{
989+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
990+
break;
991+
}
958992
}
959993
#endif
960994
else if (MatchSwitch(switchKey, "servermode", "s"))
961995
{
962996
_serverMode = true;
963997
_showBanner = false;
964998
ParametersUsed |= ParameterBitmap.ServerMode;
999+
if (IsFileOnlyEntryEnabled)
1000+
{
1001+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
1002+
break;
1003+
}
9651004
}
9661005
else if (MatchSwitch(switchKey, "namedpipeservermode", "nam"))
9671006
{
9681007
_namedPipeServerMode = true;
9691008
_showBanner = false;
9701009
ParametersUsed |= ParameterBitmap.NamedPipeServerMode;
1010+
if (IsFileOnlyEntryEnabled)
1011+
{
1012+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
1013+
break;
1014+
}
9711015
}
9721016
else if (MatchSwitch(switchKey, "sshservermode", "sshs"))
9731017
{
9741018
_sshServerMode = true;
9751019
_showBanner = false;
9761020
ParametersUsed |= ParameterBitmap.SSHServerMode;
1021+
if (IsFileOnlyEntryEnabled)
1022+
{
1023+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
1024+
break;
1025+
}
9771026
}
9781027
else if (MatchSwitch(switchKey, "noprofileloadtime", "noprofileloadtime"))
9791028
{
@@ -1263,6 +1312,15 @@ private void ParseHelper(string[] args)
12631312
}
12641313
}
12651314

1315+
if (_error is null
1316+
&& !_showVersion
1317+
&& !_showHelp
1318+
&& !ParametersUsed.HasFlag(ParameterBitmap.File)
1319+
&& IsFileOnlyEntryEnabled)
1320+
{
1321+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
1322+
}
1323+
12661324
Dbg.Assert(
12671325
((_exitCode == ConsoleHost.ExitCodeBadCommandLineParameter) && _abortStartup)
12681326
|| (_exitCode == ConsoleHost.ExitCodeSuccess),
@@ -1360,6 +1418,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
13601418
// Process interactive input...
13611419
if (args[i] == "-")
13621420
{
1421+
if (IsFileOnlyEntryEnabled)
1422+
{
1423+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
1424+
return false;
1425+
}
1426+
13631427
// the arg to -file is -, which is secret code for "read the commands from stdin with prompts"
13641428

13651429
_explicitReadCommandsFromStdin = true;
@@ -1492,6 +1556,12 @@ static object ConvertToBoolIfPossible(string arg)
14921556

14931557
private bool ParseCommand(string[] args, ref int i, bool noexitSeen, bool isEncoded)
14941558
{
1559+
if (IsFileOnlyEntryEnabled)
1560+
{
1561+
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
1562+
return false;
1563+
}
1564+
14951565
if (_commandLineCommand != null)
14961566
{
14971567
// we've already set the command, so squawk

‎src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs‎

Lines changed: 44 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -165,8 +165,6 @@ internal static int Start(
165165
// improve startup performance.
166166
}
167167

168-
uint exitCode = ExitCodeSuccess;
169-
170168
Thread.CurrentThread.Name = "ConsoleHost main thread";
171169

172170
try
@@ -192,7 +190,7 @@ internal static int Start(
192190
// or start up the engine and retrieve the information via $psversiontable.GitCommitId
193191
// but this returns the semantic version and avoids executing a script
194192
s_theConsoleHost.UI.WriteLine($"PowerShell {PSVersionInfo.GitCommitId}");
195-
return 0;
193+
return ExitCodeSuccess;
196194
}
197195

198196
// Servermode parameter validation check.
@@ -223,6 +221,14 @@ internal static int Start(
223221
return ExitCodeBadCommandLineParameter;
224222
}
225223

224+
if (serverModeCount is 1 && CommandLineParameterParser.IsFileOnlyEntryEnabled)
225+
{
226+
// User facing error message should already be written by the parser,
227+
// so just trace and exit.
228+
s_tracer.TraceError("Server mode cannot be specified when FileOnlyEntry policy is in place.");
229+
return ExitCodeBadCommandLineParameter;
230+
}
231+
226232
#if !UNIX
227233
TaskbarJumpList.CreateRunAsAdministratorJumpList();
228234
#endif
@@ -237,9 +243,10 @@ internal static int Start(
237243
configurationName: null,
238244
configurationFile: s_cpp.ConfigurationFile,
239245
combineErrOutStream: false);
240-
exitCode = 0;
246+
return ExitCodeSuccess;
241247
}
242-
else if (s_cpp.SSHServerMode)
248+
249+
if (s_cpp.SSHServerMode)
243250
{
244251
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SSHServer", s_cpp.ParametersUsedAsDouble);
245252
ProfileOptimization.StartProfile("StartupProfileData-SSHServerMode");
@@ -249,18 +256,20 @@ internal static int Start(
249256
configurationName: null,
250257
configurationFile: s_cpp.ConfigurationFile,
251258
combineErrOutStream: true);
252-
exitCode = 0;
259+
return ExitCodeSuccess;
253260
}
254-
else if (s_cpp.NamedPipeServerMode)
261+
262+
if (s_cpp.NamedPipeServerMode)
255263
{
256264
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("NamedPipe", s_cpp.ParametersUsedAsDouble);
257265
ProfileOptimization.StartProfile("StartupProfileData-NamedPipeServerMode");
258266
RemoteSessionNamedPipeServer.RunServerMode(
259267
configurationName: s_cpp.ConfigurationName);
260-
exitCode = 0;
268+
return ExitCodeSuccess;
261269
}
262270
#if !UNIX
263-
else if (s_cpp.V2SocketServerMode)
271+
272+
if (s_cpp.V2SocketServerMode)
264273
{
265274
if (s_cpp.Token == null)
266275
{
@@ -284,50 +293,49 @@ internal static int Start(
284293
token: s_cpp.Token,
285294
tokenCreationTime: s_cpp.UTCTimestamp.Value);
286295

287-
exitCode = 0;
296+
return ExitCodeSuccess;
288297
}
289298
#endif
290-
else if (s_cpp.SocketServerMode)
299+
300+
if (s_cpp.SocketServerMode)
291301
{
292302
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SocketServerMode", s_cpp.ParametersUsedAsDouble);
293303
ProfileOptimization.StartProfile("StartupProfileData-SocketServerMode");
294304
HyperVSocketMediator.Run(
295305
initialCommand: s_cpp.InitialCommand,
296306
configurationName: s_cpp.ConfigurationName);
297-
exitCode = 0;
307+
return ExitCodeSuccess;
298308
}
299-
else
309+
310+
// Run PowerShell in normal console mode.
311+
if (hostException != null)
300312
{
301-
// Run PowerShell in normal console mode.
302-
if (hostException != null)
303-
{
304-
// Unable to create console host.
305-
throw hostException;
306-
}
313+
// Unable to create console host.
314+
throw hostException;
315+
}
307316

308-
if (LoadPSReadline())
309-
{
310-
ProfileOptimization.StartProfile("StartupProfileData-Interactive");
317+
if (LoadPSReadline())
318+
{
319+
ProfileOptimization.StartProfile("StartupProfileData-Interactive");
311320

312-
if (UpdatesNotification.CanNotifyUpdates)
313-
{
314-
// Start a task in the background to check for the update release.
315-
_ = UpdatesNotification.CheckForUpdates();
316-
}
317-
}
318-
else
321+
if (UpdatesNotification.CanNotifyUpdates)
319322
{
320-
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
323+
// Start a task in the background to check for the update release.
324+
_ = UpdatesNotification.CheckForUpdates();
321325
}
326+
}
327+
else
328+
{
329+
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
330+
}
322331

323-
s_theConsoleHost.BindBreakHandler();
324-
IsStdOutputRedirected = Console.IsOutputRedirected;
332+
s_theConsoleHost.BindBreakHandler();
333+
IsStdOutputRedirected = Console.IsOutputRedirected;
325334

326-
// Send startup telemetry for ConsoleHost startup
327-
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
335+
// Send startup telemetry for ConsoleHost startup
336+
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
328337

329-
exitCode = s_theConsoleHost.Run(s_cpp, false);
330-
}
338+
return unchecked((int)s_theConsoleHost.Run(s_cpp, false));
331339
}
332340
finally
333341
{
@@ -349,11 +357,6 @@ internal static int Start(
349357
}
350358
#pragma warning restore IDE0031
351359
}
352-
353-
unchecked
354-
{
355-
return (int)exitCode;
356-
}
357360
}
358361

359362
internal static void ParseCommandLine(string[] args)

‎src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,4 +228,13 @@ Valid formats are:
228228
<data name="MissingMandatoryArgument" xml:space="preserve">
229229
<value>An argument is required to be supplied to the '{0}' parameter.</value>
230230
</data>
231+
<data name="FileOnlyEntryRequired" xml:space="preserve">
232+
<value>The parameter "-File" is required by policy.</value>
233+
</data>
234+
<data name="FileOnlyEntryNoExitDisabled" xml:space="preserve">
235+
<value>The parameter "-NoExit" is disallowed by policy.</value>
236+
</data>
237+
<data name="FileOnlyEntryServerMode" xml:space="preserve">
238+
<value>Server mode is disallowed by policy.</value>
239+
</data>
231240
</root>

0 commit comments

Comments
 (0)