Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Optimize 'GetSystemLockdownPolicy' for non-lockdown scenarios#13438

Merged
TravisEz13 merged 2 commits intoPowerShell:masterfrom
daxian-dbw:optimize
Aug 19, 2020
Merged

Optimize 'GetSystemLockdownPolicy' for non-lockdown scenarios#13438
TravisEz13 merged 2 commits intoPowerShell:masterfrom
daxian-dbw:optimize

Conversation

@daxian-dbw
Copy link
Member

PR Summary

Today, the implementation of GetSystemLockdownPolicy is optimized for lockdown scenarios, but dis-optimized for the more common non-lockdown scenario because the test hook will make this method call the Win32 API WldpGetLockdownPolicy every time. This PR attempts to improve it.

PR Checklist

@daxian-dbw daxian-dbw requested a review from TravisEz13 as a code owner August 14, 2020 17:35
@ghost ghost assigned iSazonov Aug 14, 2020
@daxian-dbw daxian-dbw requested a review from PaulHigin August 14, 2020 17:35
@daxian-dbw daxian-dbw assigned TravisEz13 and unassigned iSazonov Aug 14, 2020
@daxian-dbw
Copy link
Member Author

@PaulHigin You mentioned the registry check in GetDebugLockdownPolicy may not be needed anymore for our tests, can you please review and confirm if that's the case? If so, I can remove that part in this PR.

Copy link
Contributor

@PaulHigin PaulHigin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes LGTM. However, please also remove the debug registry check. AFAIK this is no longer needed and tests use the __PSLockdownPolicy environment variable. and 'System32' filename append. If any tests fail, we can look at them.

https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/security/wldpNativeMethods.cs#L360

I want to remove the registry check because users sometimes believe it is a 'secure' way to lock down PowerShell, which it is not. Since we are PowerShell Core I feel we can remove it safely. We can always re-add it if needed.

@ghost ghost added the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Aug 14, 2020
@daxian-dbw daxian-dbw changed the title [WIP] Optimize 'GetSystemLockdownPolicy' for non-lockdown scenarios Optimize 'GetSystemLockdownPolicy' for non-lockdown scenarios Aug 14, 2020
@ghost ghost removed the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Aug 14, 2020
@daxian-dbw
Copy link
Member Author

@TravisEz13 and @PaulHigin, thanks for the review!
I have removed the registry check in the debug hook code as @PaulHigin suggested.

Copy link
Contributor

@PaulHigin PaulHigin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the change!

@daxian-dbw
Copy link
Member Author

@TravisEz13 I think this PR is ready to merge.

@TravisEz13 TravisEz13 added the CL-Engine Indicates that a PR should be marked as an engine change in the Change Log label Aug 19, 2020
@TravisEz13 TravisEz13 added this to the 7.1.0-preview.7 milestone Aug 19, 2020
@TravisEz13 TravisEz13 merged commit 98dbaef into PowerShell:master Aug 19, 2020
@daxian-dbw daxian-dbw deleted the optimize branch August 21, 2020 22:04
@ghost
Copy link

ghost commented Sep 8, 2020

🎉v7.1.0-preview.7 has been released which incorporates this pull request.:tada:

Handy links:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CL-Engine Indicates that a PR should be marked as an engine change in the Change Log

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants