[release/v7.4] Fallback to AppLocker after `WldpCanExecuteFile` by TravisEz13 · Pull Request #25229 · PowerShell/PowerShell
Backport #24912
This pull request includes several changes to the src/System.Management.Automation/security/wldpNativeMethods.cs file to improve the handling of system lockdown policies and file policy enforcement. The changes primarily focus on refining the logic for determining enforcement modes and handling exceptions more effectively.
Key changes include:
Improvements to system lockdown policy handling:
- Modified the
GetSystemLockdownPolicymethod to use an out parameter forGetDebugLockdownPolicy. - Added a new method
ConvertToModernFileEnforcementto convert legacy enforcement modes to modern file enforcement modes.
Enhancements to file policy enforcement:
- Updated the
GetFilePolicyEnforcementmethod to use the newConvertToModernFileEnforcementmethod and added logic to handle different enforcement scenarios more accurately. - Introduced the
TryGetWldpCanExecuteFileResultmethod to handle the result ofWldpCanExecuteFileand fallback to legacy APIs if necessary.
Exception handling improvements:
- Refined the exception handling in
GetFilePolicyEnforcementto catch bothDllNotFoundExceptionandEntryPointNotFoundExceptionand log the appropriate events.
Additional minor changes:
- Added
System.Diagnosticsusing directive for better debugging support. - Adjusted the
GetDebugLockdownPolicymethod to use an out parameter for modern enforcement. [1] [2] [3]
These changes collectively enhance the robustness and accuracy of the system's lockdown policy and file enforcement mechanisms.