PowerShell · daxian-dbw · May 22, 2023 · Mar 14, 2023 · Mar 15, 2023 · Mar 16, 2023
diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/AddType.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/AddType.cs
@@ -556,15 +556,24 @@ protected override void BeginProcessing()
         {
             // Prevent code compilation in ConstrainedLanguage mode, or NoLanguage mode under system lock down.
             if (SessionState.LanguageMode == PSLanguageMode.ConstrainedLanguage ||
-                (SessionState.LanguageMode == PSLanguageMode.NoLanguage && 
-                 SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce))
+                (SessionState.LanguageMode == PSLanguageMode.NoLanguage && SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce))
             {
-                ThrowTerminatingError(
-                    new ErrorRecord(
-                        new PSNotSupportedException(AddTypeStrings.CannotDefineNewType),
-                        nameof(AddTypeStrings.CannotDefineNewType),
-                        ErrorCategory.PermissionDenied,
-                        targetObject: null));
+                if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
+                {
+                    ThrowTerminatingError(
+                        new ErrorRecord(
+                            new PSNotSupportedException(AddTypeStrings.CannotDefineNewType),
+                            nameof(AddTypeStrings.CannotDefineNewType),
+                            ErrorCategory.PermissionDenied,
+                            targetObject: null));
+                }
+
+                SystemPolicy.LogWDACAuditMessage(
+                    context: Context,
+                    title: AddTypeStrings.AddTypeLogTitle,
+                    message: AddTypeStrings.AddTypeLogMessage,
+                    fqid: "AddTypeCmdletDisabled",
+                    dropIntoDebugger: true);
             }
 
             // 'ConsoleApplication' and 'WindowsApplication' types are currently not working in .NET Core

diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/Import-LocalizedData.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/Import-LocalizedData.cs
@@ -7,6 +7,7 @@
 using System.IO;
 using System.Management.Automation;
 using System.Management.Automation.Internal;
+using System.Management.Automation.Security;
 
 namespace Microsoft.PowerShell.Commands
 {
@@ -146,16 +147,23 @@ protected override void ProcessRecord()
             }
 
             // Prevent additional commands in ConstrainedLanguage mode
-            if (Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
+            if (_setSupportedCommand && Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
             {
-                if (_setSupportedCommand)
+                if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
                 {
                     NotSupportedException nse =
                         PSTraceSource.NewNotSupportedException(
                             ImportLocalizedDataStrings.CannotDefineSupportedCommand);
                     ThrowTerminatingError(
                         new ErrorRecord(nse, "CannotDefineSupportedCommand", ErrorCategory.PermissionDenied, null));
                 }
+
+                SystemPolicy.LogWDACAuditMessage(
+                    context: Context,
+                    title: ImportLocalizedDataStrings.WDACLogTitle,
+                    message: ImportLocalizedDataStrings.WDACLogMessage,
+                    fqid: "SupportedCommandsDisabled",
+                    dropIntoDebugger: true);
             }
 
             string script = GetScript(path);

diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/InvokeExpressionCommand.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/InvokeExpressionCommand.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Management.Automation;
 using System.Management.Automation.Internal;
+using System.Management.Automation.Security;
 
 namespace Microsoft.PowerShell.Commands
 {
@@ -43,6 +44,16 @@ protected override void ProcessRecord()
                 myScriptBlock.LanguageMode = PSLanguageMode.ConstrainedLanguage;
             }
 
+            if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Audit)
+            {
+                SystemPolicy.LogWDACAuditMessage(
+                    context: Context,
+                    title: UtilityCommonStrings.IEXWDACLogTitle,
+                    message: UtilityCommonStrings.IEXWDACLogMessage,
+                    fqid: "InvokeExpressionCmdletConstrained",
+                    dropIntoDebugger: true);
+            }
+
             var emptyArray = Array.Empty<object>();
             myScriptBlock.InvokeUsingCmdlet(
                 contextCmdlet: this,

diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs
@@ -187,18 +187,30 @@ protected override void BeginProcessing()
                             targetObject: null));
                 }
 
-                if (Context.LanguageMode == PSLanguageMode.ConstrainedLanguage)
-                {
-                    if (!CoreTypes.Contains(type))
-                    {
-                        ThrowTerminatingError(
-                            new ErrorRecord(
-                                new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage), "CannotCreateTypeConstrainedLanguage", ErrorCategory.PermissionDenied, null));
-                    }
-                }
-
                 switch (Context.LanguageMode)
                 {
+                    case PSLanguageMode.ConstrainedLanguage:
+                        if (!CoreTypes.Contains(type))
+                        {
+                            if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
+                            {
+                                ThrowTerminatingError(
+                                    new ErrorRecord(
+                                        new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage), 
+                                        "CannotCreateTypeConstrainedLanguage",
+                                        ErrorCategory.PermissionDenied,
+                                        targetObject: null));
+                            }
+
+                            SystemPolicy.LogWDACAuditMessage(
+                                context: Context,
+                                title: NewObjectStrings.TypeWDACLogTitle,
+                                message: StringUtil.Format(NewObjectStrings.TypeWDACLogMessage, type.FullName),
+                                fqid: "NewObjectCmdletCannotCreateType",
+                                dropIntoDebugger: true);
+                        }
+                        break;
+
                     case PSLanguageMode.NoLanguage:
                     case PSLanguageMode.RestrictedLanguage:
                         if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce
@@ -212,8 +224,7 @@ protected override void BeginProcessing()
                                     ErrorCategory.PermissionDenied,
                                     targetObject: null));
                         }
-
-                    break;
+                        break;
                 }
 
                 // WinRT does not support creating instances of attribute & delegate WinRT types.
@@ -301,21 +312,31 @@ protected override void BeginProcessing()
                     bool isAllowed = false;
 
                     // If it's a system-wide lockdown, we may allow additional COM types
-                    if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce)
+                    var systemLockdownPolicy = SystemPolicy.GetSystemLockdownPolicy();
+                    if (systemLockdownPolicy == SystemEnforcementMode.Enforce || systemLockdownPolicy == SystemEnforcementMode.Audit)
                     {
-                        if ((result >= 0) &&
-                            SystemPolicy.IsClassInApprovedList(_comObjectClsId))
-                        {
-                            isAllowed = true;
-                        }
+                        isAllowed = (result >= 0) && SystemPolicy.IsClassInApprovedList(_comObjectClsId);
                     }
 
                     if (!isAllowed)
                     {
-                        ThrowTerminatingError(
-                            new ErrorRecord(
-                                new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage), "CannotCreateComTypeConstrainedLanguage", ErrorCategory.PermissionDenied, null));
-                        return;
+                        if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
+                        {
+                            ThrowTerminatingError(
+                                new ErrorRecord(
+                                    new PSNotSupportedException(NewObjectStrings.CannotCreateTypeConstrainedLanguage),
+                                    "CannotCreateComTypeConstrainedLanguage",
+                                    ErrorCategory.PermissionDenied,
+                                    targetObject: null));
+                            return;
+                        }
+
+                        SystemPolicy.LogWDACAuditMessage(
+                            context: Context,
+                            title: NewObjectStrings.ComWDACLogTitle,
+                            message: StringUtil.Format(NewObjectStrings.ComWDACLogMessage, ComObject ?? string.Empty),
+                            fqid: "NewObjectCmdletCannotCreateCOM",
+                            dropIntoDebugger: true);
                     }
                 }
 

diff --git a/src/Microsoft.PowerShell.Commands.Utility/resources/AddTypeStrings.resx b/src/Microsoft.PowerShell.Commands.Utility/resources/AddTypeStrings.resx
@@ -150,4 +150,10 @@
   <data name="AssemblyTypeNotSupported" xml:space="preserve">
     <value>Both the assembly types 'ConsoleApplication' and 'WindowsApplication' are not currently supported.</value>
   </data>
+  <data name="AddTypeLogTitle" xml:space="preserve">
+    <value>Add-Type Cmdlet</value>
+  </data>
+  <data name="AddTypeLogMessage" xml:space="preserve">
+    <value>Add-Type cmdlet will not be allowed in ConstrainedLanguage mode.</value>
+  </data>
 </root>
diff --git a/src/Microsoft.PowerShell.Commands.Utility/resources/ImportLocalizedDataStrings.resx b/src/Microsoft.PowerShell.Commands.Utility/resources/ImportLocalizedDataStrings.resx
@@ -143,4 +143,10 @@
   <data name="IncorrectVariableName" xml:space="preserve">
     <value>The BindingVariable name '{0}' is invalid.</value>
   </data>
+  <data name="WDACLogTitle" xml:space="preserve">
+    <value>Import-LocalizedData Cmdlet</value>
+  </data>
+  <data name="WDACLogMessage" xml:space="preserve">
+    <value>Additional supported commands (via SupportedCommand parameter) will not be allowed in ConstrainedLanguage mode.</value>
+  </data>
 </root>
diff --git a/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx b/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx
@@ -147,4 +147,16 @@
   <data name="CannotCreateTypeLanguageMode" xml:space="preserve">
     <value>Cannot create type. Only core types are supported in {0} language mode on a policy locked down machine.</value>
   </data>
+  <data name="TypeWDACLogTitle" xml:space="preserve">
+    <value>New-Object Cmdlet Type Creation</value>
+  </data>
+  <data name="TypeWDACLogMessage" xml:space="preserve">
+    <value>The type '{0}' will not be created in ConstrainedLanguage mode.</value>
+  </data>
+  <data name="ComWDACLogTitle" xml:space="preserve">
+    <value>New-Object Cmdlet COM Object Creation</value>
+  </data>
+  <data name="ComWDACLogMessage" xml:space="preserve">
+    <value>The COM object '{0}' will not be created in ConstrainedLanguage mode.</value>
+  </data>
 </root>
diff --git a/src/Microsoft.PowerShell.Commands.Utility/resources/UtilityCommonStrings.resx b/src/Microsoft.PowerShell.Commands.Utility/resources/UtilityCommonStrings.resx
@@ -168,4 +168,10 @@
   <data name="InvalidSDDL" xml:space="preserve">
     <value>Cannot construct a security descriptor from the given SDDL due to the following error: {0}</value>
   </data>
+  <data name="IEXWDACLogTitle" xml:space="preserve">
+    <value>Invoke-Expression Cmdlet</value>
+  </data>
+  <data name="IEXWDACLogMessage" xml:space="preserve">
+    <value>Invoke-Expression cmdlet script block will be run in ConstrainedLanguage mode.</value>
+  </data>
 </root>
diff --git a/src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs b/src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs
@@ -16,6 +16,7 @@
 using System.Management.Automation.Remoting;
 using System.Management.Automation.Remoting.Server;
 using System.Management.Automation.Runspaces;
+using System.Management.Automation.Security;
 using System.Management.Automation.Subsystem.Feedback;
 using System.Management.Automation.Tracing;
 using System.Reflection;
@@ -1839,7 +1840,14 @@ private void DoRunspaceInitialization(RunspaceCreationEventArgs args)
                     switch (languageMode)
                     {
                         case PSLanguageMode.ConstrainedLanguage:
-                            s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLMode);
+                            if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
+                            {
+                                s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLMode);
+                            }
+                            else
+                            {
+                                s_theConsoleHost.UI.WriteLine(ManagedEntranceStrings.ShellBannerCLAuditMode);
+                            }
                             break;
 
                         case PSLanguageMode.NoLanguage:

diff --git a/src/Microsoft.PowerShell.ConsoleHost/resources/ManagedEntranceStrings.resx b/src/Microsoft.PowerShell.ConsoleHost/resources/ManagedEntranceStrings.resx
@@ -123,6 +123,9 @@
   <data name="ShellBannerCLMode" xml:space="preserve">
     <value>[Constrained Language Mode]</value>
   </data>
+  <data name="ShellBannerCLAuditMode" xml:space="preserve">
+    <value>[Constrained Language AUDIT Mode : No Restrictions]</value>
+  </data>
   <data name="ShellBannerNLMode" xml:space="preserve">
     <value>[No Language Mode]</value>
   </data>

diff --git a/src/System.Management.Automation/CoreCLR/CorePsStub.cs b/src/System.Management.Automation/CoreCLR/CorePsStub.cs
@@ -435,6 +435,23 @@ internal sealed class SystemPolicy
     {
         private SystemPolicy() { }
 
+        /// <summary>
+        /// Writes to PowerShell WDAC Audit mode ETW log.
+        /// </summary>
+        /// <param name="context">Current execution context.</param>
+        /// <param name="title">Audit message title.</param>
+        /// <param name="message">Audit message message.</param>
+        /// <param name="fqid">Fully Qualified ID.</param>
+        /// <param name="dropIntoDebugger">Stops code execution and goes into debugger mode.</param>
+        internal static void LogWDACAuditMessage(
+            ExecutionContext context,
+            string title,
+            string message,
+            string fqid,
+            bool dropIntoDebugger = false)
+        {
+        }
+
         /// <summary>
         /// Gets the system lockdown policy.
         /// </summary>
@@ -511,7 +528,12 @@ public enum SystemScriptFileEnforcement
         /// <summary>
         /// Script file is allowed to run in ConstrainedLanguage mode only.
         /// </summary>
-        AllowConstrained = 3
+        AllowConstrained = 3,
+
+        /// <summary>
+        /// Script file is allowed to run in FullLanguage mode but will emit ConstrainedLanguage restriction audit logs.
+        /// </summary>
+        AllowConstrainedAudit = 4
     }
 }
 

diff --git a/src/System.Management.Automation/engine/Attributes.cs b/src/System.Management.Automation/engine/Attributes.cs
@@ -9,6 +9,7 @@
 using System.Linq;
 using System.Management.Automation.Internal;
 using System.Management.Automation.Language;
+using System.Management.Automation.Security;
 using System.Runtime.CompilerServices;
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
@@ -1829,11 +1830,21 @@ protected override void Validate(object arguments, EngineIntrinsics engineIntrin
             {
                 if (ExecutionContext.IsMarkedAsUntrusted(arguments))
                 {
-                    throw new ValidationMetadataException(
-                        "ValidateTrustedDataFailure",
-                        null,
-                        Metadata.ValidateTrustedDataFailure,
-                        arguments);
+                    if (SystemPolicy.GetSystemLockdownPolicy() != SystemEnforcementMode.Audit)
+                    {
+                        throw new ValidationMetadataException(
+                            "ValidateTrustedDataFailure",
+                            null,
+                            Metadata.ValidateTrustedDataFailure,
+                            arguments);
+                    }
+
+                    SystemPolicy.LogWDACAuditMessage(
+                        context: null,
+                        title: Metadata.WDACParameterArgNotTrustedLogTitle,
+                        message: StringUtil.Format(Metadata.WDACParameterArgNotTrustedMessage, arguments),
+                        fqid: "ParameterArgumentNotTrusted",
+                        dropIntoDebugger: true);
                 }
             }
         }

diff --git a/src/System.Management.Automation/engine/CommandProcessor.cs b/src/System.Management.Automation/engine/CommandProcessor.cs
@@ -227,6 +227,7 @@ internal override void Prepare(IDictionary psDefaultParameterValues)
                     Context.LanguageMode = scriptCmdletInfo.ScriptBlock.LanguageMode.Value;
 
                     // If it's from ConstrainedLanguage to FullLanguage, indicate the transition before parameter binding takes place.
+                    // When transitioning to FullLanguage mode, we don't want any ConstrainedLanguage restrictions or incorrect Audit messages.
                     if (oldLanguageMode == PSLanguageMode.ConstrainedLanguage && Context.LanguageMode == PSLanguageMode.FullLanguage)
                     {
                         oldLangModeTransitionStatus = Context.LanguageModeTransitionInParameterBinding;
@@ -779,7 +780,7 @@ private void Init(IScriptCommandInfo scriptCommandInfo)
             // If the script has been dotted, throw an error if it's from a different language mode.
             if (!this.UseLocalScope)
             {
-                ValidateCompatibleLanguageMode(scriptCommandInfo.ScriptBlock, _context.LanguageMode, Command.MyInvocation);
+                ValidateCompatibleLanguageMode(scriptCommandInfo.ScriptBlock, _context, Command.MyInvocation);
             }
         }