Skip to content

[release/v7.6.6] Add support for new WLDP setting EnableFileOnlyEntry #27922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Patrick Meinecke (SeeminglyScience) merged 1 commit into from
Sep 1, 2026
Merged

[release/v7.6.6] Add support for new WLDP setting EnableFileOnlyEntry #27922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions src/Microsoft.PowerShell.ConsoleHost/host/msh/CommandLineParameterParser.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
using System.Management.Automation.Internal;
using System.Management.Automation.Language;
using System.Management.Automation.Runspaces;
using System.Management.Automation.Security;
using System.Security;
using System.Text;

Expand Down Expand Up @@ -878,10 +879,27 @@ internal void Parse(string[] args)
ParseHelper(args);
}

internal static bool IsFileOnlyEntryEnabled
{
get
{
#if UNIX
return false;
#else
return SystemPolicy.IsFileOnlyEntryEnabled();
#endif
}
}

private void ParseHelper(string[] args)
{
if (args.Length == 0)
{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
}

return;
}

Expand Down Expand Up @@ -927,6 +945,12 @@ private void ParseHelper(string[] args)
_noExit = true;
noexitSeen = true;
ParametersUsed |= ParameterBitmap.NoExit;

if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryNoExitDisabled);
break;
}
}
else if (MatchSwitch(switchKey, "noprofile", "nop"))
{
Expand All @@ -948,32 +972,57 @@ private void ParseHelper(string[] args)
_socketServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.SocketServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
#if !UNIX
else if (MatchSwitch(switchKey, "v2socketservermode", "v2so"))
{
_v2SocketServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.V2SocketServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
#endif
else if (MatchSwitch(switchKey, "servermode", "s"))
{
_serverMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.ServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "namedpipeservermode", "nam"))
{
_namedPipeServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.NamedPipeServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "sshservermode", "sshs"))
{
_sshServerMode = true;
_showBanner = false;
ParametersUsed |= ParameterBitmap.SSHServerMode;
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryServerMode);
break;
}
}
else if (MatchSwitch(switchKey, "noprofileloadtime", "noprofileloadtime"))
{
Expand Down Expand Up @@ -1263,6 +1312,15 @@ private void ParseHelper(string[] args)
}
}

if (_error is null
&& !_showVersion
&& !_showHelp
&& !ParametersUsed.HasFlag(ParameterBitmap.File)
&& IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
}

Dbg.Assert(
((_exitCode == ConsoleHost.ExitCodeBadCommandLineParameter) && _abortStartup)
|| (_exitCode == ConsoleHost.ExitCodeSuccess),
Expand Down Expand Up @@ -1360,6 +1418,12 @@ private bool ParseFile(string[] args, ref int i, bool noexitSeen)
// Process interactive input...
if (args[i] == "-")
{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
return false;
}

// the arg to -file is -, which is secret code for "read the commands from stdin with prompts"

_explicitReadCommandsFromStdin = true;
Expand Down Expand Up @@ -1492,6 +1556,12 @@ static object ConvertToBoolIfPossible(string arg)

private bool ParseCommand(string[] args, ref int i, bool noexitSeen, bool isEncoded)
{
if (IsFileOnlyEntryEnabled)
{
SetCommandLineError(CommandLineParameterParserStrings.FileOnlyEntryRequired);
return false;
}

if (_commandLineCommand != null)
{
// we've already set the command, so squawk
Expand Down
85 changes: 44 additions & 41 deletions src/Microsoft.PowerShell.ConsoleHost/host/msh/ConsoleHost.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,8 +165,6 @@ internal static int Start(
// improve startup performance.
}

uint exitCode = ExitCodeSuccess;

Thread.CurrentThread.Name = "ConsoleHost main thread";

try
Expand All @@ -192,7 +190,7 @@ internal static int Start(
// or start up the engine and retrieve the information via $psversiontable.GitCommitId
// but this returns the semantic version and avoids executing a script
s_theConsoleHost.UI.WriteLine($"PowerShell {PSVersionInfo.GitCommitId}");
return 0;
return ExitCodeSuccess;
}

// Servermode parameter validation check.
Expand Down Expand Up @@ -223,6 +221,14 @@ internal static int Start(
return ExitCodeBadCommandLineParameter;
}

if (serverModeCount is 1 && CommandLineParameterParser.IsFileOnlyEntryEnabled)
{
// User facing error message should already be written by the parser,
// so just trace and exit.
s_tracer.TraceError("Server mode cannot be specified when FileOnlyEntry policy is in place.");
return ExitCodeBadCommandLineParameter;
}

#if !UNIX
TaskbarJumpList.CreateRunAsAdministratorJumpList();
#endif
Expand All @@ -237,9 +243,10 @@ internal static int Start(
configurationName: null,
configurationFile: s_cpp.ConfigurationFile,
combineErrOutStream: false);
exitCode = 0;
return ExitCodeSuccess;
}
else if (s_cpp.SSHServerMode)

if (s_cpp.SSHServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SSHServer", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-SSHServerMode");
Expand All @@ -249,18 +256,20 @@ internal static int Start(
configurationName: null,
configurationFile: s_cpp.ConfigurationFile,
combineErrOutStream: true);
exitCode = 0;
return ExitCodeSuccess;
}
else if (s_cpp.NamedPipeServerMode)

if (s_cpp.NamedPipeServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("NamedPipe", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-NamedPipeServerMode");
RemoteSessionNamedPipeServer.RunServerMode(
configurationName: s_cpp.ConfigurationName);
exitCode = 0;
return ExitCodeSuccess;
}
#if !UNIX
else if (s_cpp.V2SocketServerMode)

if (s_cpp.V2SocketServerMode)
{
if (s_cpp.Token == null)
{
Expand All @@ -284,50 +293,49 @@ internal static int Start(
token: s_cpp.Token,
tokenCreationTime: s_cpp.UTCTimestamp.Value);

exitCode = 0;
return ExitCodeSuccess;
}
#endif
else if (s_cpp.SocketServerMode)

if (s_cpp.SocketServerMode)
{
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("SocketServerMode", s_cpp.ParametersUsedAsDouble);
ProfileOptimization.StartProfile("StartupProfileData-SocketServerMode");
HyperVSocketMediator.Run(
initialCommand: s_cpp.InitialCommand,
configurationName: s_cpp.ConfigurationName);
exitCode = 0;
return ExitCodeSuccess;
}
else

// Run PowerShell in normal console mode.
if (hostException != null)
{
// Run PowerShell in normal console mode.
if (hostException != null)
{
// Unable to create console host.
throw hostException;
}
// Unable to create console host.
throw hostException;
}

if (LoadPSReadline())
{
ProfileOptimization.StartProfile("StartupProfileData-Interactive");
if (LoadPSReadline())
{
ProfileOptimization.StartProfile("StartupProfileData-Interactive");

if (UpdatesNotification.CanNotifyUpdates)
{
// Start a task in the background to check for the update release.
_ = UpdatesNotification.CheckForUpdates();
}
}
else
if (UpdatesNotification.CanNotifyUpdates)
{
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
// Start a task in the background to check for the update release.
_ = UpdatesNotification.CheckForUpdates();
}
}
else
{
ProfileOptimization.StartProfile("StartupProfileData-NonInteractive");
}

s_theConsoleHost.BindBreakHandler();
IsStdOutputRedirected = Console.IsOutputRedirected;
s_theConsoleHost.BindBreakHandler();
IsStdOutputRedirected = Console.IsOutputRedirected;

// Send startup telemetry for ConsoleHost startup
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);
// Send startup telemetry for ConsoleHost startup
ApplicationInsightsTelemetry.SendPSCoreStartupTelemetry("Normal", s_cpp.ParametersUsedAsDouble);

exitCode = s_theConsoleHost.Run(s_cpp, false);
}
return unchecked((int)s_theConsoleHost.Run(s_cpp, false));
}
finally
{
Expand All @@ -349,11 +357,6 @@ internal static int Start(
}
#pragma warning restore IDE0031
}

unchecked
{
return (int)exitCode;
}
}

internal static void ParseCommandLine(string[] args)
Expand Down
9 changes: 9 additions & 0 deletions src/Microsoft.PowerShell.ConsoleHost/resources/CommandLineParameterParserStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,4 +228,13 @@ Valid formats are:
<data name="MissingMandatoryArgument" xml:space="preserve">
<value>An argument is required to be supplied to the '{0}' parameter.</value>
</data>
<data name="FileOnlyEntryRequired" xml:space="preserve">
<value>The parameter "-File" is required by policy.</value>
</data>
<data name="FileOnlyEntryNoExitDisabled" xml:space="preserve">
<value>The parameter "-NoExit" is disallowed by policy.</value>
</data>
<data name="FileOnlyEntryServerMode" xml:space="preserve">
<value>Server mode is disallowed by policy.</value>
</data>
</root>
Loading
Loading