Major changes are:
- Rename `s_wasSystemPolicyDebugPolicy` to `s_allowDebugOverridePolicy` to make it less confusing. Also slightly refactor `HelperSecurity.psm1` and `ConstrainedLanguageDebugger.Tests.ps1` to remove unneeded code. There is no functional change in this commit.
- Remove the unneeded static property `IsInbox`, as PowerShell Core won't be shipped in-box with Windows in the foreseeable feature. Even if we do in future, we won't be needing it because Windows PowerShell will probably be gone by that time.
- Update 'BindRunspace' to avoid getting all commands and unneeded method calls.
- Avoid creating a `IsSafeValueVisitor` every time when `IsScriptBlockInFactASafeHashtable` runs.
- Use File.GetAttributes() instead of p/invokes to check for existence of FileSystem items. The method throws access exceptions which we use for better error messages.
- Remove the word 'Native' from method names.
These changes port Windows PowerShell support for Applocker and DeviceGuard User Mode Code Integrity (UMCI) to PSCore6. Windows PowerShell uses public APIs to determine if a system is in locked down mode via AppLocker or DeviceGuard, and automatically runs in constrained language mode. For more information about PowerShell constrained language, see: https://blogs.msdn.microsoft.com/powershell/2017/11/02/powershell-constrained-language-mode/
This support for application whitelisting has mostly existed in PSCore6, but the primary APIs were stubbed out in CorePSStub.cs because they relied on Windows only DeviceGuard (wldp.dll) and AppLocker (Safer APIs) public APIs. These changes re-implement PowerShell lock down APIs on PSCore6 for Windows platforms only. The AppLocker and DeviceGuard public APIs are currently only implemented in Windows OSes and are not supported on Linux or MacOS platforms.
Tests have also been ported to PSCore6 and run only for Windows platforms.
Based on standard practices, we need to have a copyright and license notice at the top of each source file. Removed existing copyrights and updated/added copyright notices for .h, .cpp, .cs, .ps1, and .psm1 files.
Updated module manifests for consistency to have Author = "PowerShell" and Company = "Microsoft Corporation". Removed multiple line breaks.
Separate PR coming to update contribution document for new source files: #6140
Manually reviewed each change.
Fix#6073
This PR is divided into the following areas:
1. Add/Rename the PowerShell/Windows ETW manifest to the repo and change both the provider id (guid) and name. See #4939.
The manifest is at tools/resxgen/PowerShell-Core-Instrumentation.man
2. Generate a resx file containing the string resources needed for logging ETW events to syslog.
This is accomplished by tools\resxgen\resxgen.psm1 and resxgen.ps1. The tool generates two files
A resx file containing string resources for each message string from the manifest. This is generated in the System.Management.Automation\gen directory.
A C# class (EventResource) that provides the mapping between the integer event id and the associated string resource name. The file is generated in the System.Management.Automation\CoreCLR directory with a compile-time condition of UNIX
NOTE: The EventResource.cs class generated by resgen is explicitly ignored in the csproj file; it is not used.
3. SMA\utils\tracing\PSSysLogProvider.cs
Implements the abstract LogProvider class and is the syslog equivalent of PSEtwLogProvider. The class contains a number of logical methods for logging lifecycle, health, and normal events.
4. SMA\utils\tracing\SysLogProvider.cs
This is the Syslog equivalent of ETW's log provider class and implements a Log method versus ETW's EventWrite. It is also responsible for resolving event ids to resource names and performing the Syslog call. There is a large comment block in the class XML doc that describes the types of log output it produces.
5. SMA\utils\tracing\PSEtwLog.cs
PowerShell's current implementation is tightly coupled to this class; with code calling it directly for all events. To simplify integration of syslog, I updated the class to create an instance of PSSysLogProvider on Linux and removed the Linux-specific stub file.
6. SMA\engine\PropertyAccessor.cs
This class provides a wrapper around PowerShellProperties.json and has been extended to have Unix-specific assessors for configuring logging. Note that the file is expected to be in the $PSHOME directory to ensure SxS.
Currently, there are four configuration properties:
- LogIdentity - the string identifier for the source application. This defaults to 'powershell' and can be configured to enable distinguishing between side-by-side installations.
- LogLevel - configures the tracing level (log level). Informational is the defauilt.
- LogChannels - used to enable operational and analytic logging. Operational is the default.
- LogKeywords - used to configure enabling tracing by keyword. All keywords other than `UseAlwaysAnalytic` are enabled by default.
NOTE: This will likely change. PowerShell sometimes confuses the analytic channel with this keyword and sends logging to the wrong channel. Once this is cleared up, `UseAlwaysAnalytic` and `UseAlwaysOperational` keywords will likely be removed.
Additional Notes:
1. The current implementation writes directly to syslog and writing to a separate log file is still pending.
2. The generated class and resx are not part of the build; instead, it is expected that Resxgen should be run when events are added to the manifest. To fully automate the process, resxgen will need to be updated to generate the other dependent enums such as 'PSChannel', 'PSEventId', 'PSTask', 'PSOpcode', etc. You will see parsing logic in resxgen.psm1 to prepare for that but it is not enabled at this point.
4. Documentation is pending that documents the format of the syslog output as well as associated configuration.
5. As mentioned at the start, tests are pending
- Rename powershell.exe to pwsh.exe
- Fixe appveyor.psm1
- Update MSI to include 'pwsh' in path and app paths
- Revert change for hyper-v powershell direct
- Update names in packaging.psm1.
- Fix check for SxS
The code in `AssemblyLoadContext.dll` doesn't need to be in a separate DLL anymore.
S.M.A.dll depends on `AssemblyLoadContext.dll`, so keeping that code out of S.M.A.dll doesn't help make S.M.A smaller size or less dependent. So the code in `AssemblyLoadContext.dll` is moved to `S.M.A.dll` and then we remove `AssemblyLoadContext.dll`.
The changes are:
- Move `CorePsAssemblyLoadContext.cs` to `src\S.M.A\CoreCLR\`
- Update `CorePsAssemblyLoadContext.cs` to get the test took moved to `Utils.InternalTestHooks` and update tests
- Update `build.psm1` and `.csproj` accrodingly
- Update `pwrshcommon.cpp` to remove `AssemblyLoadContext.dll` from the TPA list.
- `S.M.A.AssemblyExtensions` is removed as `PackageManagement` has finished their move to .NET Core 2.0. (I will work with Bryan to get the latest version uploaded to powershell-core)
* Clean up ShellExecuteHelper and enable ShellExecute in NativeCommandProcessor
* Minor fix
* [Feature] Fix NativeCommandProcessor to clean up in case an exception is thron
* [Feature] Update tests
* [Feature] Address comments
* address one more comment
* Address some more comments
Make `System.Management.Automation references` to package `System.Security.Permissions`, which brings back `SecurityZone` and `System.Security.Policy.Zone`.
Add the dynamic parameter `-FollowSymlink` to `Get-ChildItem`.
Add a mechanism for tracking visited directories.
Add native code to get device/inode information on Unix/Windows.
Add warning when refusing to enter an already-visited directory.
* Fix SSH process creation on Linux platforms
* Fixed typos
* Added UNIX managed code StartProcess
* Fixed compile errors
* Changed process create to return pid
* Now resolve full SSH command file path for all platforms
* Removed data reader error handling because it conflicts with SSH errors in the error stream
* Clean up work
* Fix for file line endings
* More clean up
* Change to Linux platform SSH process creation to create process in new session
* Added third party license text for DotNet Core
* Removed process creation in new session and added suppress SIGINT
* Removed unneeded code for creating SSH process
* Fixed Unix compile errors
* Changes for code review
* Response to more code review comments
* Removed unneeded using statements
Remove the code that spins up our own assembly load context. Keep the code that registers our `Resolve` method to the default loader's `Resolving` event, so that we can continue to do special assembly resolution as needed (such as the GAC probing logic needed for consuming FullCLR PS modules).
Essentially, the assembly `Microsoft.PowerShell.CoreCLR.AssemblyLoadContext.dll` is not needed anymore, the remaining code should be moved to S.M.A.dll. However, that will break DSC and other native hosts that are hosting powershell. So this assembly is kept for now.
Use 2.0 CLI/SDK of version `2.0.0-preview1-005952` to keep in sync with the .NET Core 2.0 //Build dogfood instructions. The version of `Microsoft.NetCore.App` in use is `2.0.0-preview1-002106-00`.
Rather than relying on case-insensitive string compares of source and destination paths, use operating system calls to determine whether two paths refer to the same file. This solves not only the case-insensitivity issue but also allows the cmdlet to operate properly if the destination is a hard or symbolic link to the source.
The Windows side is implemented in C#. The Unix side is implemented partially in native code.
This change moves powershell to .NET Core 2.0. Major changes are:
1. PowerShell assemblies are now targeting `netcoreapp2.0`. We are using `microsoft.netcore.app-2.0.0-preview1-001913-00`, which is from dotnet-core build 4/4/17. We cannot target `netstandard2.0` because the packages `System.Reflection.Emit` and `System.Reflection.Emit.Lightweight`, which are needed for powershell class, cannot be referenced when targeting `netstandard2.0`.
2. Refactor code to remove most CLR stub types and extension types.
3. Update build scripts to enable CI builds. The `-cache` section is specified to depend on `appveyor.yml`, so the cache will be invalidated if `appveyor.yml` is changed.
4. Ship `netcoreapp` reference assemblies with powershell to fix the issues in `Add-Type` (#2764). By default `Add-Type` will reference all those reference assemblies when compiling C# code. If `-ReferenceAssembly` is specified, then we search reference assemblies first, then the framework runtime assemblies, and lastly the loaded assemblies (possibly a third-party one that was already loaded).
5. `dotnet publish` generates executable on Unix platforms, but doesn't set "x" permission and thus it cannot execute. Currently, the "x" permission is set in the build script, `dotnet/cli` issue [#6286](https://github.com/dotnet/cli/issues/6286) is tracking this.
6. Replace the use of some APIs with the ones that take `SecureString`.
7. osx.10.12 is required to update to `netcoreapp2.0` because `dotnet-cli` 2.0.0-preview only works on osx.10.12.
8. Add dependency to `System.ValueTuple` to work around a ambiguous type identity issue in coreclr. The issue is tracked by `dotnet/corefx` [#17797](https://github.com/dotnet/corefx/issues/17797). When moving to newer version of `netcoreapp2.0`, we need to verify if this dependency is still needed.
There are cases like using PowerShell via Puppet where the account being
used does not have a home directory. Updated PowerShell to use a process
specific temporary directory if HOME, CONFIG, CACHE, and DATA directories
are not available. Temporary directory is removed when last runspace
is disposed.
XDG profile directory creation can fail for accounts that do not have home directories.
The module analysis was trying to persist it's cache in an XDG profile directory.
The cache is less critical than it once was, so it's reasonable to not cache if there is no good place to do so.
Fixes#3011
* Fixes#2534 by replacing expensive WMI query with Win32 API calls
* fix break on unix build
* added tests for #2535
* although test passed, fixing exception that shows up
* fixed Describe text
* addressing code review feedback
* addressing review feedback to comment on why sleep is needed
added check that test processes are created before we try to kill them
* fixed test to timeout and pending fix for #2561
This is verified to work "correctly" on Linux in that it gets the
`perror` for the last set value of errno in native code.
No extra mapping or handling needs to be done on our part.
Keeping the strerror_r implementation in the history for the valuable
implementation of config.h.in in the library.
PowerShell has some stubs to enable code to almost sort of work with things.
Some of the stubs try to say "Do not use me".
This commit corrects the grammar of the message.
Previously the message tried to apply a past tense form to `hit`,
but the past tense of `hit` is `hit`, and while breakpoints can
be hit, it's better to talk to the user about what should be done/
should not be done.
Dongbo Wang