GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [WIP] Restrict read access by default to powershell core logs by SteveL-MSFT · Pull Request #29 · PowerShell/PowerShell-Native

Conversation

@SteveL-MSFT

@SteveL-MSFT Steve Lee (SteveL-MSFT) commented Aug 22, 2019

Copy link
Copy Markdown
Member

change ACL on Operational, Analytic, and Debug logs to be read only for local system, admins, server operators, and event log readers

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@SteveL-MSFT
change ACL on Operational, Analytic, and Debug logs to be read only f…
2a55d76 
…or local system, admins, server operators, and event log readers
@SteveL-MSFT
Steve Lee (SteveL-MSFT) requested a review from Travis Plunk (TravisEz13) August 22, 2019 16:47
@SteveL-MSFT Steve Lee (SteveL-MSFT) assigned Aditya Patwardhan (adityapatwardhan) Aug 22, 2019
TravisEz13
Travis Plunk (TravisEz13) reviewed Aug 23, 2019
View reviewed changes
Comment thread src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
symbol="C_OPERATIONAL"
type="Operational"
access="O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x1;;;S-1-5-32-573)"
>

@TravisEz13 Travis Plunk (TravisEz13) Aug 23, 2019

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inbox has these additional permissions:

InputObject                                                                       SideIndicator
-----------                                                                       -------------
NT AUTHORITY\BATCH: AccessAllowed (ListDirectory, WriteData)                      <=
NT AUTHORITY\INTERACTIVE: AccessAllowed (ListDirectory, WriteData)                <=
NT AUTHORITY\SERVICE: AccessAllowed (ListDirectory, WriteData)                    <=
NT AUTHORITY\WRITE RESTRICTED: AccessAllowed (ListDirectory, WriteData)           <=
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES: AccessAllowed (WriteData) <=
: AccessAllowed (WriteData)                                                       <=

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@TravisEz13 Travis Plunk (TravisEz13) Aug 23, 2019

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

batch, interactive and service shouldn't be allowed. I'm not sure about the other two.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@TravisEz13 Travis Plunk (TravisEz13) Aug 23, 2019

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reading https://techcommunity.microsoft.com/t5/Ask-The-Performance-Team/WS2008-Windows-Service-Hardening/ba-p/372702 Write restricted doesn't give a lot of value here either.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@TravisEz13 Travis Plunk (TravisEz13) Aug 23, 2019

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make sure our MSIX can write without APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@SteveL-MSFT Steve Lee (SteveL-MSFT) changed the title Restrict read access by default to powershell core logs DO NOT MERGE: Restrict read access by default to powershell core logs Aug 29, 2019
@SteveL-MSFT

Steve Lee (SteveL-MSFT) commented Aug 29, 2019

Copy link
Copy Markdown
Member Author

Let's wait on this one
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@adityapatwardhan Aditya Patwardhan (adityapatwardhan) changed the title DO NOT MERGE: Restrict read access by default to powershell core logs [WIP] Restrict read access by default to powershell core logs Sep 4, 2019
@adityapatwardhan

Aditya Patwardhan (adityapatwardhan) commented May 17, 2021

Copy link
Copy Markdown
Member

Steve Lee (@SteveL-MSFT) Is this something that will be worked on or should we close the PR?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@adityapatwardhan

Aditya Patwardhan (adityapatwardhan) commented Jan 3, 2023

Copy link
Copy Markdown
Member

Steve Lee (@SteveL-MSFT) - is this PR still needed?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TravisEz13 Travis Plunk (TravisEz13) TravisEz13 left review comments

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@adityapatwardhan Aditya Patwardhan (adityapatwardhan)

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@SteveL-MSFT @adityapatwardhan @TravisEz13
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.