Skip to content

Commit 0d7b185

Browse files
nyanhpnyanhp
committed
Add new AppLocker template
1 parent 730f49b commit 0d7b185

19 files changed

Lines changed: 571 additions & 0 deletions

File tree

‎templates/AppLockerProject/.github/workflows/publish.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
publish:
9+
10+
runs-on: windows-latest
11+
12+
steps:
13+
- uses: actions/checkout@v1
14+
- name: Install Prerequisites
15+
run: .\build\vsts-prerequisites.ps1
16+
shell: powershell
17+
- name: Validate Configuration Data
18+
run: .\build\vsts-validate.ps1 -TestType ConfigurationData
19+
shell: powershell
20+
- name: Build
21+
run: .\build\vsts-build.ps1 -IncludeRsop
22+
shell: powershell
23+
- uses: actions/upload-artifact@v3
24+
with:
25+
name: build-artifacts
26+
path: |
27+
.\output\rsop
28+
.\output\policies
29+
- name: Validate Integration Tests
30+
run: .\build\vsts-validate.ps1 -TestType Integration
31+
shell: powershell
32+
- name: Publish
33+
run: .\build\vsts-publish.ps1
34+
shell: powershell

‎templates/AppLockerProject/.github/workflows/validate.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
on: [pull_request]
2+
3+
jobs:
4+
validate:
5+
6+
runs-on: windows-latest
7+
8+
steps:
9+
- uses: actions/checkout@v1
10+
- name: Install Prerequisites
11+
run: .\build\vsts-prerequisites.ps1
12+
shell: powershell
13+
- name: Validate
14+
run: .\build\vsts-validate.ps1 -TestType ConfigurationData
15+
shell: powershell
16+
- name: Build
17+
run: .\build\vsts-build.ps1 -IncludeRsop
18+
shell: powershell
19+
- uses: actions/upload-artifact@v3
20+
with:
21+
name: build-artifacts
22+
path: |
23+
.\output\rsop
24+
.\output\policies

‎templates/AppLockerProject/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
output
2+
testresults.xml

‎templates/AppLockerProject/azurepipelines.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
trigger:
2+
branches:
3+
include:
4+
- main
5+
6+
stages:
7+
- stage: build
8+
jobs:
9+
- job: Build
10+
displayName: 'Build AppLocker Artifacts'
11+
pool:
12+
name: Default
13+
workspace:
14+
clean: all
15+
steps:
16+
- task: PowerShell@2
17+
name: build
18+
displayName: 'Download prerequisites'
19+
inputs:
20+
filePath: '.\build\vsts-prerequisites.ps1'
21+
- task: PowerShell@2
22+
name: build
23+
displayName: Validate Configuration Data
24+
inputs:
25+
filePath: '.\build\vsts-validate.ps1'
26+
arguments: '-TestType ConfigurationData'
27+
- task: PowerShell@2
28+
name: build
29+
displayName: Build policy XML
30+
inputs:
31+
filePath: '.\build\vsts-build.ps1'
32+
arguments: '-IncludeRsop'
33+
34+
- task: PublishBuildArtifacts@1
35+
displayName: 'Publish Policy XML Files'
36+
inputs:
37+
PathtoPublish: 'output/Policies'
38+
ArtifactName: Policies
39+
40+
- task: PublishBuildArtifacts@1
41+
displayName: 'Publish Policy RSOP Files'
42+
inputs:
43+
PathtoPublish: 'output/Rsop'
44+
ArtifactName: Rsop
45+
46+
- stage: publish
47+
dependsOn: build
48+
jobs:
49+
- deployment: Dev
50+
displayName: Dev Deployment
51+
environment: Dev
52+
pool:
53+
name: Default
54+
workspace:
55+
clean: all
56+
strategy:
57+
runOnce:
58+
deploy:
59+
steps:
60+
- download: None
61+
62+
- task: DownloadBuildArtifacts@0
63+
displayName: 'Download Build Artifact: Rsop'
64+
inputs:
65+
buildType: 'current'
66+
artifactName: Rsop
67+
downloadPath: $(Build.SourcesDirectory)
68+
- task: DownloadBuildArtifacts@0
69+
displayName: 'Download Build Artifact: Policies'
70+
inputs:
71+
buildType: 'current'
72+
artifactName: Policies
73+
downloadPath: $(Build.SourcesDirectory)
74+
- task: PowerShell@2
75+
name: publishpolicies
76+
displayName: Publish policies
77+
inputs:
78+
filePath: '.\build\vsts-publish.ps1'
79+
arguments: '-OutputPath $(Build.SourcesDirectory)'
80+
81+
- stage: DscDeploymentTest
82+
dependsOn:
83+
- build
84+
- DscDeploymentDev
85+
jobs:
86+
- deployment: Test
87+
displayName: Test Deployment
88+
environment: Test
89+
pool:
90+
name: Default
91+
workspace:
92+
clean: all
93+
strategy:
94+
runOnce:
95+
deploy:
96+
steps:
97+
- download: None
98+
99+
- task: DownloadBuildArtifacts@0
100+
displayName: 'Download Build Artifact: MOF'
101+
inputs:
102+
buildType: 'current'
103+
artifactName: MOF
104+
downloadPath: $(Build.SourcesDirectory)
105+
106+
- task: CopyFiles@2
107+
name: DeployMofsToPullServer
108+
displayName: 'Deploy MOF Files to Pull Server'
109+
inputs:
110+
SourceFolder: '$(Build.SourcesDirectory)/MOF/$(Environment.Name)'
111+
Contents: '**'
112+
TargetFolder: '\\dscpull01\DscConfiguration'
113+
OverWrite: true
114+
115+
- stage: DscDeploymentProd
116+
dependsOn:
117+
- build
118+
- DscDeploymentTest
119+
jobs:
120+
- deployment: Prod
121+
displayName: Prodt Deployment
122+
environment: Prod
123+
pool:
124+
name: Default
125+
workspace:
126+
clean: all
127+
strategy:
128+
runOnce:
129+
deploy:
130+
steps:
131+
- download: None
132+
133+
- task: DownloadBuildArtifacts@0
134+
displayName: 'Download Build Artifact: MOF'
135+
inputs:
136+
buildType: 'current'
137+
artifactName: MOF
138+
downloadPath: $(Build.SourcesDirectory)
139+
140+
- task: CopyFiles@2
141+
name: DeployMofsToPullServer
142+
displayName: 'Deploy MOF Files to Pull Server'
143+
inputs:
144+
SourceFolder: '$(Build.SourcesDirectory)/MOF/$(Environment.Name)'
145+
Contents: '**'
146+
TargetFolder: '\\dscpull01\DscConfiguration'
147+
OverWrite: true

‎templates/AppLockerProject/build/build.ps1‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
2+
param
3+
(
4+
[string]
5+
$SourcePath = (Resolve-Path "$PSScriptRoot\..\configurationdata").Path,
6+
7+
[string]
8+
$OutputPath = (Resolve-Path "$PSScriptRoot\..\output").Path,
9+
10+
[switch]
11+
$IncludeRsop
12+
)
13+
14+
$rsopPath = Join-Path -Path $OutputPath -ChildPath rsop
15+
$policyPath = Join-Path -Path $OutputPath -ChildPath policies
16+
if (-not (Test-Path -Path $rsopPath))
17+
{
18+
$null = New-Item -Path $rsopPath -ItemType Directory -Force
19+
}
20+
21+
if (-not (Test-Path -Path $policyPath))
22+
{
23+
$null = New-Item -Path $policyPath -ItemType Directory -Force
24+
}
25+
26+
$datum = New-DatumStructure -DefinitionFile (Join-Path $SourcePath Datum.yml)
27+
$rsops = Get-DatumRsop $datum (Get-DatumNodesRecursive -AllDatumNodes $Datum.AllNodes)
28+
$rsops | Export-AlfXml -Path $policyPath
29+
30+
if (-not $IncludeRsop) { return }
31+
32+
foreach ($rsop in $rsops)
33+
{
34+
$domainPath = Join-Path -Path $rsopPath -ChildPath $rsop.Domain
35+
if (-not (Test-Path -Path $domainPath))
36+
{
37+
$null = New-Item -Path $domainPath -ItemType Directory -Force
38+
}
39+
$rsop | ConvertTo-Yaml -OutFile (Join-Path -Path $domainPath -ChildPath "$($rsop.PolicyName).yml") -Force
40+
}

‎templates/AppLockerProject/build/prerequisites.ps1‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
param
2+
(
3+
[string]
4+
$DependencyPath = (Resolve-Path "$PSScriptRoot\requiredModules.psd1").Path
5+
)
6+
7+
$psdependConfig = Import-PowerShellDataFile -Path $DependencyPath
8+
9+
$null = Get-PackageProvider -Name NuGet -ForceBootstrap
10+
11+
Save-Module -Name PackageManagement, PowerShellGet, PSDepend -Repository $psdependConfig.PSDependOptions.Parameters.Repository -Path $psdependConfig.PSDependOptions.Target -Force
12+
13+
Remove-Module -Name PowerShellGet -ErrorAction SilentlyContinue -Force
14+
Remove-Module -Name PackageManagement -ErrorAction SilentlyContinue -Force
15+
Import-Module -Force -Name (Join-Path -Path $psdependConfig.PSDependOptions.Target -ChildPath PackageManagement\*\PackageManagement.psd1 -Resolve)
16+
Import-Module -Force -Name (Join-Path -Path $psdependConfig.PSDependOptions.Target -ChildPath PowerShellGet\*\PowerShellGet.psd1 -Resolve)
17+
Import-Module -Name (Join-Path -Path $psdependConfig.PSDependOptions.Target -ChildPath PSDepend\*\PSDepend.psd1 -Resolve)
18+
19+
Invoke-PSDepend -Path $DependencyPath -Force

‎templates/AppLockerProject/build/publish.ps1‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
param
2+
(
3+
[string]
4+
$OutputPath = (Resolve-Path "$PSScriptRoot\..\output").Path
5+
)
6+
7+
foreach ($policy in (Get-ChildItem -Path (Join-Path -Path $OutputPath -ChildPath Policies) -Recurse -Filter *.xml))
8+
{
9+
$searcher = [adsisearcher]::new()
10+
$searcher.Filter = "(&(objectClass=groupPolicyContainer)(displayName=$($policy.BaseName)))"
11+
$policyFound = $searcher.FindOne()
12+
13+
if (-not $policyFound)
14+
{
15+
$null = New-GPO -Name $policy.BaseName -Comment "Auto-updated applocker policy" -Domain $policy.Directory.Name
16+
}
17+
18+
$policyFound = $searcher.FindOne()
19+
20+
Set-AppLockerPolicy -XmlPolicy (Get-Content -Path $policy.FullName) -Ldap $policyFound.Path
21+
}

‎templates/AppLockerProject/build/requiredModules.psd1‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
@{
2+
PSDependOptions = @{
3+
AddToPath = $true
4+
Target = 'output\RequiredModules'
5+
Parameters = @{
6+
Repository = 'PSGallery'
7+
AllowPreRelease = $true
8+
}
9+
}
10+
11+
'powershell-yaml' = '0.4.7'
12+
PSScriptAnalyzer = '1.21.0'
13+
Pester = '5.4.1'
14+
'Sampler.DscPipeline' = '0.2.0-preview0015' # Unfortunately still in preview
15+
Datum = '0.40.1'
16+
'Datum.InvokeCommand' = '0.3.0'
17+
AppLockerFoundry = '1.1.0'
18+
}

‎templates/AppLockerProject/build/validate.ps1‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
[CmdletBinding()]
2+
param
3+
(
4+
[string]
5+
$ProjectRoot = (Resolve-Path "$PSScriptRoot\..").Path,
6+
7+
[ValidateSet('Unit', 'ConfigurationData', 'Integration')]
8+
[string]
9+
$TestType
10+
)
11+
12+
Import-Module Pester
13+
14+
$po = [PesterConfiguration]::New()
15+
$po.Run.Path = Join-Path $ProjectRoot "tests/$TestType"
16+
$po.Run.PassThru = $true
17+
$po.Output.Verbosity = 'Detailed'
18+
$po.TestResult.Enabled = $true
19+
$po.TestResult.OutputPath = Join-Path $ProjectRoot 'testresults.xml'
20+
$po.TestResult.OutputFormat = 'NUnit2.5'
21+
22+
$result = Invoke-Pester -Configuration $po
23+
if ($result.FailedCount -gt 0) {
24+
throw "Pester tests failed"
25+
}

‎templates/AppLockerProject/configurationdata/Apps/Git.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
Configurations:
2+
- RuleCollections
3+
4+
RuleCollections:
5+
Exe:
6+
EnforcementMode: AuditOnly
7+
Rules:
8+
- Name: Allow git.exe
9+
Description: Allow all users to run git.exe
10+
Path: '%PROGRAMFILES%\git\cmd\git.exe'
11+
UserOrGroupSid: S-1-1-0
12+
Action: Allow
13+
- Name: Allow specific hashed git
14+
Description: Allow all users to run git.exe that has a specific hash
15+
Type: SHA256
16+
Data: "0xC659F4712B60C25E86A927E0C0121C301075F2D0754506140F8B9812B5FDBA3C"
17+
SourceFileName: git.exe
18+
SourceFileLength: 45104
19+
UserOrGroupSid: S-1-1-0
20+
Action: Allow
21+
- Name: Allow signed git
22+
Description: Allow all users to run git.exe that was signed by a specific publisher
23+
PublisherName: O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE
24+
ProductName: GIT
25+
BinaryName: GIT.EXE
26+
BinaryVersionRange:
27+
LowSection: 2.40.1.1
28+
HighSection: 2.40.1.1
29+
UserOrGroupSid: S-1-1-0
30+
Action: Allow

0 commit comments

Comments
 (0)