Skip to content

Commit 39b29cf

Browse files
TravisEz13TravisEz13
committed
offline updates
1 parent d712d42 commit 39b29cf

File tree

1 file changed

+37
-18
lines changed

1 file changed

+37
-18
lines changed

‎1-Draft/RFCXXXX-Policy.md

Lines changed: 37 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,18 @@ Consumers, developers, and enterprise system administrators should be able to fl
1919
I based this off of @iSazonov 's RFC, for just a slightly different purpose.
2020
[PR #111](https://github.com/PowerShell/PowerShell-RFC/pull/111)
2121

22+
## Goals
23+
24+
1. Specify how PowerShell 7 will deal with having both Windows PowerShell and PowerShell Core Group Policy.
25+
- This is covered in [Policy settings Setting Fall-Back](#policy-settings-setting-fall-back).
26+
1. Correct how the `pwsh -settingsfile` switch behaves.
27+
- This is covered in [Parameter `-settingsfile`](#Parameter--settingsfile)
28+
29+
## Definitions
30+
31+
- **Computer-Wide settings/policy** - setting or policy applied to the entire operating system.
32+
- **User settings/policy** - setting or policy applied only to the user.
33+
2234
## Specification
2335

2436
`PowerShell 7` should be configured using the following schemes:
@@ -34,8 +46,8 @@ Configuration schemes allow to customize `PowerShell 7` in the most flexible way
3446

3547
- Enterprise system administrators can use GPO,
3648
GPP and computer-wide settings files to apply approved configuration settings and mandatory security settings in a centralized manner.
37-
The same settings can be applied at user, application or startup levels.
38-
- Developers and consumers can use user, application and startup level settings files.
49+
Most settings can be applied either to the user or computer-wide.
50+
- Developers and consumers can use user, or computer-wide level setting files.
3951

4052
### Configuration defaults
4153

@@ -45,7 +57,7 @@ The default values must be `secure-by-default`.
4557

4658
For release versions hard-coded defaults must be the same as ones in pre-installed configuration files. For preview versions they may vary (ex., enable experimental features and so on).
4759

48-
System configuration includes security sensitive setting,
60+
Computer-wide configuration includes security sensitive setting,
4961
and failing to read those setting could result in an insecure system.
5062
So, if during startup, PowerShell 7 cannot read files read from the Computer-Wide scope,
5163
it fails to startup.
@@ -61,7 +73,7 @@ Regular settings are normal configuration settings.
6173
Regular settings can be treated as default and recommended values.
6274
Policy settings is higher precedence.
6375
See [Precedence for Policy settings in descending order](#precedence-for-policy-settings-in-descending-order).
64-
Policy settings are used by administrators to centrally manage PowerShell and hosted applications.
76+
Policy settings are used by administrators to centrally manage PowerShell.
6577

6678
| Location | Policy settings | Regular settings |
6779
|--------------|-----------------------------------------------------------|------------------------------------------------------------|
@@ -89,30 +101,31 @@ Because a configuration setting can be in several schemes, the setting wins acco
89101

90102
| Scheme | Windows | Unix |
91103
|-----------------------------|------------------------------------------------------|------------------------------------------------------|
92-
| GPO -> Computer Policy | HKLM\Software\Policies\PowerShellCore | /etc/powershell/powershell.config.json |
93-
| GPO -> User Policy | HKCU\Software\Policies\PowerShellCore | See [`Comment A`](#comment-a) below |
94-
| File -> Computer-Wide | %ProgramFiles%/PowerShell/powershell.config.json | /etc/powershell/powershell.config.json |
104+
| GPO -> Computer Policy | HKLM\Software\Policies\PowerShellCore | See [Moving configuration out of PSHome][moving] |
105+
| GPO -> User Policy | HKCU\Software\Policies\PowerShellCore | See [`Comment A`](#comment-a) below |
106+
| File -> Computer-Wide | See [Moving configuration out of PSHome][moving] | [Moving configuration out of PSHome][moving] |
95107
| File -> Application-Startup | pwsh -settingsfile `somepath/powershell.config.json` | pwsh -settingsfile `somepath/powershell.config.json` |
96108
| File -> User-Wide | %APPDATA%/powershell.config.json | %XDG_CONFIG_HOME%/powershell.config.json |
97-
| File -> Application-Wide | $PSHome/powershell.config.json | $PSHome/powershell.config.json |
98109

99110
Defaults:
100111

101112
`%APPDATA%` - `C:\Users\useraccount\AppData\Roaming`
102113

103114
`%XDG_CONFIG_HOME%` - `HOME/.config`
104115

105-
`$PSHome` definition from [about_powershell_config](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_powershell_config?view=powershell-6) - The $PSHOME location is defined as the same directory as the executing System.Management.Automation.dll assembly.
106-
This applies to hosted PowerShell SDK instances as well.
107116
#### Parameter `-settingsfile`
108117

109-
With `-settingsfile` parameter users can assign custom settings from the config file and overwrite user-wide and application-wide settings.
118+
With `-settingsfile` parameter users can assign custom settings from the config file and overwrite user-wide settings.
119+
120+
##### More definitions
121+
122+
- System Lock-down mode:
123+
When Windows Defender Application Control or AppLocker force PowerShell into Constrained Language mode and
124+
only trusted code runs in Full Language mode.
125+
See [PowerShell Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/)
110126

111127
##### Computer-wide and user policy settings
112128

113-
Definitions:
114-
- System Lock-down mode: When Windows Defender Application Control or AppLocker force PowerShell into Constrained Language mode and only trusted code runs in Full Language mode. See [PowerShell Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/)
115-
116129
Admin/root users can overwrite computer-wide and user policy settings using `-settingsfile`,
117130
only when not in System Lock-down mode.
118131

@@ -123,10 +136,9 @@ This will have performance impact on startup, but only when `-settingsfile` is s
123136
| Scheme | Windows | Unix |
124137
|-----------------------------|------------------------------------------------------|------------------------------------------------------|
125138
| File -> Application-Startup | pwsh -settingsfile `somepath/powershell.config.json` | pwsh -settingsfile `somepath/powershell.config.json` |
126-
| File -> Application-Wide | $apphome\powershell.config.json | $apphome/powershell.config.json |
127-
| File -> User-Wide | %APPDATA%\powershell.config.json | ~/.config/powershell/powershell.config.json |
139+
| File -> User-Wide | %APPDATA%\powershell.config.json | ~/.config/powershell/powershell.config.json |
128140
| File -> Computer-Wide | %ProgramFiles%\PowerShell\powershell.config.json | /opt/Microsoft/powershell/powershell.config.json |
129-
| GPO -> User Config | HKCU\Software\PowerShellCore | ~/.config/powershell/powershell.config.json | |
141+
| GPO -> User Config | HKCU\Software\PowerShellCore | ~/.config/powershell/powershell.config.json| |
130142
| GPO -> Computer Config | HKLM\Software\PowerShellCore | /etc/powershell.config.json |
131143

132144
### Configuration settings
@@ -199,7 +211,7 @@ I filed [#9632](https://github.com/PowerShell/PowerShell/issues/9632) on Updatab
199211

200212
### Automatically resolve Windows PowerShell policy conflicts
201213

202-
#### Motivation
214+
#### Motivation - Automatically policy
203215

204216
This is a description of the alternative to [Policy settings Setting Fall-Back](#policy-settings-setting-fall-back).
205217
The main purpose of describing the alternative is to describe why it should not be pursued.
@@ -213,3 +225,10 @@ This would make the `Precedence for Policy settings` not just a simple list but
213225

214226
A new RFC should be drafted about how to allow environment variables in the values in the JSON.
215227
This would allow consistent files across platforms.
228+
229+
### Moving configuration out of PSHome
230+
231+
Per issues [9278](https://github.com/PowerShell/PowerShell/issues/9278) we need to move configuration out of PSHome,
232+
follow that issue for issues related to new locations of files.
233+
234+
[moving]:#moving-configuration-out-of-pshome

0 commit comments

Comments
 (0)