Joseph Doherty
88e53f7f84
First real run of the #780 installer (windev, #800 gate) failed on both hosts and its rollback failed too: - PowerShell 7: DirectoryInfo.GetAccessControl/SetAccessControl do not exist on .NET. Use Get-Acl / Set-Acl. - Windows PowerShell 5.1: an if-expression unrolled the wanted ACE to a scalar ($null on -Remove), so .Count threw under StrictMode. Wrap it in @(...). - Found on the re-run: an apply from 5.1 was not idempotent. 5.1 passes the literal quotes in sc.exe binPath= with legacy quoting, so the anchor path was stored unquoted and AnchorService reported 'changed' on every run. sc create/config now runs through Invoke-OtOpcUaSc with an explicit command line, identical on both hosts. Adds scripts/install/tests/Test-ScriptWorkerIsolation.Windows.ps1: a Windows-executed dry run -> apply -> re-apply -> uninstall -> uninstall test (scratch names, stand-in host service) for either host. The plan-only harness cannot see these. Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
333 lines
20 KiB
PowerShell
333 lines
20 KiB
PowerShell
<#
|
|
ScriptWorker isolation (lmxopcua#780, design §6 + owner decisions §14 #5/#6, §7 PeCacheDir ACL).
|
|
|
|
Pure planning functions (no OS calls — the dry-run harness runs them on any OS) plus the Windows apply step.
|
|
Install-ScriptWorkerIsolation.ps1 is the entry point; see its help.
|
|
|
|
The worker identity is the virtual account NT SERVICE\<WorkerServiceName>. Its SID is computed from the name
|
|
(Get-OtOpcUaServiceSid, the algorithm behind `sc.exe showsid`), and the host starts each worker with a restricted
|
|
token whose restricting SIDs are that identity + Everyone + BUILTIN\Users + RESTRICTED (ScriptWorkerIdentity.cs,
|
|
RestrictedWorkerLauncher.cs). Every access check the worker makes must therefore pass for the host account AND for
|
|
that set — which is why the ACLs below grant or deny the worker identity specifically.
|
|
#>
|
|
|
|
Set-StrictMode -Version Latest
|
|
|
|
# Access masks (FileSystemRights) used in the planned ACEs.
|
|
$script:FullControl = 0x1F01FF
|
|
$script:Modify = 0x1301BF # Modify | Synchronize
|
|
$script:ReadAndExecute = 0x1200A9 # ReadAndExecute | Synchronize
|
|
$script:ReadData = 0x000001 # ReadData (files) / ListDirectory (folders)
|
|
|
|
$script:FirewallRuleName = 'OtOpcUa-ScriptWorker-BlockOutbound'
|
|
$script:WorkerExeName = 'ZB.MOM.WW.OtOpcUa.ScriptWorker.exe'
|
|
$script:EnvIdentity = 'Scripting__Worker__Identity'
|
|
$script:EnvPeCacheDir = 'Scripting__Worker__PeCacheDir'
|
|
|
|
function Get-OtOpcUaServiceSid {
|
|
<#
|
|
.SYNOPSIS
|
|
The SID of the virtual account NT SERVICE\<Name>: S-1-5-80- + SHA-1 of the upper-cased name (UTF-16LE) read as
|
|
five little-endian UInt32 values. Identical to `sc.exe showsid <Name>` and to ScriptWorkerIdentity.ServiceSid.
|
|
#>
|
|
[CmdletBinding()]
|
|
param([Parameter(Mandatory)] [ValidatePattern('^[A-Za-z0-9_.\-]{1,80}$')] [string]$Name)
|
|
$bytes = [System.Text.Encoding]::Unicode.GetBytes($Name.ToUpperInvariant())
|
|
$sha1 = [System.Security.Cryptography.SHA1]::Create()
|
|
try { $hash = $sha1.ComputeHash($bytes) } finally { $sha1.Dispose() }
|
|
$parts = for ($i = 0; $i -lt 5; $i++) { [BitConverter]::ToUInt32($hash, $i * 4) }
|
|
'S-1-5-80-' + ($parts -join '-')
|
|
}
|
|
|
|
function Format-OtOpcUaAce {
|
|
# One SDDL ACE string: (A|D;flags;0xMASK;;;SID).
|
|
param([ValidateSet('A', 'D')] [string]$Type, [string]$Flags, [int]$Mask, [string]$Sid)
|
|
'({0};{1};0x{2:x};;;{3})' -f $Type, $Flags, $Mask, $Sid
|
|
}
|
|
|
|
function Get-OtOpcUaPeCacheSddl {
|
|
<#
|
|
.SYNOPSIS
|
|
The PeCacheDir root's security descriptor: owner Administrators, PROTECTED (no inherited Users/Everyone/
|
|
Authenticated Users), SYSTEM + Administrators + the host account full control (container + object inherit).
|
|
The worker identity gets NOTHING here — the HMAC key (pe-cache.key) and the launch markers (workers\) stay
|
|
host-only; the worker's one writable place is the pe\ subfolder (Get-OtOpcUaPeEntriesAce).
|
|
#>
|
|
param([Parameter(Mandatory)] [string]$HostSid)
|
|
$aces = @(
|
|
(Format-OtOpcUaAce -Type A -Flags 'OICI' -Mask $script:FullControl -Sid 'SY')
|
|
(Format-OtOpcUaAce -Type A -Flags 'OICI' -Mask $script:FullControl -Sid 'BA')
|
|
)
|
|
if ($HostSid -ne 'S-1-5-18') { $aces += Format-OtOpcUaAce -Type A -Flags 'OICI' -Mask $script:FullControl -Sid $HostSid }
|
|
'O:BAG:SYD:PAI' + ($aces -join '')
|
|
}
|
|
|
|
function Get-OtOpcUaPeEntriesAce {
|
|
# pe\ : the worker compiles in-process (owner decision §14 #7) and writes HMAC'd entries here — Modify, inherited.
|
|
param([Parameter(Mandatory)] [string]$WorkerSid)
|
|
Format-OtOpcUaAce -Type A -Flags 'OICI' -Mask $script:Modify -Sid $WorkerSid
|
|
}
|
|
|
|
function Get-OtOpcUaScriptWorkerFolderAce {
|
|
# script-worker\ : the worker's own binaries — read and execute, inherited.
|
|
param([Parameter(Mandatory)] [string]$WorkerSid)
|
|
Format-OtOpcUaAce -Type A -Flags 'OICI' -Mask $script:ReadAndExecute -Sid $WorkerSid
|
|
}
|
|
|
|
function Get-OtOpcUaInstallRootDenyAce {
|
|
<#
|
|
.SYNOPSIS
|
|
InstallRoot\ : DENY the worker identity ReadData/ListDirectory, inherited — so appsettings*.json, the logs and
|
|
the host binaries are unreadable to the worker even where BUILTIN\Users (one of its restricting SIDs) can read
|
|
them (Program Files grants Users read). script-worker\'s explicit allow is the nearer ACE and wins below it.
|
|
#>
|
|
param([Parameter(Mandatory)] [string]$WorkerSid)
|
|
Format-OtOpcUaAce -Type D -Flags 'OICI' -Mask $script:ReadData -Sid $WorkerSid
|
|
}
|
|
|
|
function New-OtOpcUaPlanStep {
|
|
param([string]$Id, [string]$Target, [string]$Change, [hashtable]$Data = @{})
|
|
[pscustomobject]@{ Id = $Id; Target = $Target; Change = $Change; Data = $Data }
|
|
}
|
|
|
|
function Get-ScriptWorkerIsolationPlan {
|
|
<#
|
|
.SYNOPSIS
|
|
Every change Install-ScriptWorkerIsolation.ps1 makes, in order, as data. Pure: no OS call, so the dry-run harness
|
|
(scripts/install/tests/Test-ScriptWorkerIsolation.ps1) asserts it on any OS and -WhatIf prints it verbatim.
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory)] [string]$InstallRoot,
|
|
[Parameter(Mandatory)] [string]$HostSid,
|
|
[Parameter(Mandatory)] [string]$PeCacheDir,
|
|
[string]$WorkerServiceName = 'OtOpcUaScriptWorker',
|
|
[string]$HostServiceName = 'OtOpcUaHost',
|
|
[switch]$ConfigureHostService,
|
|
[switch]$Uninstall,
|
|
[switch]$RemovePeCache
|
|
)
|
|
# Windows paths, planned on any OS (the harness runs on macOS/Linux too): drive-rooted or UNC only.
|
|
foreach ($p in @{ InstallRoot = $InstallRoot; PeCacheDir = $PeCacheDir }.GetEnumerator()) {
|
|
if ($p.Value -notmatch '^([A-Za-z]:\\|\\\\[^\\]+\\)') { throw "$($p.Key) '$($p.Value)' must be an absolute Windows path" }
|
|
}
|
|
$root = $InstallRoot.TrimEnd('\')
|
|
$cache = $PeCacheDir.TrimEnd('\')
|
|
if ($cache -ieq $root -or $cache.StartsWith($root + '\', [StringComparison]::OrdinalIgnoreCase)) {
|
|
throw "PeCacheDir '$PeCacheDir' is inside InstallRoot '$InstallRoot'; the host refuses a cache inside its content root"
|
|
}
|
|
$workerSid = Get-OtOpcUaServiceSid -Name $WorkerServiceName
|
|
$identity = "NT SERVICE\$WorkerServiceName"
|
|
$workerFolder = "$root\script-worker"
|
|
$workerExe = "$workerFolder\$($script:WorkerExeName)"
|
|
$entries = "$cache\pe"
|
|
$steps = [System.Collections.Generic.List[object]]::new()
|
|
|
|
if (-not $Uninstall) {
|
|
$steps.Add((New-OtOpcUaPlanStep 'AnchorService' $WorkerServiceName `
|
|
"register the disabled anchor service '$WorkerServiceName' so the virtual account '$identity' ($workerSid) resolves by name (never started)" `
|
|
@{ Name = $WorkerServiceName; Identity = $identity; BinPath = $workerExe }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'PeCacheDir' $cache `
|
|
"create the PE cache directory and set its ACL (protected; SYSTEM, Administrators, host account full control; no Users; no worker access to the key or markers)" `
|
|
@{ Path = $cache; Sddl = (Get-OtOpcUaPeCacheSddl -HostSid $HostSid) }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'PeEntriesDir' $entries `
|
|
"create the PE entries directory and grant the worker identity Modify (it compiles and writes HMAC'd entries)" `
|
|
@{ Path = $entries; Ace = (Get-OtOpcUaPeEntriesAce -WorkerSid $workerSid); Sid = $workerSid; Mask = $script:Modify; Type = 'Allow' }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'WorkerFolderAcl' $workerFolder `
|
|
"grant the worker identity read+execute on its own binaries" `
|
|
@{ Path = $workerFolder; Ace = (Get-OtOpcUaScriptWorkerFolderAce -WorkerSid $workerSid); Sid = $workerSid; Mask = $script:ReadAndExecute; Type = 'Allow' }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'InstallRootDeny' $root `
|
|
"deny the worker identity ReadData/ListDirectory on the install folder (appsettings, logs, host binaries); script-worker\ stays readable" `
|
|
@{ Path = $root; Ace = (Get-OtOpcUaInstallRootDenyAce -WorkerSid $workerSid); Sid = $workerSid; Mask = $script:ReadData; Type = 'Deny' }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'FirewallBlockOutbound' $script:FirewallRuleName `
|
|
"add a Windows Firewall rule blocking ALL outbound traffic from '$workerExe' (every profile)" `
|
|
@{ Name = $script:FirewallRuleName; Program = $workerExe }))
|
|
if ($ConfigureHostService) {
|
|
$steps.Add((New-OtOpcUaPlanStep 'HostServiceEnv' $HostServiceName `
|
|
"set $($script:EnvIdentity)=$identity and $($script:EnvPeCacheDir)=$cache in the '$HostServiceName' service environment (other entries kept; takes effect on the next service start)" `
|
|
@{ Service = $HostServiceName; Set = [ordered]@{ $script:EnvIdentity = $identity; $script:EnvPeCacheDir = $cache } }))
|
|
}
|
|
}
|
|
else {
|
|
if ($ConfigureHostService) {
|
|
$steps.Add((New-OtOpcUaPlanStep 'HostServiceEnv' $HostServiceName `
|
|
"remove $($script:EnvIdentity) and $($script:EnvPeCacheDir) from the '$HostServiceName' service environment (workers revert to the host's token on the next start)" `
|
|
@{ Service = $HostServiceName; Remove = @($script:EnvIdentity, $script:EnvPeCacheDir) }))
|
|
}
|
|
$steps.Add((New-OtOpcUaPlanStep 'FirewallBlockOutbound' $script:FirewallRuleName `
|
|
"remove the Windows Firewall rule '$($script:FirewallRuleName)'" @{ Name = $script:FirewallRuleName; Remove = $true }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'InstallRootDeny' $root `
|
|
"remove every explicit ACE for the worker identity from the install folder" @{ Path = $root; Sid = $workerSid; Remove = $true }))
|
|
$steps.Add((New-OtOpcUaPlanStep 'WorkerFolderAcl' $workerFolder `
|
|
"remove every explicit ACE for the worker identity from script-worker\" @{ Path = $workerFolder; Sid = $workerSid; Remove = $true }))
|
|
if ($RemovePeCache) {
|
|
$steps.Add((New-OtOpcUaPlanStep 'PeCacheDir' $cache `
|
|
"delete the PE cache directory (HMAC key, entries, launch markers; the host recreates a fresh cache if still configured)" `
|
|
@{ Path = $cache; Remove = $true }))
|
|
}
|
|
else {
|
|
$steps.Add((New-OtOpcUaPlanStep 'PeEntriesDir' $entries `
|
|
"remove every explicit ACE for the worker identity from the PE entries directory (the cache itself is kept; -RemovePeCache deletes it)" `
|
|
@{ Path = $entries; Sid = $workerSid; Remove = $true }))
|
|
}
|
|
$steps.Add((New-OtOpcUaPlanStep 'AnchorService' $WorkerServiceName `
|
|
"delete the anchor service '$WorkerServiceName'" @{ Name = $WorkerServiceName; Remove = $true }))
|
|
}
|
|
$steps
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------------------------------------------------
|
|
# Apply (Windows only). Each function is idempotent: it reads the current state, changes only what differs, and
|
|
# returns 'changed' or 'unchanged'. Callers gate every call with ShouldProcess, so -WhatIf runs none of them.
|
|
# ---------------------------------------------------------------------------------------------------------------------
|
|
|
|
function Set-OtOpcUaExplicitAce {
|
|
# Ensures exactly one explicit ACE for $Sid on $Path with the given type/mask/inheritance (or none when $Remove).
|
|
param([string]$Path, [string]$Sid, [int]$Mask = 0, [string]$Type = 'Allow', [switch]$Remove)
|
|
if (-not (Test-Path -LiteralPath $Path)) {
|
|
if ($Remove) { return 'unchanged' }
|
|
throw "$Path does not exist"
|
|
}
|
|
$acl = Get-Acl -LiteralPath $Path # #800: DirectoryInfo.GetAccessControl does not exist on PowerShell 7 (.NET)
|
|
$identity = [System.Security.Principal.SecurityIdentifier]::new($Sid)
|
|
$explicit = @($acl.GetAccessRules($true, $false, [System.Security.Principal.SecurityIdentifier]) |
|
|
Where-Object { $_.IdentityReference -eq $identity })
|
|
$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
|
|
# #800: @() keeps $wanted an array; the if-expression unrolled it to a scalar ($null on -Remove), and .Count on that
|
|
# throws under Set-StrictMode -Version Latest on Windows PowerShell 5.1.
|
|
$wanted = @(if (-not $Remove) {
|
|
[System.Security.AccessControl.FileSystemAccessRule]::new($identity, [System.Security.AccessControl.FileSystemRights]$Mask,
|
|
$inherit, [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]$Type)
|
|
})
|
|
$same = ($explicit.Count -eq $wanted.Count) -and (
|
|
$wanted.Count -eq 0 -or (
|
|
[int]$explicit[0].FileSystemRights -eq $Mask -and $explicit[0].AccessControlType -eq $wanted[0].AccessControlType -and
|
|
$explicit[0].InheritanceFlags -eq $inherit -and $explicit[0].PropagationFlags -eq 'None'))
|
|
if ($same) { return 'unchanged' }
|
|
$acl.PurgeAccessRules($identity)
|
|
foreach ($rule in $wanted) { $acl.AddAccessRule($rule) }
|
|
Set-Acl -LiteralPath $Path -AclObject $acl
|
|
'changed'
|
|
}
|
|
|
|
function Invoke-OtOpcUaSc {
|
|
# Runs sc.exe with an explicitly quoted command line (CommandLineToArgvW rules), identical on PowerShell 5.1 and 7.
|
|
# Returns the exit code. Used where an argument contains literal double quotes.
|
|
param([string[]]$Arguments)
|
|
$quoted = foreach ($a in $Arguments) { '"' + ($a -replace '(\\*)"', '$1$1\"' -replace '(\\+)$', '$1$1') + '"' }
|
|
$psi = [System.Diagnostics.ProcessStartInfo]::new((Join-Path ([Environment]::SystemDirectory) 'sc.exe'), ($quoted -join ' '))
|
|
$psi.UseShellExecute = $false
|
|
$psi.CreateNoWindow = $true
|
|
$psi.RedirectStandardOutput = $true
|
|
$psi.RedirectStandardError = $true
|
|
$proc = [System.Diagnostics.Process]::Start($psi)
|
|
$null = $proc.StandardOutput.ReadToEnd()
|
|
$null = $proc.StandardError.ReadToEnd()
|
|
$proc.WaitForExit()
|
|
$proc.ExitCode
|
|
}
|
|
|
|
function Set-OtOpcUaStepAce {
|
|
param([hashtable]$Data)
|
|
if ($Data.ContainsKey('Remove')) { return (Set-OtOpcUaExplicitAce -Path $Data.Path -Sid $Data.Sid -Remove) }
|
|
Set-OtOpcUaExplicitAce -Path $Data.Path -Sid $Data.Sid -Mask $Data.Mask -Type $Data.Type
|
|
}
|
|
|
|
function Invoke-ScriptWorkerIsolationStep {
|
|
<#
|
|
.SYNOPSIS
|
|
Applies one plan step on Windows. Idempotent; returns 'changed' or 'unchanged'.
|
|
#>
|
|
[CmdletBinding()]
|
|
param([Parameter(Mandatory)] $Step)
|
|
$d = $Step.Data
|
|
switch ($Step.Id) {
|
|
'AnchorService' {
|
|
$svc = Get-Service -Name $d.Name -ErrorAction SilentlyContinue
|
|
if ($d.ContainsKey('Remove')) {
|
|
if (-not $svc) { return 'unchanged' }
|
|
& sc.exe delete $d.Name | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { throw "sc.exe delete $($d.Name) failed ($LASTEXITCODE)" }
|
|
return 'changed'
|
|
}
|
|
$verb = if ($svc) { 'config' } else { 'create' }
|
|
$cfg = Get-CimInstance Win32_Service -Filter "Name='$($d.Name)'" -ErrorAction SilentlyContinue
|
|
if ($cfg -and $cfg.StartMode -eq 'Disabled' -and $cfg.StartName -ieq $d.Identity -and $cfg.PathName -eq "`"$($d.BinPath)`"") {
|
|
return 'unchanged'
|
|
}
|
|
# #883: the binPath value carries literal quotes. Windows PowerShell 5.1 passes native arguments with legacy quoting
|
|
# (embedded quotes are dropped or mangled, so the stored path was unquoted and every re-run reported 'changed'),
|
|
# PowerShell 7 escapes them. Build the command line explicitly so both hosts store the same value.
|
|
$scExit = Invoke-OtOpcUaSc @($verb, $d.Name, 'binPath=', "`"$($d.BinPath)`"", 'start=', 'disabled', 'obj=', $d.Identity,
|
|
'DisplayName=', 'OtOpcUa ScriptWorker identity (anchor, never started)')
|
|
if ($scExit -ne 0) { throw "sc.exe $verb $($d.Name) failed ($scExit)" }
|
|
& sc.exe sidtype $d.Name unrestricted | Out-Null
|
|
& sc.exe description $d.Name 'Anchors the NT SERVICE virtual account OtOpcUa ScriptWorker processes are restricted to (lmxopcua#780). Never started: the OtOpcUaHost launches workers itself under a restricted token.' | Out-Null
|
|
return 'changed'
|
|
}
|
|
'PeCacheDir' {
|
|
if ($d.ContainsKey('Remove')) {
|
|
if (-not (Test-Path -LiteralPath $d.Path)) { return 'unchanged' }
|
|
Remove-Item -LiteralPath $d.Path -Recurse -Force
|
|
return 'changed'
|
|
}
|
|
$changed = $false
|
|
if (-not (Test-Path -LiteralPath $d.Path)) { New-Item -ItemType Directory -Path $d.Path -Force | Out-Null; $changed = $true }
|
|
$current = (Get-Acl -LiteralPath $d.Path).GetSecurityDescriptorSddlForm('Access, Owner')
|
|
$desired = [System.Security.AccessControl.DirectorySecurity]::new()
|
|
$desired.SetSecurityDescriptorSddlForm($d.Sddl, 'Access, Owner')
|
|
if ($current -ne $desired.GetSecurityDescriptorSddlForm('Access, Owner')) {
|
|
Set-Acl -LiteralPath $d.Path -AclObject $desired # propagates to the key file, pe\ and workers\ (inherited ACEs)
|
|
$changed = $true
|
|
}
|
|
return $(if ($changed) { 'changed' } else { 'unchanged' })
|
|
}
|
|
'PeEntriesDir' {
|
|
if (-not $d.ContainsKey('Remove') -and -not (Test-Path -LiteralPath $d.Path)) {
|
|
New-Item -ItemType Directory -Path $d.Path -Force | Out-Null
|
|
}
|
|
return (Set-OtOpcUaStepAce -Data $d)
|
|
}
|
|
{ $_ -in 'WorkerFolderAcl', 'InstallRootDeny' } {
|
|
return (Set-OtOpcUaStepAce -Data $d)
|
|
}
|
|
'FirewallBlockOutbound' {
|
|
$rule = Get-NetFirewallRule -Name $d.Name -ErrorAction SilentlyContinue
|
|
if ($d.ContainsKey('Remove')) {
|
|
if (-not $rule) { return 'unchanged' }
|
|
Remove-NetFirewallRule -Name $d.Name
|
|
return 'changed'
|
|
}
|
|
if ($rule) {
|
|
$app = ($rule | Get-NetFirewallApplicationFilter).Program
|
|
if ($rule.Direction -eq 'Outbound' -and $rule.Action -eq 'Block' -and $rule.Enabled -eq 'True' -and
|
|
$rule.Profile -eq 'Any' -and $app -ieq $d.Program) { return 'unchanged' }
|
|
Remove-NetFirewallRule -Name $d.Name
|
|
}
|
|
New-NetFirewallRule -Name $d.Name -DisplayName 'OtOpcUa ScriptWorker - block outbound' `
|
|
-Description 'lmxopcua#780 design §6: OtOpcUa script workers never need the network; scripts are also denied System.Net at compile time.' `
|
|
-Direction Outbound -Action Block -Program $d.Program -Profile Any -Enabled True | Out-Null
|
|
return 'changed'
|
|
}
|
|
'HostServiceEnv' {
|
|
$key = "HKLM:\SYSTEM\CurrentControlSet\Services\$($d.Service)"
|
|
if (-not (Test-Path $key)) {
|
|
if ($d.ContainsKey('Remove')) { return 'unchanged' }
|
|
throw "service '$($d.Service)' is not installed (run Install-Services.ps1 first)"
|
|
}
|
|
$current = @((Get-ItemProperty -Path $key -Name Environment -ErrorAction SilentlyContinue).Environment | Where-Object { $_ })
|
|
$names = if ($d.ContainsKey('Remove')) { $d.Remove } else { @($d.Set.Keys) }
|
|
$next = @($current | Where-Object { $n = ($_ -split '=', 2)[0]; $names -notcontains $n })
|
|
if (-not $d.ContainsKey('Remove')) { foreach ($k in $d.Set.Keys) { $next += "$k=$($d.Set[$k])" } }
|
|
if ((@($current) -join "`n") -eq (@($next) -join "`n")) { return 'unchanged' }
|
|
Set-ItemProperty -Path $key -Name Environment -Type MultiString -Value ([string[]]$next)
|
|
return 'changed'
|
|
}
|
|
default { throw "unknown plan step '$($Step.Id)'" }
|
|
}
|
|
}
|
|
|
|
Export-ModuleMember -Function Get-OtOpcUaServiceSid, Get-OtOpcUaPeCacheSddl, Get-OtOpcUaPeEntriesAce,
|
|
Get-OtOpcUaScriptWorkerFolderAce, Get-OtOpcUaInstallRootDenyAce, Get-ScriptWorkerIsolationPlan,
|
|
Invoke-ScriptWorkerIsolationStep
|