[wpkg-users] [OT?] Nested for on a cmd script...
Marco Gaiarin
gaio at sv.lnf.it
Mon Feb 9 11:19:10 CET 2015
Mandi! Stefan Pendl
In chel di` si favelave...
> could you post some example lines of the rules, so we could see what
> can be used to filter?
Attached my curreent script and rules file. Clearly, you have to
decomment the last line in srp.paths. ;-)
> May be using FINDSTR instead of FIND could be an option, since
> FINDSTR uses regular expression syntax by default.
Seems not a 'find' trouble, at least using '%%' now.
> I would also use a sample batch file with only the parsing to start
> with and add pieces until I get a syntax that works for the final
> batch file.
As you can see, mu batch script is just very simple...
> May be it will be time to change to Javascript to succeed, instead
> of using batch commands.
I can also keep using 'REG_EXPAND_SZ' for every rule, i think can only
add some little overhead... i'm only curious. ;-)
--
dott. Marco Gaiarin GNUPG Key ID: 240A3D66
Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/
Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN)
marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797
Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
http://www.lanostrafamiglia.it/25/index.php/component/k2/item/123
(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
-------------- next part --------------
@ECHO OFF
::
:: Script per l'applicazione registry-based delle Software Restriction Policies.
:: Copyright (C) 2015 Marco Gaiarin (gaio at linux.it)
::
:: This program is free software; you can redistribute it and/or
:: modify it under the terms of the GNU General Public License
:: as published by the Free Software Foundation; either version 2
:: of the License, or (at your option) any later version.
::
:: This program is distributed in the hope that it will be useful,
:: but WITHOUT ANY WARRANTY; without even the implied warranty of
:: MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
:: GNU General Public License for more details.
::
:: You should have received a copy of the GNU General Public License
:: along with this program; if not, write to the Free Software
:: Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
:: USA.
::
:: CHANGELOG
:: (Tue Feb 3 16:40:04 CET 2015)
:: + prima versione
:: (Wed Feb 4 12:13:12 CET 2015)
:: + Elimino il calcolo del tipo di chiave, metto tutto a REG_EXPAND_SZ
:: + aggiungo le redirezioni a NUL, evito le limitazioni del buffer di cscript
:: Devo definire 'EnableDelayedExpansion' per poter gestire la complessita delle variabili nei for.
::
Setlocal EnableDelayedExpansion
:: Il parametro passato in cmdline indica se devo operare in modo black (tutto negato a parte whitelist)
:: o white (tutto permesso a parte blacklist).
:: Se non specificato, è white.
::
if "%1" == "black" (
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "DefaultLevel" /t REG_DWORD /d "0" >nul 2>nul
) else (
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "DefaultLevel" /t REG_DWORD /d "262144" >nul 2>nul
)
:: Sistemo gli altri parametri comuni. In particolare le policy sono disabilitate per Administrator.
::
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "TransparentEnabled" /t REG_DWORD /d "1" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "PolicyScope" /t REG_DWORD /d "1" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "AuthenticodeEnabled" /t REG_DWORD /d "0" >nul 2>nul
:: Standard, meno i LNK (link) che non si capisce che ci faccino qui dentro...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "ExecutableTypes" /t REG_MULTI_SZ /d "WSC\0VB\0URL\0SHS\0SCR\0REG\0PIF\0PCD\0OCX\0MST\0MSP\0MSI\0MSC\0MDE\0MDB\0ISP\0INS\0INF\0HTA\0HLP\0EXE\0CRT\0CPL\0COM\0CMD\0CHM\0BAT\0BAS\0ADP\0ADE" >nul 2>nul
:: Il timestamp delle regole, è fisso, ed è un timestamp di oggi.
::
set ts=130674430620013217
:: Ciclo tra le regole custom, prima generali e poi specifiche.
::
for /F "eol=; tokens=1,*" %%l in ( %WPKGROOT%\packages\srp.paths %WPKGROOT%\packages\srp\%COMPUTERNAME%.paths ) do (
:: primo campo: il livello.
set level=262144
if "%%l" == "black" (
set level=0
)
:: secondo campo: il path
set pathrule=%%m
:: faccio qualcosa solo se ho un path... salto le righe nulle o malformate.
if "!pathrule!" neq "" (
:: Calcolo il tipo. NON FUNZIONA.
set type=REG_SZ
echo !pathrule! | find "%%" >nul 2>nul && set type=REG_EXPAND_SZ
:: Genero un UUID e inserisco la voce, devo farlo all'interno del for per evitare le delayed expansion.
for /F "tokens=1" %%u in ( '%WPKGROOT%\tools\Uuidgen.Exe' ) do (
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "ItemData" /t "!type!" /d "!pathrule!" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "LastModified" /t "REG_QWORD" /d "%ts%" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "SaferFlags" /t "REG_DWORD" /d "0" >nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\!level!\Paths\{%%u}" /f /v "Description" /t "REG_SZ" /d "" >nul 2>nul
)
)
)
:: Esco
::
exit 0
-------------- next part --------------
; Elenco di regole di Software Restriction Policy.
; Il primo campo è la tipologia (black o white), segue la regola.
; Queste sono le regole standard, che è sempre bene avere.
; In generale le regole di WHITELIST è bene che non facciano riferimento a variabili d'ambiente
; perchè ovviamente possono essere abusate.
; Meglio usare le 'registry path rules'.
;
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%
white %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
; Alcune regole di blacklist. Qui le variabili ovviamente hanno più senso. ;-)
;
black %AppData%
black %LocalAppData%
black %TEMP%
; Posso anche usare path assoluti, ma meglio usare sempre perlomeno %SystemDrive%...
;
;black c:\prova
More information about the wpkg-users
mailing list