Icinga / Icinga/icinga-powershell-framework
Import-Module icinga-powershell-framework fails in ContranedLanguage powershell when Applocker is enabled
@LordHepipud is already working on this.
Since May 10, 2023.
- Dominant language
- PowerShell
- Stars
- 87
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
I am trying to setup the Icinga for Windows with the PowerShell Framework on an Domain managed system.
Do to policy reason the Icinga agent has to run as an domain user and I have configured icinga agent like that (following the instruction.
When I run an powershell as that icinga service user to debug some stuff and try to import the icinga-powershell-framework module I get an error
Import-Module : This module uses the dot-source operator while exporting functions using wildcard characters, and this
is disallowed when the system is under application verification enforcement.
I guess this is caused due to the fact that AppLocker is active on the system and the user is not an Adminstrator and gets an PowerShell with ContrainedLanguage LanguageMode
Expected Behavior
I would like to be able to do an Import-Module icinga-powershell-framework as an normal user even when AppLocker is enabled.
Current Behavior
Failure to do an Import-Module icinga-powershell-framework
PS C:\Windows\system32> Import-Module icinga-powershell-framework
The pipeline has been stopped.
+ CategoryInfo : OperationStopped: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : PipelineStoppedImport-Module : The module to process 'icinga-powershell-framework.psm1', listed in field 'ModuleToProcess/RootModule'
of module manifest 'C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\icinga-powershell-framework.
psd1' was not processed because no valid module was found in any module directory.
At line:1 char:1
- Import-Module icinga-powershell-framework
+ CategoryInfo : ResourceUnavailable: (icinga-powershell-framework:String) [Import-Module], PSInvalidOper ationException + FullyQualifiedErrorId : Modules_ModuleFileNotFound,Microsoft.PowerShell.Commands.ImportModuleCommandImport-Module : This module uses the dot-source operator while exporting functions using wildcard characters, and this
is disallowed when the system is under application verification enforcement.
At line:1 char:1
- Import-Module icinga-powershell-framework
+ CategoryInfo : SecurityError: (:) [Import-Module], PSSecurityException + FullyQualifiedErrorId : Modules_SystemLockDown_CannotUseDotSourceWithWildCardFunctionExport,Microsoft.PowerShell .Commands.ImportModuleCommand
Possible Solution
Steps to Reproduce (for bugs)
- System with AppLocker enabled somehow (details are beyond my capabilities
- Run PowerShell as normal user.
- Verify LanguageMode is ConstrainedLanguage by displaying $ExecutionContext.SessionState.LanguageMode
- Try to do an Import-Module icinga-powershell-framework
Context
I am trying to setup Icinga agent on an system where I will manage it but won't have Administrator access but can run stuff as the icinga service user
Your Environment
- PowerShell Version used (
$PSVersionTable.PSVersion):
Major Minor Build Revision
5 1 19041 2673
- Operating System and version (
Get-IcingaWindowsInformation Win32_OperatingSystem | Select-Object Version, BuildNumber, Caption):
Version BuildNumber Caption
10.0.19045 19045 Microsoft Windows 10 Enterprise
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.