From 973b578e2e0807b69d07d9dc4a87c1e29bdeb8c2 Mon Sep 17 00:00:00 2001
From: KnifMelti <gaj@knifmelti.se>
Date: Sat, 4 Feb 2023 04:17:35 +0100
Subject: [PATCH] Done

---
 README.md                                     |  3 --
 Winget-AutoUpdate-Install.ps1                 | 44 ++++++++++++++----
 .../functions/Invoke-PostUpdateActions.ps1    | 46 ++++++++++++++-----
 3 files changed, 69 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 2e7547c..39c476a 100644
--- a/README.md
+++ b/README.md
@@ -103,9 +103,6 @@ Thanks to [Weatherlights](https://github.com/Weatherlights) in [#256 (reply in t
 **-ModsPath**  
 Get Mods from external Path (**URL/UNC/Local**) - download/copy to `mods` in Winget-AutoUpdate installation location if external mods are newer.  
 
-Security:  
-If -ModsPath is used during installation WAU assumes it's an enterprise environment and adds a **Deny rule** to the file rights for the directory `mods` for **Local Users** (SID: S-1-5-32-545) making it impossible to implement own scripts that can be executed in **SYSTEM** context.
-
 For **URL**: This requires a site directory with **Directory Listing Enabled** and no index page overriding the listing of files (or an index page with href listing of all the **Mods** to be downloaded):  
 ```
 <ul>
diff --git a/Winget-AutoUpdate-Install.ps1 b/Winget-AutoUpdate-Install.ps1
index ffa46be..f0a24ef 100644
--- a/Winget-AutoUpdate-Install.ps1
+++ b/Winget-AutoUpdate-Install.ps1
@@ -380,16 +380,40 @@ function Install-WingetAutoUpdate {
             Set-Acl -Path $LogFile -AclObject $NewAcl
         }
 
-        #Most likely an enterprise with central mods, not a home user
-        if ($ModsPath) {
-            # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
-            $directory = Get-Item -Path "$WingetUpdatePath\mods"
-            $acl = Get-Acl -Path $directory.FullName
-            $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-            $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
-            $acl.SetAccessRule($rule)
-            Set-Acl -Path $directory.FullName -AclObject $acl
-        }
+        #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+        $directory = Get-Item -Path "$WingetUpdatePath\mods"
+        $acl = Get-Acl -Path $directory.FullName
+        #Disable inheritance
+        $acl.SetAccessRuleProtection($True, $True)
+        # Remove any existing rules
+        $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+        #SYSTEM Full - S-1-5-18
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        # Save the updated ACL
+        Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
+
+        #Administrators Full - S-1-5-32-544
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+        
+        #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
+
+        #Authenticated Users ReadAndExecute - S-1-5-11
+        $acl = Get-Acl -Path $directory.FullName
+        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+        $acl.SetAccessRule($rule)
+        Set-Acl -Path $directory.FullName -AclObject $acl
 
         #Create Shortcuts
         if ($StartMenuShortcut) {
diff --git a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1 b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
index ec614d1..bd6a608 100644
--- a/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
+++ b/Winget-AutoUpdate/functions/Invoke-PostUpdateActions.ps1
@@ -53,17 +53,41 @@ function Invoke-PostUpdateActions {
         Write-Log "-> MaxLogFiles/MaxLogSize setting was missing. Fixed with 3/1048576 (in bytes, default is 1048576 = 1 MB)."
     }
 
-    #Most likely an enterprise with central mods, not a home user
-    $ModsPath = Get-ItemProperty $regPath -Name WAU_ModsPath -ErrorAction SilentlyContinue
-    if ($ModsPath) {
-        # Set ReadOnly on Mods Directory for Local Users - Security risk if not done (they could create a script of their own - System Context)!
-        $directory = Get-Item -Path "$WingetUpdatePath\mods"
-        $acl = Get-Acl -Path $directory.FullName
-        $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "Write", "Deny")
-        $acl.SetAccessRule($rule)
-        Set-Acl -Path $directory.FullName -AclObject $acl
-    }
+    #Security: Mods directory must be protected (Users could create scripts of their own - then they're run in System Context)!
+    $WingetUpdatePath = Get-ItemProperty $regPath -Name InstallLocation -ErrorAction SilentlyContinue
+    $directory = Get-Item -Path "$WingetUpdatePath\mods"
+    $acl = Get-Acl -Path $directory.FullName
+    #Disable inheritance
+    $acl.SetAccessRuleProtection($True, $True)
+    # Remove any existing rules
+    $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_) }
+    #SYSTEM Full - S-1-5-18
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    # Save the updated ACL
+    Set-Acl -Path $directory.FullName -AclObject $acl | Out-Null
+
+    #Administrators Full - S-1-5-32-544
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
+    
+    #Local Users ReadAndExecute - S-1-5-32-545 S-1-5-11
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-545")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
+
+    #Authenticated Users ReadAndExecute - S-1-5-11
+    $acl = Get-Acl -Path $directory.FullName
+    $userSID = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-11")
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($userSID, "ReadAndExecute","ContainerInherit,ObjectInherit","None","Allow")
+    $acl.SetAccessRule($rule)
+    Set-Acl -Path $directory.FullName -AclObject $acl
 
     #Convert about.xml if exists (previous WAU versions) to reg
     $WAUAboutPath = "$WorkingDir\config\about.xml"