Skip to content

Commit 7ce87cc

Browse files
kjacobsenkjacobsen
committed
Switched from class to mof structured DSC resource as it is easier to test. Switched to two examples, one for enable and one for disabled
1 parent ead68c3 commit 7ce87cc

10 files changed

+230
-151
lines changed

‎DSCResources/cSpeculationControlFix/cSpeculationControlFix.psm1

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
$MemoryManagementPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management'
2+
$VirtualizationPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization'
3+
4+
Function Get-TargetResource
5+
{
6+
[OutputType([System.Collections.Hashtable])]
7+
[CMDLetBinding()]
8+
param
9+
(
10+
# Parameter help description
11+
[Parameter(Mandatory = $true)]
12+
[ValidateSet('Enabled', 'Disabled')]
13+
[String]
14+
$Status
15+
)
16+
17+
$getTargetResourceResult = $null
18+
19+
# Test if the fixes are enabled
20+
$FeatureSettingsOverrideEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverride' -ExpectedValue 0
21+
Write-Verbose -Message ('FeatureSettingsOverride is {0}' -f $FeatureSettingsOverrideEnabled)
22+
23+
$FeatureSettingsOverrideMaskEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverrideMask' -ExpectedValue 3
24+
Write-Verbose -Message ('FeatureSettingsOverrideMask is {0}' -f $FeatureSettingsOverrideMaskEnabled)
25+
26+
$MinVmVersionForCpuBasedMitigationsEnabled = Test-RegistryItem -Path $VirtualizationPath -Name 'MinVmVersionForCpuBasedMitigations' -ExpectedValue '1.0'
27+
Write-Verbose -Message ('MinVmVersionForCpuBasedMitigations is {0}' -f $MinVmVersionForCpuBasedMitigationsEnabled)
28+
29+
if ($FeatureSettingsOverrideEnabled -and $FeatureSettingsOverrideMaskEnabled -and $MinVmVersionForCpuBasedMitigationsEnabled)
30+
{
31+
$Status = 'Enabled'
32+
}
33+
else
34+
{
35+
$Status = 'Disabled'
36+
}
37+
38+
$getTargetResourceResult = @{
39+
Status = $Status
40+
}
41+
42+
$getTargetResourceResult
43+
}
44+
45+
Function Set-TargetResource
46+
{
47+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]
48+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '')]
49+
[CMDLetBinding(SupportsShouldProcess=$true)]
50+
param
51+
(
52+
# Parameter help description
53+
[Parameter(Mandatory = $true)]
54+
[ValidateSet('Enabled', 'Disabled')]
55+
[String]
56+
$Status
57+
)
58+
59+
if ($Status -eq 'Enabled')
60+
{
61+
Write-Verbose -Message 'Enabling Protections'
62+
if ($PSCmdlet.ShouldProcess('Enable cSpeculationControlFix', 'Set-TargetResource')) {
63+
Update-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverride' -Value 0 -PropertyType 'DWORD' -Confirm:$false
64+
Update-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverrideMask' -Value 3 -PropertyType 'DWORD' -Confirm:$false
65+
Update-RegistryItem -Path $VirtualizationPath -Name 'MinVmVersionForCpuBasedMitigations' -Value '1.0' -PropertyType 'STRING' -Confirm:$false
66+
}
67+
}
68+
else
69+
{
70+
Write-Verbose -Message 'Disabling Protections'
71+
if ($PSCmdlet.ShouldProcess('Disable cSpeculationControlFix', 'Set-TargetResource')) {
72+
Update-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverride' -Value 3 -PropertyType 'DWORD' -Confirm:$false
73+
Update-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverrideMask' -Value 3 -PropertyType 'DWORD' -Confirm:$false
74+
}
75+
}
76+
77+
# Setting the global:DSCMachineStatus = 1 tells DSC that a reboot is required
78+
$global:DSCMachineStatus = 1
79+
}
80+
81+
Function Test-TargetResource
82+
{
83+
[CMDLetBinding()]
84+
[OutputType([bool])]
85+
param
86+
(
87+
# Parameter help description
88+
[Parameter(Mandatory = $true)]
89+
[ValidateSet('Enabled', 'Disabled')]
90+
[String]
91+
$Status
92+
)
93+
94+
if ($Status -eq 'Enabled')
95+
{
96+
$FeatureSettingsOverrideEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverride' -ExpectedValue 0
97+
Write-Verbose -Message ('FeatureSettingsOverride is {0}' -f $FeatureSettingsOverrideEnabled)
98+
99+
$FeatureSettingsOverrideMaskEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverrideMask' -ExpectedValue 3
100+
Write-Verbose -Message ('FeatureSettingsOverrideMask is {0}' -f $FeatureSettingsOverrideMaskEnabled)
101+
102+
$MinVmVersionForCpuBasedMitigationsEnabled = Test-RegistryItem -Path $VirtualizationPath -Name 'MinVmVersionForCpuBasedMitigations' -ExpectedValue '1.0'
103+
Write-Verbose -Message ('MinVmVersionForCpuBasedMitigations is {0}' -f $MinVmVersionForCpuBasedMitigationsEnabled)
104+
105+
$FixStatus = $FeatureSettingsOverrideEnabled -and $FeatureSettingsOverrideMaskEnabled -and $MinVmVersionForCpuBasedMitigationsEnabled
106+
}
107+
else
108+
{
109+
$FeatureSettingsOverrideEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverride' -ExpectedValue 3
110+
Write-Verbose -Message ('FeatureSettingsOverride is {0}' -f $FeatureSettingsOverrideEnabled)
111+
112+
$FeatureSettingsOverrideMaskEnabled = Test-RegistryItem -Path $MemoryManagementPath -Name 'FeatureSettingsOverrideMask' -ExpectedValue 3
113+
Write-Verbose -Message ('FeatureSettingsOverrideMask is {0}' -f $FeatureSettingsOverrideMaskEnabled)
114+
115+
$FixStatus = $FeatureSettingsOverrideEnabled -and $FeatureSettingsOverrideMaskEnabled
116+
}
117+
118+
Write-Verbose -Message ('cSpeculationControlFix should be {0} = {1}' -f $Status, $FixStatus)
119+
$FixStatus
120+
}

‎DSCResources/cSpeculationControlFix/cSpeculationControlFix.schema.mof

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[ClassVersion("1.0.0"), FriendlyName("cSpeculationControlFix")]
2+
class cSpeculationControlFix : OMI_BaseResource
3+
{
4+
[Key] string Status;
5+
};

‎Examples/cSpeculationControlFix_disable.Example.ps1

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Configuration EnableSpeculationControl
2+
{
3+
Import-DscResource -Module cSpeculationControlFixes
4+
cSpeculationControlFix enableSpeculationControlFix
5+
{
6+
Status = 'Disabled'
7+
}
8+
}
9+
10+
EnableSpeculationControl -OutputPath C:\DSCConfiguration

‎Examples/cSpeculationControlFix.Example.ps1 ‎Examples/cSpeculationControlFix_enable.Example.ps1

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ Configuration EnableSpeculationControl
66
Status = 'Enabled'
77
}
88
}
9-
EnableSpeculationControl -OutputPath C:\DSCConfiguration
10-
#Start-DSCConfiguration -Wait -Force -Verbose -Path C:\DSCConfiguration
9+
10+
EnableSpeculationControl -OutputPath C:\DSCConfiguration

‎cSpeculationControlFixes.psd1

+6-6
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
@{
1010

1111
# Script module or binary module file associated with this manifest.
12-
# RootModule = ''
12+
RootModule = 'cSpeculationControlFixes.psm1'
1313

1414
# Version number of this module.
1515
ModuleVersion = '0.1'
@@ -33,7 +33,7 @@ Copyright = '(c) 2018 Kieran Jacobsen. All rights reserved.'
3333
Description = 'PowerShell DSC for enabling Speculation Control fixes on Windows Server'
3434

3535
# Minimum version of the Windows PowerShell engine required by this module
36-
PowerShellVersion = '5.0'
36+
PowerShellVersion = '4.0'
3737

3838
# Name of the Windows PowerShell host required by this module
3939
# PowerShellHostName = ''
@@ -66,10 +66,10 @@ PowerShellVersion = '5.0'
6666
# FormatsToProcess = @()
6767

6868
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
69-
NestedModules = @('dscresources\cSpeculationControlFix.psm1')
69+
# NestedModules = @()
7070

7171
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
72-
FunctionsToExport = @()
72+
FunctionsToExport = @('Test-RegistryItem', 'Update-RegistryItem')
7373

7474
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
7575
CmdletsToExport = @()
@@ -81,7 +81,7 @@ VariablesToExport = '*'
8181
AliasesToExport = @()
8282

8383
# DSC resources to export from this module
84-
DscResourcesToExport = @('cSpeculationControlFix')
84+
# DscResourcesToExport = @()
8585

8686
# List of all modules packaged with this module
8787
# ModuleList = @()
@@ -95,7 +95,7 @@ PrivateData = @{
9595
PSData = @{
9696

9797
# Tags applied to this module. These help with module discovery in online galleries.
98-
Tags = @('Speculation', 'SpeculationControl', 'Spectre', 'Meltdown')
98+
Tags = @('DesiredStateConfiguration', 'DSC', 'DSCResource', 'Speculation', 'SpeculationControl', 'Spectre', 'Meltdown', 'CPU')
9999

100100
# A URL to the license for this module.
101101
# LicenseUri = ''

‎cSpeculationControlFixes.psm1

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Taken from http://overpoweredshell.com/Working-with-Plaster/
2+
3+
$functionFolders = @('functions', 'internal', 'classes')
4+
ForEach ($folder in $functionFolders)
5+
{
6+
$folderPath = Join-Path -Path $PSScriptRoot -ChildPath $folder
7+
If (Test-Path -Path $folderPath)
8+
{
9+
Write-Verbose -Message "Importing from $folder"
10+
$functions = Get-ChildItem -Path $folderPath -Filter '*.ps1'
11+
ForEach ($function in $functions)
12+
{
13+
Write-Verbose -Message " Importing $($function.BaseName)"
14+
. $($function.FullName)
15+
}
16+
}
17+
}
18+
19+
$PublicFunctionsPath = Join-Path -path $PSScriptRoot -ChildPath 'functions'
20+
if (Test-Path -Path $PublicFunctionsPath)
21+
{
22+
$publicFunctions = (Get-ChildItem -Path $PublicFunctionsPath -Filter '*.ps1').BaseName
23+
Export-ModuleMember -Function $publicFunctions
24+
}

‎dscresources/cSpeculationControlFix.psm1

-71
This file was deleted.

‎functions/Update-RegistryItem.ps1

+7
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,13 @@ function Update-RegistryItem
4545
[String]
4646
$PropertyType
4747
)
48+
# Test if the path exists
49+
if (-not (Test-Path -Path $Path)) {
50+
Write-Verbose -Message 'Path does not exist, Calling New-Item'
51+
if ($PSCmdlet.ShouldProcess($Name, 'New-Item')) {
52+
$null = New-Item $Path -ItemType Directory
53+
}
54+
}
4855

4956
$Item = Get-Item -Path $Path
5057

‎tests/README_TESTS.md

-10
This file was deleted.

0 commit comments

Comments
 (0)