-
Notifications
You must be signed in to change notification settings - Fork 29
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add handling VBS known issue on ESXi 7.0.3 (#429)
Signed-off-by: Diane Wang <dianew@vmware.com>
- Loading branch information
Showing
5 changed files
with
178 additions
and
64 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| # Copyright 2023 VMware, Inc. | ||
| # SPDX-License-Identifier: BSD-2-Clause | ||
| --- | ||
| # Get available security properties for Windows Defender Device Guard. | ||
| # Refer to this page: https://docs.microsoft.com/en-us/windows/security/ | ||
| # threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity | ||
| # 1. If present, hypervisor support is available. | ||
| # 2. If present, Secure Boot is available. | ||
| # 3. If present, DMA protection is available. | ||
| # 4. If present, Secure Memory Overwrite is available. | ||
| # 5. If present, NX protections are available. | ||
| # 6. If present, SMM mitigations are available. | ||
| # 7. If present, MBEC/GMET is available. | ||
| # 8. If present, APIC virtualization is available. | ||
| # | ||
| - name: "Initialize the fact of Device Guard available security properties" | ||
| ansible.builtin.set_fact: | ||
| win_dg_security_properties: [] | ||
|
|
||
| - name: "Get Device Guard available security properties" | ||
| include_tasks: win_execute_cmd.yml | ||
| vars: | ||
| win_powershell_cmd: "(CimInstance –ClassName Win32_DeviceGuard –Namespace root\\Microsoft\\Windows\\DeviceGuard).AvailableSecurityProperties" | ||
|
|
||
| - name: "Set fact of Device Guard available security properties" | ||
| ansible.builtin.set_fact: | ||
| win_dg_security_properties: "{{ win_powershell_cmd_output.stdout_lines | map('int') }}" | ||
| when: | ||
| - win_powershell_cmd_output is defined | ||
| - win_powershell_cmd_output.stdout_lines is defined | ||
| - win_powershell_cmd_output.stdout_lines | length != 0 | ||
|
|
||
| - name: "Display the results" | ||
| ansible.builtin.debug: | ||
| msg: | ||
| - "AvailableSecurityProperties: {{ win_dg_security_properties }}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,54 +1,62 @@ | ||
| # Copyright 2022-2023 VMware, Inc. | ||
| # SPDX-License-Identifier: BSD-2-Clause | ||
| --- | ||
| # Shutdown guest OS to disable VBS on VM | ||
| - include_tasks: ../utils/win_shutdown_restart.yml | ||
| - name: "Shutdown guest OS to disable VBS on VM" | ||
| include_tasks: ../utils/win_shutdown_restart.yml | ||
| vars: | ||
| set_win_power_state: "shutdown" | ||
|
|
||
| # Disable VBS on VM | ||
| - include_tasks: ../utils/win_enable_vbs_vm.yml | ||
| - name: "Disable VBS on VM" | ||
| include_tasks: ../utils/win_enable_vbs_vm.yml | ||
| vars: | ||
| win_enable_vbs: false | ||
|
|
||
| # Power on VM | ||
| - include_tasks: ../../common/vm_set_power_state.yml | ||
| - name: "Power on VM" | ||
| include_tasks: ../../common/vm_set_power_state.yml | ||
| vars: | ||
| vm_power_state_set: "powered-on" | ||
| - include_tasks: ../utils/win_update_inventory.yml | ||
| - name: "Update in-memory inventory after VM power on" | ||
| include_tasks: ../utils/win_update_inventory.yml | ||
|
|
||
| # Check VM VBS status on VM | ||
| - include_tasks: ../../common/vm_get_vbs_status.yml | ||
| - name: "Check VM VBS status after enable" | ||
| - name: "Get VM VBS status" | ||
| include_tasks: ../../common/vm_get_vbs_status.yml | ||
| - name: "Check VM VBS status after disable" | ||
| ansible.builtin.assert: | ||
| that: | ||
| - vm_vbs_enabled is defined | ||
| - not vm_vbs_enabled | bool | ||
| fail_msg: "VM VBS status is not disabled after disabling it." | ||
|
|
||
| # Get VBS status in guest OS | ||
| - include_tasks: ../utils/win_get_vbs_guest.yml | ||
|
|
||
| # SecurityServicesRunning: 0 means No services running | ||
| # VirtualizationBasedSecurityStatus: 1 means VBS is enabled but not running | ||
| fail_msg: "VM VBS enabled status is '{{ vm_vbs_enabled | default('') }}', not disabled after disabling it." | ||
|
|
||
| - name: "Get VBS status in guest OS" | ||
| include_tasks: ../utils/win_get_vbs_guest.yml | ||
|
|
||
| # SecurityServicesRunning: | ||
| # 0. No services running. | ||
| # 1. If present, Windows Defender Credential Guard is running. | ||
| # 2. If present, HVCI is running. | ||
| # 3. If present, System Guard Secure Launch is running. | ||
| # 4. If present, SMM Firmware Measurement is running. | ||
| # VirtualizationBasedSecurityStatus: | ||
| # 2 means VBS is enabled and running | ||
| # 1 means VBS is enabled but not running | ||
| # 0 means VBS is not enabled | ||
| # | ||
| - name: "Check VBS and running security service status" | ||
| ansible.builtin.assert: | ||
| that: | ||
| - win_vbs_status_guest | int == 1 | ||
| - win_vbs_running_service[0] | int != 2 | ||
| fail_msg: "Either VBS is running '{{ win_vbs_status_guest }}', or HVCI is running '{{ win_vbs_running_service }}'." | ||
| - "'2' not in win_vbs_running_service" | ||
| fail_msg: "VBS status is '{{ win_vbs_status_guest }}' not expected '1', or HVCI '2' is in SecurityServicesRunning list '{{ win_vbs_running_service }}'." | ||
|
|
||
| # Disable VBS in guest | ||
| - include_tasks: ../utils/win_disable_vbs_guest.yml | ||
| - name: "Disable VBS in guest OS" | ||
| include_tasks: ../utils/win_disable_vbs_guest.yml | ||
|
|
||
| # Get VBS status in guest OS | ||
| - include_tasks: ../utils/win_get_vbs_guest.yml | ||
| - name: "Get VBS status in guest OS" | ||
| include_tasks: ../utils/win_get_vbs_guest.yml | ||
|
|
||
| # SecurityServicesRunning: 0 means No services running | ||
| # VirtualizationBasedSecurityStatus: 0 means VBS is not enabled | ||
| - name: "Check VBS and running security service status" | ||
| ansible.builtin.assert: | ||
| that: | ||
| - win_vbs_status_guest | int == 0 | ||
| - win_vbs_running_service[0] | int == 0 | ||
| fail_msg: "Either VBS is not disabled '{{ win_vbs_status_guest }}', or still running security service '{{ win_vbs_running_service }}'." | ||
| - win_vbs_running_service == ['0'] | ||
| fail_msg: "VBS status is '{{ win_vbs_status_guest }}' not expected '0', or SecurityServicesRunning list is '{{ win_vbs_running_service }}', not expected ['0']." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters