2

I am a big fan of Software Restriction Policies for Microsoft Windows and was recently updating our settings for this. I became curious as to where Microsoft implemented this technology in the stack. I can imagine a very naive implementation being in Windows Explorer where when you double click on an exe or other blocked file type, that Explorer would check against the policy. I call this naive because obviously this wouldn't protect against someone typing something in a CMD window. Or worse, Adobe Reader running an external application. On the other hand, I can imagine that software restriction policies could be implemented deep in the stack almost at the metal. In this case, the low level loader would load into memory the questionable file, but mark the memory in the memory manager as non-executable data.

I'm pretty sure that Microsoft did not do the most naive implementation, because if I block Java using a path block, Internet Explorer will crash if it attempts to load Java. Which is what I want. But I'm not sure how deep in the stack it's implemented and any insight would be appreciated.

4
  • 1
    "In the stack"? What "stack" are you referring to?
    – joeqwerty
    Jan 11, 2011 at 15:45
  • It sounds like you could quite easily test whether a few of your guesses are true or not?
    – GAThrawn
    Jan 11, 2011 at 18:09
  • @joeqwerty By stack I mean the technologies making up the Windows Operating system starting at the lowest level being drivers, with several middle levels of windows code, followed by the highest level of user interface programs, such as Windows Explorer or the CMD shell. See en.wikipedia.org/wiki/Technology_stack
    – Knox
    Jan 11, 2011 at 21:54
  • @GAThrawn I did test the naive level, as I mentioned in the OP and can rule out the most naive implementation. Alas, as I move down the stack, it's beyond my capability.
    – Knox
    Jan 11, 2011 at 21:56

0

Browse other questions tagged .