Skip to content

Commit

Permalink
Clean up (microsoft#82)
Browse files Browse the repository at this point in the history
* Intro update

* Intro2

* intro v3

* intro4

* Intro5

* Intro6

* pushing readme for risky-capabilities

* risky capabilities v2

* cleanUp

* cleanUpv2
  • Loading branch information
cchavez-msft authored Nov 21, 2024
1 parent e667556 commit bcb5e51
Show file tree
Hide file tree
Showing 43 changed files with 44 additions and 1,237 deletions.
17 changes: 2 additions & 15 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,21 +3,7 @@ Win32 app isolation is a new security feature on Windows that helps contain the
application compromise.
Win32 app isolation is built on the foundation of [AppContainers](https://learn.microsoft.com/en-us/windows/win32/secauthz/implementing-an-appcontainer), which offer a security boundary,
and components that virtualize resources and provide brokered access to other resources.
This repo contains the documentation and tools to help you isolate your applications.

## Getting started
* The first step to isolating your application is to package it to run isolated by following the instructions

* [using the MSIX packaing tool](docs/packaging/msix-packaging-tool.md)
* or [using Visual Studio](docs/packaging/packaging-with-visual-studio.md)

* Once you have your application packaged, use [Application Capability Profiler](docs/profiler/application-capability-profiler.md) to update the application to grant it access to additional resources.
* We also have additional documentation about the [fundamentals](docs/fundamentals) including file access consent.
* You're now ready to deploy and run your application on Windows.

Binaries for the tools used to package applications to run isolated are shared under the [releases](https://github.com/microsoft/win32-app-isolation/releases) section of the repo.

Release notes for supported Windows builds and tools can be found [here](relnotes/windows-release-notes.md).
This repo should be used only to file bugs or feature requests, and to ask questions. To learn more about the feature and how to enable it for your app, visit the main Win32 app isolation page at [MS Learn](https://learn.microsoft.com/en-us/windows/win32/secauthz/app-isolation-overview).

## Communicating with the team
We'd love to hear your feedback and answer your questions!
Expand All @@ -27,6 +13,7 @@ Please search for similar discussions and issues before creating new ones.

## Resources
You can find additional information about Win32 app isolation using the following resources:
* [MS Learn](https://learn.microsoft.com/en-us/windows/win32/secauthz/app-isolation-overview)
* [Win32 app isolation Build session](https://www.youtube.com/watch?v=w6VwHGPz12w&pp=ygUTd2luMzIgYXBwIGlzb2xhdGlvbg%3D%3D&ab_channel=MicrosoftDeveloper)
* [Win32 app isolation blog](https://blogs.windows.com/windowsdeveloper/2023/06/14/public-preview-improve-win32-app-security-via-app-isolation/)

Expand Down
84 changes: 42 additions & 42 deletions docs/fundamentals/consent.md → consent.md
Original file line number Diff line number Diff line change
@@ -1,42 +1,42 @@
# Consent for Isolated Win32 Apps

## How file access consent is granted

Consent is granted for Isolated Win32 Apps in three ways.

1. Implicit-Consent: Apps are implicitly granted access to files and folders through the flows
listed below.

* File Dialog: Files and folders that are selected or created through Window's file dialog
created from an isolated app.

* File Type Assocition: Apps that register FTA in the manifest will show up under the open-with
context menu and can be set as the default app.
* Apps that do this through a COM extension will need the
`isolatedWin32-shellExtensionContextMenu` capability.

* Drag and Drop: Apps that register drag and drop handlers will have access to any files and
folders dragged onto them.
* There is currently no support for dragging between different Isolated Win32 Apps.

2. Publisher Directory: If the application has the `isolatedWin32-accessToPublisherDirectory`
capability, then the app will have full access to:

* Network shares whose share name ends with the publisher ID of the app.

* Directories with names ending with the publisher ID of the app located in
`\Device\BootDevice\ProgramData`.

3. Prompting: If the application has the `isolatedWin32-promptForAccess` capability, the first time
the app attempts to access a file or directory, a prompt will be generated for the user to accept
or decline. The choice will be saved until the consent is revoked

## How consent is revoked

Consent can currently be revoked in two ways.

1. Settings: Through the settings, navigate to "Reset file permissions on isolated Win32
applications". On this page you can fully reset the consent granted to specific isolated apps. This
will reset both prompted and implicit consent, but won't affect the publisher directory.

2. Uninstall: During uninstall, all consent will be revoked.
# Consent for Isolated Win32 Apps

## How file access consent is granted

Consent is granted for Isolated Win32 Apps in three ways.

1. Implicit-Consent: Apps are implicitly granted access to files and folders through the flows
listed below.

* File Dialog: Files and folders that are selected or created through Window's file dialog
created from an isolated app.

* File Type Assocition: Apps that register FTA in the manifest will show up under the open-with
context menu and can be set as the default app.
* Apps that do this through a COM extension will need the
`isolatedWin32-shellExtensionContextMenu` capability.

* Drag and Drop: Apps that register drag and drop handlers will have access to any files and
folders dragged onto them.
* There is currently no support for dragging between different Isolated Win32 Apps.

2. Publisher Directory: If the application has the `isolatedWin32-accessToPublisherDirectory`
capability, then the app will have full access to:

* Network shares whose share name ends with the publisher ID of the app.

* Directories with names ending with the publisher ID of the app located in
`\Device\BootDevice\ProgramData`.

3. Prompting: If the application has the `isolatedWin32-promptForAccess` capability, the first time
the app attempts to access a file or directory, a prompt will be generated for the user to accept
or decline. The choice will be saved until the consent is revoked

## How consent is revoked

Consent can currently be revoked in two ways.

1. Settings: Through the settings, navigate to "Reset file permissions on isolated Win32
applications". On this page you can fully reset the consent granted to specific isolated apps. This
will reset both prompted and implicit consent, but won't affect the publisher directory.

2. Uninstall: During uninstall, all consent will be revoked.
25 changes: 0 additions & 25 deletions docs/README.md

This file was deleted.

Binary file removed docs/packaging/images/01-packaging-main-menu.png
Binary file not shown.
Binary file removed docs/packaging/images/02-packaging-prepare.png
Binary file not shown.
Binary file removed docs/packaging/images/03-packaging-installer.png
Binary file not shown.
Binary file removed docs/packaging/images/04-packaging-package-info.png
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed docs/packaging/images/11-packaging-manifest.png
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed docs/packaging/images/vs/03-New-Project.png
Binary file not shown.
Binary file removed docs/packaging/images/vs/04-New-Windows-Project.png
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed docs/packaging/images/vs/07-SDK-BuildTools-Info.png
Binary file not shown.
Binary file removed docs/packaging/images/vs/09-PackagingAppx-File.png
Binary file not shown.
Binary file removed docs/packaging/images/vs/10-Build-Solution.png
Binary file not shown.
Binary file removed docs/packaging/images/vs/11-Create-App-Packages.png
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed docs/packaging/images/vs/14-Install-App-Package.png
Binary file not shown.
122 changes: 0 additions & 122 deletions docs/packaging/msix-packaging-tool.md

This file was deleted.

86 changes: 0 additions & 86 deletions docs/packaging/packaging-with-visual-studio.md

This file was deleted.

Loading

0 comments on commit bcb5e51

Please sign in to comment.