diff --git a/changes/windows-open-query-overrides-high-value b/changes/windows-open-query-overrides-high-value new file mode 100644 index 00000000000..5d330661f88 --- /dev/null +++ b/changes/windows-open-query-overrides-high-value @@ -0,0 +1 @@ +- Added curated process-name mappings for 33 Fleet-maintained Windows apps (Mozilla Firefox, VLC media player, SQL Server Management Studio, Visual Studio 2022, Power BI, Docker Desktop, GitHub Desktop, and others) so their "app open" pre-install check matches the app's real process instead of a name derived from the catalog title. diff --git a/pkg/patch_policy/patch_policy.go b/pkg/patch_policy/patch_policy.go index fa76966ba19..46a303ad953 100644 --- a/pkg/patch_policy/patch_policy.go +++ b/pkg/patch_policy/patch_policy.go @@ -193,55 +193,88 @@ func escapeSQLLiteral(s string) string { // overrides based on uninstall scripts var windowsOpenQueryOverrides = map[string]string{ //nolint:gosec // G101 false positive: values are app process names, not credentials - "1Password": "LIKE '1password%'", - "7-zip": "IN ('7zfm.exe','7zg.exe')", - "Amazon Chime": "IN ('amazon chime.exe','chime.exe')", - "Android Studio": "= 'studio64.exe'", - "Beyond Compare": "= 'bcompare.exe'", - "CLion": "IN ('clion.exe','clion64.exe')", - "DataGrip": "IN ('datagrip.exe','datagrip64.exe')", - "DataSpell": "IN ('dataspell.exe','dataspell64.exe')", - "DAX Studio": "= 'daxstudio.exe'", - "DBeaverEE": "= 'dbeaver.exe'", - "DBeaverLite": "= 'dbeaver.exe'", - "DBeaverUltimate": "= 'dbeaver.exe'", - "Dell Command Update": "IN ('dellcommandupdate.exe','dcu-cli.exe')", - "GoLand": "IN ('goland.exe','goland64.exe')", - "Google Antigravity IDE": "= 'antigravity.exe'", - "Google Chrome": "= 'chrome.exe'", - "IntelliJ IDEA CE": "IN ('idea.exe','idea64.exe')", - "IntelliJ IDEA Ultimate": "IN ('idea.exe','idea64.exe')", - "JetBrains Toolbox": "IN ('toolbox.exe','jetbrains-toolbox.exe')", - "KNIME Analytics Platform": "= 'knime.exe'", - "Lenovo Dock Manager": "= 'dockmgr.exe'", - "Microsoft Edge": "= 'msedge.exe'", - "Microsoft Remote Help": "= 'remotehelp.exe'", - "Microsoft Teams": "IN ('teams.exe','ms-teams.exe')", - "Microsoft Visual Studio Code": "= 'code.exe'", - "Node.js": "= 'node.exe'", - "Notion Calendar": "IN ('cron.exe','notion calendar.exe')", - "OBS": "IN ('obs32.exe','obs64.exe')", - "Okta Verify": "= 'oktaverify.exe'", - "Ollama": "IN ('ollama.exe','ollama app.exe')", - "OneDrive": "LIKE 'onedrive%'", - "Pale Moon": "= 'palemoon.exe'", - "pgAdmin 4": "= 'pgadmin4.exe'", - "PhpStorm": "IN ('phpstorm.exe','phpstorm64.exe')", - "Plantronics Hub": "= 'plthub.exe'", - "Portfolio Performance": "= 'portfolioperformance.exe'", - "Power Automate": "= 'pad.console.host.exe'", - "PowerShell": "= 'pwsh.exe'", - "ProtonVPN": "IN ('proton vpn.exe','protonvpn.exe')", - "PyCharm Community Edition": "IN ('pycharm.exe','pycharm64.exe')", - "PyCharm Professional": "IN ('pycharm.exe','pycharm64.exe')", - "Rider": "IN ('rider.exe','rider64.exe')", - "RStudio": "IN ('rgui.exe','rsession.exe','rstudio.exe')", - "RubyMine": "IN ('rubymine.exe','rubymine64.exe')", - "RustRover": "IN ('rustrover.exe','rustrover64.exe')", - "Spotify": "IN ('spotify.exe','spotifywebhelper.exe')", - "Sublime Text": "= 'sublime_text.exe'", - "VirtualBox": "LIKE 'virtualbox%'", - "Wacom Tablet": "IN ('wacomdesktopcenter.exe','wacom_tablet.exe')", - "WebStorm": "IN ('webstorm.exe','webstorm64.exe')", - "Windows App": "= 'windowsapp.exe'", + "1Password": "LIKE '1password%'", + "7-zip": "IN ('7zfm.exe','7zg.exe')", + "Adobe Acrobat Pro": "= 'acrobat.exe'", + "Adobe Acrobat Reader": "IN ('acrord32.exe','acrobat.exe')", + "Amazon Chime": "IN ('amazon chime.exe','chime.exe')", + "Android Studio": "= 'studio64.exe'", + "Azure Data Studio": "= 'azuredatastudio.exe'", + "Beyond Compare": "= 'bcompare.exe'", + "Cisco Jabber": "= 'ciscojabber.exe'", + "CLion": "IN ('clion.exe','clion64.exe')", + "DataGrip": "IN ('datagrip.exe','datagrip64.exe')", + "DataSpell": "IN ('dataspell.exe','dataspell64.exe')", + "DAX Studio": "= 'daxstudio.exe'", + "DBeaverEE": "= 'dbeaver.exe'", + "DBeaverLite": "= 'dbeaver.exe'", + "DBeaverUltimate": "= 'dbeaver.exe'", + "Dell Command Update": "IN ('dellcommandupdate.exe','dcu-cli.exe')", + "Directory Opus": "= 'dopus.exe'", + "Docker Desktop": "= 'docker desktop.exe'", + "Elgato Stream Deck": "= 'streamdeck.exe'", + "eM Client": "= 'mailclient.exe'", + "Epic Games Launcher": "= 'epicgameslauncher.exe'", + "Genesys Cloud": "IN ('genesys cloud.exe','genesyscloud.exe')", + "Git Extensions": "= 'gitextensions.exe'", + "GitHub Desktop": "= 'githubdesktop.exe'", + "GOG Galaxy": "= 'galaxyclient.exe'", + "GoLand": "IN ('goland.exe','goland64.exe')", + "Google Antigravity IDE": "= 'antigravity.exe'", + "Google Chrome": "= 'chrome.exe'", + "Google Drive": "= 'googledrivefs.exe'", + "IntelliJ IDEA CE": "IN ('idea.exe','idea64.exe')", + "IntelliJ IDEA Ultimate": "IN ('idea.exe','idea64.exe')", + "JetBrains Toolbox": "IN ('toolbox.exe','jetbrains-toolbox.exe')", + "KNIME Analytics Platform": "= 'knime.exe'", + "Lenovo Dock Manager": "= 'dockmgr.exe'", + "Microsoft Edge": "= 'msedge.exe'", + "Microsoft Remote Help": "= 'remotehelp.exe'", + "Microsoft Teams": "IN ('teams.exe','ms-teams.exe')", + "Microsoft Visual Studio Code": "= 'code.exe'", + "MongoDB Compass": "IN ('mongodbcompass.exe','mongodb compass.exe')", + "Mozilla Firefox": "= 'firefox.exe'", + "Mozilla Firefox Developer Edition": "= 'firefox.exe'", + "Mozilla Firefox ESR": "= 'firefox.exe'", + "Mozilla Firefox Nightly": "= 'firefox.exe'", + "Mozilla VPN": "= 'mozilla vpn.exe'", + "MySQL Workbench": "= 'mysqlworkbench.exe'", + "Node.js": "= 'node.exe'", + "Notion Calendar": "IN ('cron.exe','notion calendar.exe')", + "OBS": "IN ('obs32.exe','obs64.exe')", + "Okta Verify": "= 'oktaverify.exe'", + "Ollama": "IN ('ollama.exe','ollama app.exe')", + "OneDrive": "LIKE 'onedrive%'", + "Pale Moon": "= 'palemoon.exe'", + "pgAdmin 4": "= 'pgadmin4.exe'", + "PhpStorm": "IN ('phpstorm.exe','phpstorm64.exe')", + "Plantronics Hub": "= 'plthub.exe'", + "Podman Desktop": "= 'podman desktop.exe'", + "Portfolio Performance": "= 'portfolioperformance.exe'", + "Power Automate": "= 'pad.console.host.exe'", + "Power BI": "= 'pbidesktop.exe'", + "PowerShell": "= 'pwsh.exe'", + "Proton Drive": "= 'proton drive.exe'", + "ProtonVPN": "IN ('proton vpn.exe','protonvpn.exe')", + "PyCharm Community Edition": "IN ('pycharm.exe','pycharm64.exe')", + "PyCharm Professional": "IN ('pycharm.exe','pycharm64.exe')", + "Rancher Desktop": "= 'rancher desktop.exe'", + "Rider": "IN ('rider.exe','rider64.exe')", + "RStudio": "IN ('rgui.exe','rsession.exe','rstudio.exe')", + "RubyMine": "IN ('rubymine.exe','rubymine64.exe')", + "RustRover": "IN ('rustrover.exe','rustrover64.exe')", + "Spotify": "IN ('spotify.exe','spotifywebhelper.exe')", + "SQL Server Management Studio": "= 'ssms.exe'", + "Standard Notes": "= 'standard notes.exe'", + "Sublime Text": "= 'sublime_text.exe'", + "Tableau Desktop": "= 'tableau.exe'", + "TeamViewer Host": "= 'teamviewer.exe'", + "VirtualBox": "LIKE 'virtualbox%'", + "Visual Studio Community 2022": "= 'devenv.exe'", + "Visual Studio Enterprise 2022": "= 'devenv.exe'", + "Visual Studio Professional 2022": "= 'devenv.exe'", + "VLC media player": "= 'vlc.exe'", + "Wacom Tablet": "IN ('wacomdesktopcenter.exe','wacom_tablet.exe')", + "WebStorm": "IN ('webstorm.exe','webstorm64.exe')", + "Windows App": "= 'windowsapp.exe'", } diff --git a/pkg/patch_policy/patch_policy_test.go b/pkg/patch_policy/patch_policy_test.go index 2052e15de22..a484c711a37 100644 --- a/pkg/patch_policy/patch_policy_test.go +++ b/pkg/patch_policy/patch_policy_test.go @@ -99,6 +99,18 @@ func TestGenerateOpenQuery(t *testing.T) { got = patch_policy.GenerateOpenQuery("windows", "", "Microsoft Teams") require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('teams.exe','ms-teams.exe'));", got) + // Multi-word titles whose real process name differs from the derived + // ".exe" rely on overrides ("Mozilla Firefox" runs firefox.exe, not + // "mozilla firefox.exe"). + got = patch_policy.GenerateOpenQuery("windows", "", "Mozilla Firefox") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'firefox.exe');", got) + + got = patch_policy.GenerateOpenQuery("windows", "", "Adobe Acrobat Reader") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('acrord32.exe','acrobat.exe'));", got) + + got = patch_policy.GenerateOpenQuery("windows", "", "Visual Studio Community 2022") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'devenv.exe');", got) + // Unknown platform yields no query. require.Empty(t, patch_policy.GenerateOpenQuery("linux", "com.example.foo", "")) }