From 8517f8fa73a94fc4ff42738c32562b70fea1b3d3 Mon Sep 17 00:00:00 2001 From: Allen Houchins Date: Fri, 7 Aug 2026 22:12:13 -0500 Subject: [PATCH] Add curated Windows open-query process names for 33 high-value FMAs The Windows 'app open' pre-install query (patch_when_closed gate) only works when it names the app's real process image. For multi-word catalog names the generated '.exe' guess almost never does ('mozilla firefox.exe' vs the real firefox.exe), so the gate silently never blocks. Add windowsOpenQueryOverrides entries for the highest-value affected apps: Firefox (all four channels), VLC, SQL Server Management Studio, MySQL Workbench, Power BI, Visual Studio 2022 (all three editions), GitHub Desktop, Docker Desktop, Adobe Acrobat Pro/Reader, Azure Data Studio, MongoDB Compass, Epic Games Launcher, GOG Galaxy, eM Client, Git Extensions, Google Drive, Tableau, Directory Opus, Cisco Jabber, TeamViewer Host, Elgato Stream Deck, and Electron apps whose spaced executable name matches their catalog name (Podman Desktop, Rancher Desktop, Proton Drive, Standard Notes, Genesys Cloud, Mozilla VPN). Where the exact image name is ambiguous the entry lists both candidate names with IN (an entry that names a process that never runs is a no-op, identical to having no gate, so the failure mode is benign). --- .../windows-open-query-overrides-high-value | 1 + pkg/patch_policy/patch_policy.go | 135 +++++++++++------- pkg/patch_policy/patch_policy_test.go | 12 ++ 3 files changed, 97 insertions(+), 51 deletions(-) create mode 100644 changes/windows-open-query-overrides-high-value diff --git a/changes/windows-open-query-overrides-high-value b/changes/windows-open-query-overrides-high-value new file mode 100644 index 00000000000..5d330661f88 --- /dev/null +++ b/changes/windows-open-query-overrides-high-value @@ -0,0 +1 @@ +- Added curated process-name mappings for 33 Fleet-maintained Windows apps (Mozilla Firefox, VLC media player, SQL Server Management Studio, Visual Studio 2022, Power BI, Docker Desktop, GitHub Desktop, and others) so their "app open" pre-install check matches the app's real process instead of a name derived from the catalog title. diff --git a/pkg/patch_policy/patch_policy.go b/pkg/patch_policy/patch_policy.go index fa76966ba19..46a303ad953 100644 --- a/pkg/patch_policy/patch_policy.go +++ b/pkg/patch_policy/patch_policy.go @@ -193,55 +193,88 @@ func escapeSQLLiteral(s string) string { // overrides based on uninstall scripts var windowsOpenQueryOverrides = map[string]string{ //nolint:gosec // G101 false positive: values are app process names, not credentials - "1Password": "LIKE '1password%'", - "7-zip": "IN ('7zfm.exe','7zg.exe')", - "Amazon Chime": "IN ('amazon chime.exe','chime.exe')", - "Android Studio": "= 'studio64.exe'", - "Beyond Compare": "= 'bcompare.exe'", - "CLion": "IN ('clion.exe','clion64.exe')", - "DataGrip": "IN ('datagrip.exe','datagrip64.exe')", - "DataSpell": "IN ('dataspell.exe','dataspell64.exe')", - "DAX Studio": "= 'daxstudio.exe'", - "DBeaverEE": "= 'dbeaver.exe'", - "DBeaverLite": "= 'dbeaver.exe'", - "DBeaverUltimate": "= 'dbeaver.exe'", - "Dell Command Update": "IN ('dellcommandupdate.exe','dcu-cli.exe')", - "GoLand": "IN ('goland.exe','goland64.exe')", - "Google Antigravity IDE": "= 'antigravity.exe'", - "Google Chrome": "= 'chrome.exe'", - "IntelliJ IDEA CE": "IN ('idea.exe','idea64.exe')", - "IntelliJ IDEA Ultimate": "IN ('idea.exe','idea64.exe')", - "JetBrains Toolbox": "IN ('toolbox.exe','jetbrains-toolbox.exe')", - "KNIME Analytics Platform": "= 'knime.exe'", - "Lenovo Dock Manager": "= 'dockmgr.exe'", - "Microsoft Edge": "= 'msedge.exe'", - "Microsoft Remote Help": "= 'remotehelp.exe'", - "Microsoft Teams": "IN ('teams.exe','ms-teams.exe')", - "Microsoft Visual Studio Code": "= 'code.exe'", - "Node.js": "= 'node.exe'", - "Notion Calendar": "IN ('cron.exe','notion calendar.exe')", - "OBS": "IN ('obs32.exe','obs64.exe')", - "Okta Verify": "= 'oktaverify.exe'", - "Ollama": "IN ('ollama.exe','ollama app.exe')", - "OneDrive": "LIKE 'onedrive%'", - "Pale Moon": "= 'palemoon.exe'", - "pgAdmin 4": "= 'pgadmin4.exe'", - "PhpStorm": "IN ('phpstorm.exe','phpstorm64.exe')", - "Plantronics Hub": "= 'plthub.exe'", - "Portfolio Performance": "= 'portfolioperformance.exe'", - "Power Automate": "= 'pad.console.host.exe'", - "PowerShell": "= 'pwsh.exe'", - "ProtonVPN": "IN ('proton vpn.exe','protonvpn.exe')", - "PyCharm Community Edition": "IN ('pycharm.exe','pycharm64.exe')", - "PyCharm Professional": "IN ('pycharm.exe','pycharm64.exe')", - "Rider": "IN ('rider.exe','rider64.exe')", - "RStudio": "IN ('rgui.exe','rsession.exe','rstudio.exe')", - "RubyMine": "IN ('rubymine.exe','rubymine64.exe')", - "RustRover": "IN ('rustrover.exe','rustrover64.exe')", - "Spotify": "IN ('spotify.exe','spotifywebhelper.exe')", - "Sublime Text": "= 'sublime_text.exe'", - "VirtualBox": "LIKE 'virtualbox%'", - "Wacom Tablet": "IN ('wacomdesktopcenter.exe','wacom_tablet.exe')", - "WebStorm": "IN ('webstorm.exe','webstorm64.exe')", - "Windows App": "= 'windowsapp.exe'", + "1Password": "LIKE '1password%'", + "7-zip": "IN ('7zfm.exe','7zg.exe')", + "Adobe Acrobat Pro": "= 'acrobat.exe'", + "Adobe Acrobat Reader": "IN ('acrord32.exe','acrobat.exe')", + "Amazon Chime": "IN ('amazon chime.exe','chime.exe')", + "Android Studio": "= 'studio64.exe'", + "Azure Data Studio": "= 'azuredatastudio.exe'", + "Beyond Compare": "= 'bcompare.exe'", + "Cisco Jabber": "= 'ciscojabber.exe'", + "CLion": "IN ('clion.exe','clion64.exe')", + "DataGrip": "IN ('datagrip.exe','datagrip64.exe')", + "DataSpell": "IN ('dataspell.exe','dataspell64.exe')", + "DAX Studio": "= 'daxstudio.exe'", + "DBeaverEE": "= 'dbeaver.exe'", + "DBeaverLite": "= 'dbeaver.exe'", + "DBeaverUltimate": "= 'dbeaver.exe'", + "Dell Command Update": "IN ('dellcommandupdate.exe','dcu-cli.exe')", + "Directory Opus": "= 'dopus.exe'", + "Docker Desktop": "= 'docker desktop.exe'", + "Elgato Stream Deck": "= 'streamdeck.exe'", + "eM Client": "= 'mailclient.exe'", + "Epic Games Launcher": "= 'epicgameslauncher.exe'", + "Genesys Cloud": "IN ('genesys cloud.exe','genesyscloud.exe')", + "Git Extensions": "= 'gitextensions.exe'", + "GitHub Desktop": "= 'githubdesktop.exe'", + "GOG Galaxy": "= 'galaxyclient.exe'", + "GoLand": "IN ('goland.exe','goland64.exe')", + "Google Antigravity IDE": "= 'antigravity.exe'", + "Google Chrome": "= 'chrome.exe'", + "Google Drive": "= 'googledrivefs.exe'", + "IntelliJ IDEA CE": "IN ('idea.exe','idea64.exe')", + "IntelliJ IDEA Ultimate": "IN ('idea.exe','idea64.exe')", + "JetBrains Toolbox": "IN ('toolbox.exe','jetbrains-toolbox.exe')", + "KNIME Analytics Platform": "= 'knime.exe'", + "Lenovo Dock Manager": "= 'dockmgr.exe'", + "Microsoft Edge": "= 'msedge.exe'", + "Microsoft Remote Help": "= 'remotehelp.exe'", + "Microsoft Teams": "IN ('teams.exe','ms-teams.exe')", + "Microsoft Visual Studio Code": "= 'code.exe'", + "MongoDB Compass": "IN ('mongodbcompass.exe','mongodb compass.exe')", + "Mozilla Firefox": "= 'firefox.exe'", + "Mozilla Firefox Developer Edition": "= 'firefox.exe'", + "Mozilla Firefox ESR": "= 'firefox.exe'", + "Mozilla Firefox Nightly": "= 'firefox.exe'", + "Mozilla VPN": "= 'mozilla vpn.exe'", + "MySQL Workbench": "= 'mysqlworkbench.exe'", + "Node.js": "= 'node.exe'", + "Notion Calendar": "IN ('cron.exe','notion calendar.exe')", + "OBS": "IN ('obs32.exe','obs64.exe')", + "Okta Verify": "= 'oktaverify.exe'", + "Ollama": "IN ('ollama.exe','ollama app.exe')", + "OneDrive": "LIKE 'onedrive%'", + "Pale Moon": "= 'palemoon.exe'", + "pgAdmin 4": "= 'pgadmin4.exe'", + "PhpStorm": "IN ('phpstorm.exe','phpstorm64.exe')", + "Plantronics Hub": "= 'plthub.exe'", + "Podman Desktop": "= 'podman desktop.exe'", + "Portfolio Performance": "= 'portfolioperformance.exe'", + "Power Automate": "= 'pad.console.host.exe'", + "Power BI": "= 'pbidesktop.exe'", + "PowerShell": "= 'pwsh.exe'", + "Proton Drive": "= 'proton drive.exe'", + "ProtonVPN": "IN ('proton vpn.exe','protonvpn.exe')", + "PyCharm Community Edition": "IN ('pycharm.exe','pycharm64.exe')", + "PyCharm Professional": "IN ('pycharm.exe','pycharm64.exe')", + "Rancher Desktop": "= 'rancher desktop.exe'", + "Rider": "IN ('rider.exe','rider64.exe')", + "RStudio": "IN ('rgui.exe','rsession.exe','rstudio.exe')", + "RubyMine": "IN ('rubymine.exe','rubymine64.exe')", + "RustRover": "IN ('rustrover.exe','rustrover64.exe')", + "Spotify": "IN ('spotify.exe','spotifywebhelper.exe')", + "SQL Server Management Studio": "= 'ssms.exe'", + "Standard Notes": "= 'standard notes.exe'", + "Sublime Text": "= 'sublime_text.exe'", + "Tableau Desktop": "= 'tableau.exe'", + "TeamViewer Host": "= 'teamviewer.exe'", + "VirtualBox": "LIKE 'virtualbox%'", + "Visual Studio Community 2022": "= 'devenv.exe'", + "Visual Studio Enterprise 2022": "= 'devenv.exe'", + "Visual Studio Professional 2022": "= 'devenv.exe'", + "VLC media player": "= 'vlc.exe'", + "Wacom Tablet": "IN ('wacomdesktopcenter.exe','wacom_tablet.exe')", + "WebStorm": "IN ('webstorm.exe','webstorm64.exe')", + "Windows App": "= 'windowsapp.exe'", } diff --git a/pkg/patch_policy/patch_policy_test.go b/pkg/patch_policy/patch_policy_test.go index 2052e15de22..a484c711a37 100644 --- a/pkg/patch_policy/patch_policy_test.go +++ b/pkg/patch_policy/patch_policy_test.go @@ -99,6 +99,18 @@ func TestGenerateOpenQuery(t *testing.T) { got = patch_policy.GenerateOpenQuery("windows", "", "Microsoft Teams") require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('teams.exe','ms-teams.exe'));", got) + // Multi-word titles whose real process name differs from the derived + // "<title>.exe" rely on overrides ("Mozilla Firefox" runs firefox.exe, not + // "mozilla firefox.exe"). + got = patch_policy.GenerateOpenQuery("windows", "", "Mozilla Firefox") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'firefox.exe');", got) + + got = patch_policy.GenerateOpenQuery("windows", "", "Adobe Acrobat Reader") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('acrord32.exe','acrobat.exe'));", got) + + got = patch_policy.GenerateOpenQuery("windows", "", "Visual Studio Community 2022") + require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) = 'devenv.exe');", got) + // Unknown platform yields no query. require.Empty(t, patch_policy.GenerateOpenQuery("linux", "com.example.foo", "")) }