Options for Adding Custom Policy Rules in App Volumes

To add the custom rules, VMware recommends that you use the policy file in the base image. App Volumes provides multiple options for modifying the policy files for Writable Volumes or application packages. Depending on your requirement, you can create or modify the policy file at the corresponding volume locations.

Note: As per the security policy of App Volumes, you can access the configuration directory on a Writable Volume or an application package only through a process running with high integrity such as an elevated command prompt. You cannot access the configuration directory through Windows Explorer.

The following are the options for adding the custom policy rules:

• VMware recommends that for adding custom rules, the policy file at %SVAgent%\Config\Custom\Snapvol.cfg in the base image must be used.

  If the policy file does not exist, a new (empty) file must be created and custom rules must be added in the file.

• If modifying the base image is not possible and you are using a Writable Volume, then to update your policy file you can use the update Writable Volume feature in App Volumes Manager.

  The policy file is uploaded to all the Writable Volumes, as and when they get attached to a virtual machine.

  For more information about updating Writable Volumes, see Update Writable Volumes.

• If you want to have different policies within multiple Writable Volumes, you must create multiple Writable Volume templates.

  Each Writable Volume template must have a different set of custom rules in \Config\Writable\Snapvol.cfg, located in the root of the Writable Volume template.

  For example, consider two active directory groups: AD1 and AD2. If you want a different set of policies for each group, you can create two different Writable Volume templates with the respective policies. When assigning Writable Volumes for each group, you can select the respective Writable Volume template specifically created for each group.

• If you want the custom rules only for a particular Writable Volume or an application package, you can browse to the configuration directory of that volume and create or modify the snapvol.cfg in the corresponding location.

  If you want to add custom rules to an application package, the application package must be edited offline.

  For more information about the configuration directories for default and custom configuration files, see Default and Custom Configuration Files.