mirror of https://github.com/raandree/NTFSSecurity
Browse Source
Add tests for the error handling that the cmdlets with -Path share: a path that doesn't exist (16 cmdlets, and 6 audit cmdlets with the Security privilege), an item whose owner may not read its permissions (6 cmdlets), and an item whose owner may not change them, which the 6 cmdlets that write the DACL handle by taking ownership. Each error belongs to its path only, and the cmdlet goes on with the next one. The tests found one defect: Get-NTFSOrphanedAccess reported an item that it couldn't read as an AddAceError with the category WriteError. It now writes a ReadSecurityError, like Get-NTFSAccess. They also show that the take-ownership retry works without privileges when the account holds the Take Ownership right and may assign the previous owner, and that it can't help a denied read, because reading the owner needs the same right. Concepts and five cmdlet pages said that the retry needs the privileges; they now describe both, and that Windows removes the OWNER RIGHTS entries when the owner changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant <ai@example.com>ai/release-5.0.0-rc6
Raimund Andree
4 days ago
10 changed files with 254 additions and 12 deletions
@ -0,0 +1,232 @@ |
|||||
|
<# |
||||
|
Tests the error handling that the cmdlets with -Path share, with the module built in NTFSSecurity\bin\Release on |
||||
|
files in a sandbox folder: a path that doesn't exist, an item whose owner may not read its permissions, and an item |
||||
|
whose owner may not change its permissions, which the cmdlets that write the DACL handle by taking ownership. Each |
||||
|
error belongs to its path only, and the cmdlet continues with the next one. The tests turn the module setting |
||||
|
EnablePrivileges off, so that an elevated session meets the same denials as a basic user, and restore it. |
||||
|
#> |
||||
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute( |
||||
|
'PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'Pester shares variables between blocks.' |
||||
|
)] |
||||
|
param () |
||||
|
|
||||
|
BeforeDiscovery { |
||||
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force |
||||
|
$holdsSecurityPrivilege = Test-PrivilegeHeld -Name 'SeSecurityPrivilege' |
||||
|
$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value |
||||
|
$readEntry = @{ Account = 'S-1-1-0'; AccessRights = 'ReadData' } |
||||
|
# An audit entry on a file has no inheritance flags. |
||||
|
$auditEntry = @{ Account = 'S-1-1-0'; AccessRights = 'ReadData'; InheritanceFlags = 'None'; PropagationFlags = 'None' } |
||||
|
|
||||
|
# Output: whether the cmdlet writes an object for the next path, an existing file. |
||||
|
$missingPathCases = @( |
||||
|
@{ Command = 'Get-NTFSAccess'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Add-NTFSAccess'; Parameters = $readEntry; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Remove-NTFSAccess'; Parameters = $readEntry; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Clear-NTFSAccess'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Get-NTFSEffectiveAccess'; Parameters = @{ Account = 'S-1-1-0' }; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Get-NTFSOrphanedAccess'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Get-NTFSInheritance'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Enable-NTFSAccessInheritance'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Disable-NTFSAccessInheritance'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Set-NTFSInheritance'; Parameters = @{ AccessInheritanceEnabled = $true }; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Get-NTFSOwner'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Set-NTFSOwner'; Parameters = @{ Account = $currentUser }; ErrorId = 'ReadFileError'; Output = $false } |
||||
|
@{ Command = 'Get-NTFSSecurityDescriptor'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Get-Item2'; Parameters = @{}; ErrorId = 'FileNotFound'; Output = $true } |
||||
|
@{ Command = 'Get-FileHash2'; Parameters = @{}; ErrorId = 'ReadFileError'; Output = $true } |
||||
|
@{ Command = 'Get-NTFSHardLink'; Parameters = @{}; ErrorId = 'FileNotFound'; Output = $true } |
||||
|
) |
||||
|
|
||||
|
# The audit cmdlets need the Security privilege for the next path. |
||||
|
$missingPathAuditCases = @( |
||||
|
@{ Command = 'Get-NTFSAudit'; Parameters = @{} } |
||||
|
@{ Command = 'Add-NTFSAudit'; Parameters = $auditEntry } |
||||
|
@{ Command = 'Remove-NTFSAudit'; Parameters = $auditEntry } |
||||
|
@{ Command = 'Clear-NTFSAudit'; Parameters = @{} } |
||||
|
@{ Command = 'Enable-NTFSAuditInheritance'; Parameters = @{} } |
||||
|
@{ Command = 'Disable-NTFSAuditInheritance'; Parameters = @{} } |
||||
|
) |
||||
|
|
||||
|
$deniedReadCases = @( |
||||
|
@{ Command = 'Get-NTFSAccess'; Parameters = @{}; Output = $true } |
||||
|
@{ Command = 'Get-NTFSEffectiveAccess'; Parameters = @{ Account = 'S-1-1-0' }; Output = $true } |
||||
|
@{ Command = 'Get-NTFSOrphanedAccess'; Parameters = @{}; Output = $false } |
||||
|
@{ Command = 'Get-NTFSInheritance'; Parameters = @{}; Output = $true } |
||||
|
@{ Command = 'Get-NTFSOwner'; Parameters = @{}; Output = $true } |
||||
|
@{ Command = 'Get-NTFSSecurityDescriptor'; Parameters = @{}; Output = $true } |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
BeforeAll { |
||||
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force |
||||
|
$modulePath = Join-Path -Path $PSScriptRoot -ChildPath '..\NTFSSecurity\bin\Release\NTFSSecurity.psd1' |
||||
|
Import-Module -Name $modulePath -Force -ErrorAction Stop |
||||
|
$sandbox = New-TestSandbox -Name 'PathErrors' |
||||
|
Push-Location -LiteralPath $sandbox |
||||
|
|
||||
|
$privateData = (Get-Module -Name NTFSSecurity).PrivateData |
||||
|
$enablePrivileges = $privateData['EnablePrivileges'] |
||||
|
$privateData['EnablePrivileges'] = $false |
||||
|
$sidType = [System.Security.Principal.SecurityIdentifier] |
||||
|
|
||||
|
function Get-TestMissingPath { |
||||
|
$path = Join-Path -Path $sandbox -ChildPath ('Missing-{0}' -f [guid]::NewGuid().ToString('N').Substring(0, 8)) |
||||
|
Assert-TestSandboxPath -Sandbox $sandbox -Path $path |
||||
|
$path |
||||
|
} |
||||
|
|
||||
|
function Get-TestAcl { |
||||
|
# .NET, because Get-Acl of an elevated Windows PowerShell reads also items that deny reading their permissions. |
||||
|
# .NET Core has the method as an extension method. |
||||
|
param ([string] $Path) |
||||
|
|
||||
|
$info = New-Object -TypeName 'System.IO.FileInfo' -ArgumentList $Path |
||||
|
if ($PSVersionTable.PSEdition -eq 'Desktop') { |
||||
|
$info.GetAccessControl() |
||||
|
} |
||||
|
else { |
||||
|
[System.IO.FileSystemAclExtensions]::GetAccessControl($info) |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
AfterAll { |
||||
|
$privateData['EnablePrivileges'] = $enablePrivileges |
||||
|
Pop-Location |
||||
|
Remove-TestSandbox -Sandbox $sandbox |
||||
|
Remove-Module -Name NTFSSecurity -Force -ErrorAction SilentlyContinue |
||||
|
} |
||||
|
|
||||
|
Describe 'A path that does not exist' { |
||||
|
It '<Command> should write a <ErrorId> for it and continue with the next path' -ForEach $missingPathCases { |
||||
|
$missing = Get-TestMissingPath |
||||
|
$file = New-TestSandboxItem -Sandbox $sandbox -Name 'Next' |
||||
|
|
||||
|
$output = @(& $Command -Path $missing, $file @Parameters -ErrorVariable pathErrors -ErrorAction SilentlyContinue -WarningAction SilentlyContinue) |
||||
|
|
||||
|
$pathErrors | Should -HaveCount 1 |
||||
|
$pathErrors[0].FullyQualifiedErrorId | Should -BeLike "$ErrorId,*" |
||||
|
$pathErrors[0].TargetObject | Should -Be $missing |
||||
|
if ($Output) { |
||||
|
$output | Should -Not -BeNullOrEmpty |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
It '<Command> should write a ReadFileError for it and continue with the next path' -ForEach $missingPathAuditCases -Skip:(-not $holdsSecurityPrivilege) { |
||||
|
$privateData['EnablePrivileges'] = $true |
||||
|
try { |
||||
|
$missing = Get-TestMissingPath |
||||
|
$file = New-TestSandboxItem -Sandbox $sandbox -Name 'NextAudit' |
||||
|
|
||||
|
& $Command -Path $missing, $file @Parameters -ErrorVariable pathErrors -ErrorAction SilentlyContinue | Out-Null |
||||
|
} |
||||
|
finally { |
||||
|
$privateData['EnablePrivileges'] = $false |
||||
|
} |
||||
|
|
||||
|
$pathErrors | Should -HaveCount 1 |
||||
|
$pathErrors[0].FullyQualifiedErrorId | Should -BeLike 'ReadFileError,*' |
||||
|
$pathErrors[0].TargetObject | Should -Be $missing |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
Describe 'An item whose owner may not read its permissions' { |
||||
|
# A deny entry for OWNER RIGHTS replaces the right of the owner to read the security descriptor. Taking ownership |
||||
|
# can't help: the cmdlet must read the owner first, which needs the same right. Before 5.0.0-rc6, |
||||
|
# Get-NTFSOrphanedAccess reported this as an AddAceError. |
||||
|
It '<Command> should write a ReadSecurityError for it and continue with the next path' -ForEach $deniedReadCases { |
||||
|
$blocked = New-TestSandboxItem -Sandbox $sandbox -Name 'Unreadable' |
||||
|
Block-TestReadPermission -Sandbox $sandbox -Path $blocked |
||||
|
$file = New-TestSandboxItem -Sandbox $sandbox -Name 'NextReadable' |
||||
|
|
||||
|
$output = @(& $Command -Path $blocked, $file @Parameters -ErrorVariable pathErrors -ErrorAction SilentlyContinue -WarningAction SilentlyContinue) |
||||
|
|
||||
|
$pathErrors | Should -HaveCount 1 |
||||
|
$pathErrors[0].FullyQualifiedErrorId | Should -BeLike 'ReadSecurityError,*' |
||||
|
$pathErrors[0].TargetObject | Should -Be $blocked |
||||
|
if ($Output) { |
||||
|
$output | Should -Not -BeNullOrEmpty |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
Describe 'An item whose owner may not change its permissions' { |
||||
|
# A deny entry for OWNER RIGHTS replaces the right of the owner to change the DACL. The cmdlets take ownership, |
||||
|
# which Windows answers by removing the OWNER RIGHTS entries, write the DACL, and set the previous owner back. |
||||
|
BeforeEach { |
||||
|
$file = New-TestSandboxItem -Sandbox $sandbox -Name 'Unchangeable' |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$owner = $acl.GetOwner($sidType).Value |
||||
|
} |
||||
|
|
||||
|
It 'Add-NTFSAccess should take ownership, add the entry, and set the owner back' { |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
@($acl.GetAccessRules($true, $false, $sidType) | Where-Object -FilterScript { $_.IdentityReference.Value -eq 'S-1-1-0' }) | Should -HaveCount 1 |
||||
|
@($acl.GetAccessRules($true, $false, $sidType) | Where-Object -FilterScript { $_.IdentityReference.Value -eq 'S-1-3-4' }) | Should -BeNullOrEmpty |
||||
|
} |
||||
|
|
||||
|
It 'Remove-NTFSAccess should take ownership, remove the entry, and set the owner back' { |
||||
|
Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Remove-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
@($acl.GetAccessRules($true, $false, $sidType) | Where-Object -FilterScript { $_.IdentityReference.Value -eq 'S-1-1-0' }) | Should -BeNullOrEmpty |
||||
|
} |
||||
|
|
||||
|
It 'Clear-NTFSAccess should take ownership, remove the explicit entries, and set the owner back' { |
||||
|
Add-NTFSAccess -Path $file -Account 'S-1-1-0' -AccessRights ReadData |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Clear-NTFSAccess -Path $file -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
@($acl.GetAccessRules($true, $false, $sidType)) | Should -BeNullOrEmpty |
||||
|
} |
||||
|
|
||||
|
It 'Disable-NTFSAccessInheritance should take ownership, protect the DACL, and set the owner back' { |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Disable-NTFSAccessInheritance -Path $file -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
$acl.AreAccessRulesProtected | Should -BeTrue |
||||
|
} |
||||
|
|
||||
|
It 'Enable-NTFSAccessInheritance should take ownership, let the DACL inherit, and set the owner back' { |
||||
|
Disable-NTFSAccessInheritance -Path $file |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Enable-NTFSAccessInheritance -Path $file -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
$acl.AreAccessRulesProtected | Should -BeFalse |
||||
|
} |
||||
|
|
||||
|
It 'Set-NTFSInheritance should take ownership, protect the DACL, and set the owner back' { |
||||
|
Add-TestDenyRule -Sandbox $sandbox -Path $file -Rights @{ 'S-1-3-4' = 'ChangePermissions' } |
||||
|
|
||||
|
Set-NTFSInheritance -Path $file -AccessInheritanceEnabled $false -ErrorVariable changeErrors -ErrorAction SilentlyContinue |
||||
|
|
||||
|
$changeErrors | Should -BeNullOrEmpty |
||||
|
$acl = Get-TestAcl -Path $file |
||||
|
$acl.GetOwner($sidType).Value | Should -Be $owner |
||||
|
$acl.AreAccessRulesProtected | Should -BeTrue |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue