diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index 8ddb0ee..935054f 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-06 +last-verified: 2026-10-07 owner: active-agent source: current task evidence --- @@ -9,47 +9,50 @@ source: current task evidence ## Current focus -Live tests of 5.0.0-rc4 in a lab, which the maintainer decided on -2026-10-06 to run before 5.0.0. He continues on another workstation that -has his lab script. 5.0.0 waits for these results and for the tester -feedback in #34; then the repository is archived in favor of -WindowsAccessControl (Decision 18). +5.0.0-rc5, prepared on the branch `ai/release-5.0.0-rc5`: the live tests +in `Tests\Lab` (Decision 20) and the fix of +`Get-NTFSEffectiveAccess -ServerName` that they found. The maintainer +pushes the branch, opens and merges the pull request, and tags +`5.0.0-rc5`; CI publishes it (Decision 12). Then, with the tester feedback +in #34, he decides on 5.0.0. After 5.0.0 the repository is archived in +favor of WindowsAccessControl (Decision 18). ## Evidence -- 2026-10-06: 5.0.0-rc4 is published from the tag `5.0.0-rc4` on - `01d9264`, the merge commit of #113, and verified from the Gallery - package in both editions; its issues are closed (progress). -- The Pester tests run only on standalone machines against local NTFS - folders, with local and well-known accounts. No test uses a UNC path, a - share, a domain account, or `Get-NTFSEffectiveAccess -ServerName`, which - calls `AuthzInitializeRemoteResourceManager` over RPC. 5.0.0 changed no - code that is specific to domains or SMB. -- In #34, the tester wrote on 2026-10-06 that the owner problem also exists - on their IBM ESS system, and that he reports rc3 results against both - their file servers on 2026-10-07. No lab reproduces IBM ESS. -- The second workstation has Hyper-V and AutomatedLab 5.61, but no - LabSources folder, ISO, or lab. -- Hand commands to the maintainer as fenced code blocks at the end of the - reply, and end the turn there; never put them in the question dialog, - which also covers a reply before it. A pull request names an issue - without a closing keyword unless the merge should close it (techContext). +- 2026-10-07: the live tests ran in the lab of WindowsAccessControl + (`F1ADC1`, `F1AFile2`, `F1AFile1` in `a.forest1.net`) against the Gallery + packages of 5.0.0-rc2 and 5.0.0-rc4 and against the branch build, in + Windows PowerShell 5.1 and PowerShell 7, with the same results in both: + - Case 1 (#34 over SMB): rc2 fails `Add-NTFSAccess`, `Clear-NTFSAccess`, + and `Set-NTFSSecurityDescriptor` with error 1307, on folders with and + without the auto-inherit flag; the other four cmdlets succeed in rc2 + too. rc4 passes all seven and keeps Administrators as the owner. + - Case 2: the administrators of the file server read, add, and remove + audit entries over SMB; the delegated account gets the errors that the + cmdlet pages describe, and the folders stay unchanged. Same in rc2. + - Case 3: with `-ServerName` of the file server, the result includes its + local group, without a warning; without it, only the domain groups + count. With a computer that can't be reached, rc2 and rc4 returned no + access, because error 1722 was swallowed; fixed on the branch. + - Case 4, long paths on the share, and #108 pass; #108 fails in rc2. + - The branch build passes every live test, and the 499 tests of `Tests` + in both editions. +- One `security-reviewer` pass approved the branch with minor findings; + the assertion of the fallback warning and the path guard of the live + tests were hardened. Deferred: the bare `catch` in + `Win32.GetEffectiveAccess`, which still swallows any other error of the + remote initialization (not reproducible: for a user who isn't an + administrator of the file server, the cmdlet writes "Access is denied"); + the unchecked `AUTHZ_ACCESS_REPLY.Error`; a fallback warning that names + the server and the error, which would change behavior (Decision 16). +- #34: no report from the tester by 16:00 UTC on 2026-10-07; he announced + results against two file servers, one of them IBM ESS, for that day. +- The lab keeps the accounts, the share, and the folders of the last run; + `Invoke-NTFSSecurityLabTest.ps1 -RemoveFixture` removes them. ## Next step -Build the lab with the maintainer's script: a domain controller, a file -server with a share, and a client. From the client, run live tests against -5.0.0-rc2 as the baseline and 5.0.0-rc4, in Windows PowerShell 5.1 and -PowerShell 7: - -1. #34 over SMB: a domain user who isn't an admin on the file server, with - Full Control on a share folder owned by Administrators, runs the access - and inheritance cmdlets on its UNC path. rc2 should fail with (1307); - rc4 should succeed and keep the owner. -2. The audit cmdlets over SMB, where the file server, not the client, - checks the Security privilege: as a user with and without it there. -3. `Get-NTFSEffectiveAccess` for domain accounts with nested groups, and - with `-ServerName`. -4. `Get-NTFSOrphanedAccess` with the entry of a deleted domain account. - -Then, with the #34 feedback, release 5.0.0 as `progress.md` describes. +The maintainer runs the push and pull request commands of the session of +2026-10-07, merges, and tags `5.0.0-rc5`. Then check the published package +with `Invoke-NTFSSecurityLabTest.ps1 -Version 5.0.0-rc5`, wait for the #34 +feedback, and release 5.0.0 as `progress.md` describes. diff --git a/.memory-bank/decisions/0020-live-tests-in-tests-lab.md b/.memory-bank/decisions/0020-live-tests-in-tests-lab.md new file mode 100644 index 0000000..58e2aaa --- /dev/null +++ b/.memory-bank/decisions/0020-live-tests-in-tests-lab.md @@ -0,0 +1,27 @@ +--- +status: accepted +date: 2026-10-07 +last-verified: 2026-10-07 +owner: shared +source: maintainer decision of 2026-10-07 +--- + +# Decision 20: Live tests in a lab live in Tests\Lab + +- Choice: The live tests that need a file server and domain accounts live + in `Tests\Lab`: the Pester file `NTFSSecurity.Live.Tests.ps1`, the + controller `Invoke-NTFSSecurityLabTest.ps1`, which prepares an + AutomatedLab lab and runs the tests per module version and PowerShell + edition, and a README with the cases. CI excludes the folder through + `Run.ExcludePath` in `.github/scripts/Invoke-Tests.ps1`, and without a + configuration every live test skips. The default lab is the one of + WindowsAccessControl (`F1ADC1`, `F1AFile2`, `F1AFile1` in + `a.forest1.net`), which the maintainer allowed on 2026-10-07. +- Rationale: The tests in `Tests` run on one computer with local accounts. + #34 over SMB, the Security privilege that the file server checks, + `Get-NTFSEffectiveAccess -ServerName`, and orphaned domain accounts need a + file server and a domain. In the repository, a later release can repeat + the tests and review them in a pull request. +- Rejected: a handoff folder outside the repository, which keeps the tests + on one machine. +- Applied: 5.0.0-rc5. diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index cc266fb..e17a9d8 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-06 +last-verified: 2026-10-07 owner: active-agent source: repository evidence --- @@ -13,8 +13,11 @@ source: repository evidence published by CI from the tag `5.0.0-rc4` on `master` (`01d9264`, the merge of #113) on 2026-10-06 (Decision 12). It adds to 5.0.0-rc3 the fixes of the issues #41, #108, #109, and #111 and of the leftovers of the rc3 review. -The stable Gallery version is still 4.2.6. NTFSSecurity will be archived -soon; its users move to WindowsAccessControl (Decision 18). +5.0.0-rc5 is prepared on the branch `ai/release-5.0.0-rc5`: the live tests +in a lab (Decision 20) and the fix of `Get-NTFSEffectiveAccess -ServerName` +that they found. The stable Gallery version is still 4.2.6. NTFSSecurity +will be archived soon; its users move to WindowsAccessControl +(Decision 18). ## Recent milestones @@ -56,6 +59,15 @@ soon; its users move to WindowsAccessControl (Decision 18). small items (#111). One `security-reviewer` pass approved it; its Minor findings R1, R2, R6, and R8 were fixed before the merge. #41, #108, #109, and #111 closed as completed, #90 and #107 as not planned. +- 2026-10-07: live tests in the lab of WindowsAccessControl (Decision 20) + against 5.0.0-rc2 and 5.0.0-rc4 in both editions: rc2 fails #34 over SMB + with error 1307 for `Add-NTFSAccess`, `Clear-NTFSAccess`, and + `Set-NTFSSecurityDescriptor`; rc4 passes the four cases, except + `Get-NTFSEffectiveAccess -ServerName` with a computer that can't be + reached, which returned no access since before rc1. The maintainer chose + to fix it test-first in 5.0.0-rc5; the branch build passes all live tests + and the suite. One `security-reviewer` pass approved it with minor + findings (`activeContext.md`). ## Stable capabilities @@ -70,9 +82,10 @@ soon; its users move to WindowsAccessControl (Decision 18). ## Open work -1. Release 5.0.0 through CI (Decision 12) after the live tests in a lab - (`activeContext.md`) and the tester feedback in #34: remove the label, - date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc4` to +1. Publish 5.0.0-rc5 (merge, then tag), check its package in the lab with + `Tests\Lab\Invoke-NTFSSecurityLabTest.ps1 -Version 5.0.0-rc5`, and then + release 5.0.0 through CI (Decision 12) with the tester feedback in #34: + remove the label, date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc5` to `$publishedVersions`, and tag `5.0.0` (steps in `Docs/Contributing/05-Releasing.md`). #34 stays open with Bug and Help Wanted until a tester with a file server that refuses the owner @@ -86,7 +99,12 @@ soon; its users move to WindowsAccessControl (Decision 18). snapshots on read paths, and a duplicate SACL check; of rc4, R3 to R5, R7, and five older defects, listed in the description of #113, among them the accounts filter that `RemoveFileSystemAccessRuleAll` and - `RemoveFileSystemAuditRuleAll` ignore, which no cmdlet passes. + `RemoveFileSystemAuditRuleAll` ignore, which no cmdlet passes; of rc5, + the bare `catch` in `Win32.GetEffectiveAccess`, the unchecked + `AUTHZ_ACCESS_REPLY.Error`, a fallback warning without the server name, + and hardening of the lab controller (guards in the setup blocks, + interpolated `-EncodedCommand` paths, CredSSP by IP address, the + password string in memory, disabling the role accounts after a run). 4. `pwsh` 7.6.1 crashed three times during test runs on the ARM64 workstation (x64 emulation), without module frames; none of the CI runs on native x64 on 2026-10-05 crashed. diff --git a/.memory-bank/systemPatterns.md b/.memory-bank/systemPatterns.md index c2dbc99..c28e09b 100644 --- a/.memory-bank/systemPatterns.md +++ b/.memory-bank/systemPatterns.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-06 +last-verified: 2026-10-07 owner: active-agent source: repository evidence --- @@ -66,6 +66,7 @@ Each Decision record is a file in `decisions/`; read only the relevant ones. | 17 | [Issue labels](decisions/0017-issue-labels.md) | | 18 | [NTFSSecurity will be archived](decisions/0018-archive-for-windowsaccesscontrol.md) | | 19 | [Cmdlets write only the sections that they change](decisions/0019-write-only-changed-sections.md) | +| 20 | [Live tests in a lab live in Tests\Lab](decisions/0020-live-tests-in-tests-lab.md) | ## Patterns @@ -96,3 +97,10 @@ Each Decision record is a file in `decisions/`; read only the relevant ones. hook `BypassOnlineHelpRetrieval`. `Manifest.Tests.ps1` and `Release.Tests.ps1` check the manifest, the version (Decision 10), the release notes, and the packages. +- The live tests in `Tests\Lab` (Decision 20) run as domain accounts in a + lab: on the client over SMB, then on the file server, which checks what + the client runs left. They read and write descriptors as Windows stores + them with `GetFileSecurity` and `SetFileSecurity`, because + `GetNamedSecurityInfo` converts a DACL without the auto-inherit flag and + returns its owner. The expected effective rights come from the S4U tokens + of the file server and the client, like the Effective Access tab. diff --git a/.memory-bank/techContext.md b/.memory-bank/techContext.md index 9b4a715..625f722 100644 --- a/.memory-bank/techContext.md +++ b/.memory-bank/techContext.md @@ -1,6 +1,6 @@ --- status: current -last-verified: 2026-10-04 +last-verified: 2026-10-07 owner: active-agent source: repository evidence --- @@ -69,10 +69,23 @@ source: repository evidence same way, its folder first on `$env:PSModulePath` of the test process. The GitHub CLI is in `C:\Program Files\GitHub CLI`, outside the PATH of sessions started before its installation. +- The third workstation (`ExHost`, a Windows Server 2025 VM, x64, used since + 2026-10-07) runs the agent session elevated and hosts the AutomatedLab lab + `WindowsAccessControlLab` (Decision 20) with Hyper-V and AutomatedLab + 5.61.704. It has no NuGet cache, platyPS, or GitHub CLI: check each + nuget.org package against the SHA-512 `packageHash` of its catalog entry + (`https://api.nuget.org/v3/registration5-semver1//.json`, + then `catalogEntry`), and each Gallery package against `PackageHash` of + `api/v2/Packages(Id='',Version='')`. Pester 5.7.1 is in + `V:\Git\WindowsAccessControl\output\RequiredModules`; read issues and pull + requests through the GitHub REST API. The lab domains `a.forest1.net` and + `b.forest1.net` had a maximum password age of 42 days, so the password of + `install` expired on 2026-09-15 and AutomatedLab got access denied; it + never expires since 2026-10-07, as in `forest1.net`. ## Constraints -- `ModuleVersion` on `master` is `5.0.0` with the prerelease label `rc4`. +- `ModuleVersion` is `5.0.0` with the prerelease label `rc5`. The latest stable tag and Gallery release is `4.2.6`. The manifest requires PowerShell 5.1 and .NET Framework 4.5.2, uses `RootModule`, and lists exactly 36 cmdlets; `Test-ModuleManifest` passes in Windows @@ -108,7 +121,9 @@ source: repository evidence at the end of the reply, which the chat shows with a copy button, and end the turn there; the maintainer reports back in the chat. The question dialog joins the lines of its text, has no copy button, and covers the - reply before it (maintainer, 2026-10-06). A pull request description + reply before it (maintainer, 2026-10-06). A long question also hides its + choices, so that it can't be answered: keep it to a few short sentences + (2026-10-07). A pull request description names an issue without a closing keyword (fixes, closes, resolves) unless the merge should close it: "fixes #34" in #112 closed #34. Simulated `gh` commands in offline tests must print what the real ones print, such as @@ -160,6 +175,12 @@ source: repository evidence session. Run them as a basic user with `runas /trustlevel:0x20000`, and give Windows PowerShell its own `PSModulePath`; that token holds one privilege, so the `Enable-Privileges -PassThru` count test fails there. +- Live tests (Decision 20): in an elevated Windows PowerShell 5.1 session + on the lab host, `Tests\Lab\Invoke-NTFSSecurityLabTest.ps1` with + `-Version` for Gallery packages or `-ModulePath` for a build; it writes + the results to `$env:TEMP\NTFSSecurityLab\Results`. A run of two versions + in both editions takes about 30 minutes; `-RemoveFixture` removes its + accounts, share, and folders from the lab. - Markdown lint: `npx markdownlint-cli2` with `MD013` limited to prose (tables, code, and headings excluded) on the conceptual pages; for `CHANGELOG.md` also `MD024` with `siblings_only: true`, because every