mirror of https://github.com/raandree/NTFSSecurity
Browse Source
Exercise all 13 scopes using named scopes and explicit Windows flags, through disk paths and in-memory descriptors, for access and audit entries. Verify removal keeps another account, and check actual inheritance through children and grandchildren, including OneLevel. Cover keep/remove switches and successful PassThru for both files and folders, including Set-NTFSInheritance enabling protection states. Controlled mutations lose OneLevel and keep folders protected: 12 tests fail as expected. Restored implementations pass the 170-test focused suite in all four configurations where privileges permit. No cmdlet contract changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant <ai@example.com>pull/117/head
Raimund Andree
3 days ago
2 changed files with 291 additions and 0 deletions
@ -0,0 +1,165 @@ |
|||
<# |
|||
Tests all permission scopes through the access and audit cmdlets, both parameter forms and both storage modes. |
|||
Expected flags are the Windows ACE flags, independent of the module's scope converter. |
|||
#> |
|||
[Diagnostics.CodeAnalysis.SuppressMessageAttribute( |
|||
'PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'Pester shares variables between blocks.' |
|||
)] |
|||
param () |
|||
|
|||
BeforeDiscovery { |
|||
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force |
|||
$canReadAudit = Test-PrivilegeHeld -Name 'SeSecurityPrivilege' |
|||
$scopes = @( |
|||
@{ Name = 'ThisFolderOnly'; Inheritance = 'None'; Propagation = 'None' } |
|||
@{ Name = 'ThisFolderSubfoldersAndFiles'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'None' } |
|||
@{ Name = 'ThisFolderAndSubfolders'; Inheritance = 'ContainerInherit'; Propagation = 'None' } |
|||
@{ Name = 'ThisFolderAndFiles'; Inheritance = 'ObjectInherit'; Propagation = 'None' } |
|||
@{ Name = 'SubfoldersAndFilesOnly'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'InheritOnly' } |
|||
@{ Name = 'SubfoldersOnly'; Inheritance = 'ContainerInherit'; Propagation = 'InheritOnly' } |
|||
@{ Name = 'FilesOnly'; Inheritance = 'ObjectInherit'; Propagation = 'InheritOnly' } |
|||
@{ Name = 'ThisFolderSubfoldersAndFilesOneLevel'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'NoPropagateInherit' } |
|||
@{ Name = 'ThisFolderAndSubfoldersOneLevel'; Inheritance = 'ContainerInherit'; Propagation = 'NoPropagateInherit' } |
|||
@{ Name = 'ThisFolderAndFilesOneLevel'; Inheritance = 'ObjectInherit'; Propagation = 'NoPropagateInherit' } |
|||
@{ Name = 'SubfoldersAndFilesOnlyOneLevel'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'InheritOnly, NoPropagateInherit' } |
|||
@{ Name = 'SubfoldersOnlyOneLevel'; Inheritance = 'ContainerInherit'; Propagation = 'InheritOnly, NoPropagateInherit' } |
|||
@{ Name = 'FilesOnlyOneLevel'; Inheritance = 'ObjectInherit'; Propagation = 'InheritOnly, NoPropagateInherit' } |
|||
) |
|||
$activeTargets = @{ |
|||
ThisFolderOnly = @('Root') |
|||
ThisFolderSubfoldersAndFiles = @('Root', 'File', 'Child', 'ChildFile', 'Grandchild', 'GrandchildFile') |
|||
ThisFolderAndSubfolders = @('Root', 'Child', 'Grandchild') |
|||
ThisFolderAndFiles = @('Root', 'File', 'ChildFile', 'GrandchildFile') |
|||
SubfoldersAndFilesOnly = @('File', 'Child', 'ChildFile', 'Grandchild', 'GrandchildFile') |
|||
SubfoldersOnly = @('Child', 'Grandchild') |
|||
FilesOnly = @('File', 'ChildFile', 'GrandchildFile') |
|||
ThisFolderSubfoldersAndFilesOneLevel = @('Root', 'File', 'Child') |
|||
ThisFolderAndSubfoldersOneLevel = @('Root', 'Child') |
|||
ThisFolderAndFilesOneLevel = @('Root', 'File') |
|||
SubfoldersAndFilesOnlyOneLevel = @('File', 'Child') |
|||
SubfoldersOnlyOneLevel = @('Child') |
|||
FilesOnlyOneLevel = @('File') |
|||
} |
|||
$propagationCases = @($scopes | ForEach-Object { @{ Name = $_.Name; ActiveTargets = $activeTargets[$_.Name] } }) |
|||
$scopeNames = @($scopes.Name) |
|||
$scopeCases = @(foreach ($scope in $scopes) { |
|||
foreach ($source in 'Path', 'SecurityDescriptor') { |
|||
foreach ($form in 'AppliesTo', 'Flags') { |
|||
@{ Name = $scope.Name; Inheritance = $scope.Inheritance; Propagation = $scope.Propagation; Source = $source; Form = $form } |
|||
} |
|||
} |
|||
}) |
|||
} |
|||
|
|||
BeforeAll { |
|||
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force |
|||
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath '..\NTFSSecurity\bin\Release\NTFSSecurity.psd1') -Force -ErrorAction Stop |
|||
$sandbox = New-TestSandbox -Name 'PermissionScopes' |
|||
Push-Location -LiteralPath $sandbox |
|||
$account = 'S-1-5-21-1-2-3-4801' |
|||
$keeper = 'S-1-5-21-1-2-3-4802' |
|||
} |
|||
|
|||
AfterAll { |
|||
Pop-Location |
|||
Remove-TestSandbox -Sandbox $sandbox |
|||
Remove-Module -Name NTFSSecurity -Force -ErrorAction SilentlyContinue |
|||
} |
|||
|
|||
Describe 'Permission scope inventory' { |
|||
It 'Should cover every named -AppliesTo value' -ForEach @(@{ ScopeNames = $scopeNames }) { |
|||
(@([Enum]::GetNames([Security2.ApplyTo])) | Sort-Object) -join ',' | |
|||
Should -Be (($scopeNames | Sort-Object) -join ',') |
|||
} |
|||
} |
|||
|
|||
Describe 'Access rule scopes' { |
|||
It 'Should add and remove <Name> using <Form> on <Source>, preserving the other account' -ForEach $scopeCases { |
|||
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'AccessScope' -Directory |
|||
$before = (Get-Acl -LiteralPath $folder).GetSecurityDescriptorSddlForm('Access') |
|||
$location = if ($Source -eq 'Path') { @{ Path = $folder } } else { @{ SecurityDescriptor = Get-NTFSSecurityDescriptor -Path $folder -ErrorAction Stop } } |
|||
$flags = @{ InheritanceFlags = $Inheritance; PropagationFlags = $Propagation } |
|||
$addScope = if ($Form -eq 'AppliesTo') { @{ AppliesTo = $Name } } else { $flags } |
|||
$removeScope = if ($Form -eq 'AppliesTo') { $flags } else { @{ AppliesTo = $Name } } |
|||
Add-NTFSAccess @location -Account $keeper -AccessRights Delete -AppliesTo ThisFolderOnly -ErrorAction Stop |
|||
|
|||
$added = @(Add-NTFSAccess @location @addScope -Account $account -AccessRights ReadData -PassThru -ErrorAction Stop | |
|||
Where-Object -FilterScript { $_.Account.Sid -eq $account }) |
|||
|
|||
$added | Should -HaveCount 1 |
|||
$added[0] | Should -BeOfType [Security2.FileSystemAccessRule2] |
|||
$added[0].InheritanceFlags | Should -Be ([Security.AccessControl.InheritanceFlags] $Inheritance) |
|||
$added[0].PropagationFlags | Should -Be ([Security.AccessControl.PropagationFlags] $Propagation) |
|||
$added[0].AccessRights.HasFlag([Security2.FileSystemRights2]::ReadData) | Should -BeTrue |
|||
[Security2.FileSystemSecurity2]::ConvertToApplyTo($added[0].InheritanceFlags, $added[0].PropagationFlags).ToString() | Should -Be $Name |
|||
if ($Source -eq 'SecurityDescriptor') { |
|||
(Get-Acl -LiteralPath $folder).GetSecurityDescriptorSddlForm('Access') | Should -BeExactly $before |
|||
} |
|||
|
|||
$remaining = @(Remove-NTFSAccess @location @removeScope -Account $account -AccessRights ReadData -RemoveSpecific -PassThru -ErrorAction Stop) |
|||
|
|||
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $account }) | Should -BeNullOrEmpty |
|||
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $keeper }) | Should -HaveCount 1 |
|||
@(Get-NTFSAccess @location -Account $account -ErrorAction Stop) | Should -BeNullOrEmpty |
|||
} |
|||
} |
|||
|
|||
Describe 'Access scopes on descendants' { |
|||
It 'Should apply <Name> only to its intended descendants, including the OneLevel boundary' -ForEach $propagationCases { |
|||
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'Propagation' -Directory |
|||
Add-NTFSAccess -Path $folder -Account $account -AccessRights ReadData -AppliesTo $Name -ErrorAction Stop |
|||
$paths = [ordered]@{ |
|||
Root = $folder |
|||
File = Join-Path -Path $folder -ChildPath 'File.txt' |
|||
Child = Join-Path -Path $folder -ChildPath 'Child' |
|||
ChildFile = Join-Path -Path $folder -ChildPath 'Child\File.txt' |
|||
Grandchild = Join-Path -Path $folder -ChildPath 'Child\Grandchild' |
|||
GrandchildFile = Join-Path -Path $folder -ChildPath 'Child\Grandchild\File.txt' |
|||
} |
|||
Assert-TestSandboxPath -Sandbox $sandbox -Path @($paths.Values) |
|||
New-Item -ItemType Directory -Path $paths.Grandchild -Force | Out-Null |
|||
foreach ($key in 'File', 'ChildFile', 'GrandchildFile') { |
|||
Set-Content -LiteralPath $paths[$key] -Value $key |
|||
} |
|||
|
|||
$actual = @(foreach ($key in $paths.Keys) { |
|||
$active = @(Get-NTFSAccess -Path $paths[$key] -Account $account -ErrorAction Stop | Where-Object -FilterScript { |
|||
-not $_.PropagationFlags.HasFlag([Security.AccessControl.PropagationFlags]::InheritOnly) -and |
|||
$_.AccessRights.HasFlag([Security2.FileSystemRights2]::ReadData) |
|||
}) |
|||
if ($active.Count -gt 0) { $key } |
|||
}) |
|||
|
|||
($actual | Sort-Object) -join ',' | Should -Be (($ActiveTargets | Sort-Object) -join ',') |
|||
} |
|||
} |
|||
Describe 'Audit rule scopes' -Skip:(-not $canReadAudit) { |
|||
It 'Should add and remove <Name> using <Form> on <Source>, preserving the other account' -ForEach $scopeCases { |
|||
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'AuditScope' -Directory |
|||
$before = (Get-Acl -LiteralPath $folder -Audit).GetSecurityDescriptorSddlForm('Audit') |
|||
$location = if ($Source -eq 'Path') { @{ Path = $folder } } else { @{ SecurityDescriptor = Get-NTFSSecurityDescriptor -Path $folder -ErrorAction Stop } } |
|||
$flags = @{ InheritanceFlags = $Inheritance; PropagationFlags = $Propagation } |
|||
$addScope = if ($Form -eq 'AppliesTo') { @{ AppliesTo = $Name } } else { $flags } |
|||
$removeScope = if ($Form -eq 'AppliesTo') { $flags } else { @{ AppliesTo = $Name } } |
|||
Add-NTFSAudit @location -Account $keeper -AccessRights Delete -AuditFlags Failure -AppliesTo ThisFolderOnly -ErrorAction Stop |
|||
|
|||
$added = @(Add-NTFSAudit @location @addScope -Account $account -AccessRights ReadData -AuditFlags 'Success, Failure' -PassThru -ErrorAction Stop | |
|||
Where-Object -FilterScript { $_.Account.Sid -eq $account }) |
|||
|
|||
$added | Should -HaveCount 1 |
|||
$added[0] | Should -BeOfType [Security2.FileSystemAuditRule2] |
|||
$added[0].InheritanceFlags | Should -Be ([Security.AccessControl.InheritanceFlags] $Inheritance) |
|||
$added[0].PropagationFlags | Should -Be ([Security.AccessControl.PropagationFlags] $Propagation) |
|||
$added[0].AuditFlags | Should -Be ([Security.AccessControl.AuditFlags] 'Success, Failure') |
|||
[Security2.FileSystemSecurity2]::ConvertToApplyTo($added[0].InheritanceFlags, $added[0].PropagationFlags).ToString() | Should -Be $Name |
|||
if ($Source -eq 'SecurityDescriptor') { |
|||
(Get-Acl -LiteralPath $folder -Audit).GetSecurityDescriptorSddlForm('Audit') | Should -BeExactly $before |
|||
} |
|||
|
|||
$remaining = @(Remove-NTFSAudit @location @removeScope -Account $account -AccessRights ReadData -AuditFlags 'Success, Failure' -RemoveSpecific -PassThru -ErrorAction Stop) |
|||
|
|||
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $account }) | Should -BeNullOrEmpty |
|||
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $keeper }) | Should -HaveCount 1 |
|||
@(Get-NTFSAudit @location -Account $account -ErrorAction Stop) | Should -BeNullOrEmpty |
|||
} |
|||
} |
|||
Loading…
Reference in new issue