mirror of https://github.com/raandree/NTFSSecurity
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
165 lines
10 KiB
165 lines
10 KiB
<#
|
|
Tests all permission scopes through the access and audit cmdlets, both parameter forms and both storage modes.
|
|
Expected flags are the Windows ACE flags, independent of the module's scope converter.
|
|
#>
|
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
|
|
'PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'Pester shares variables between blocks.'
|
|
)]
|
|
param ()
|
|
|
|
BeforeDiscovery {
|
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force
|
|
$canReadAudit = Test-PrivilegeHeld -Name 'SeSecurityPrivilege'
|
|
$scopes = @(
|
|
@{ Name = 'ThisFolderOnly'; Inheritance = 'None'; Propagation = 'None' }
|
|
@{ Name = 'ThisFolderSubfoldersAndFiles'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'None' }
|
|
@{ Name = 'ThisFolderAndSubfolders'; Inheritance = 'ContainerInherit'; Propagation = 'None' }
|
|
@{ Name = 'ThisFolderAndFiles'; Inheritance = 'ObjectInherit'; Propagation = 'None' }
|
|
@{ Name = 'SubfoldersAndFilesOnly'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'InheritOnly' }
|
|
@{ Name = 'SubfoldersOnly'; Inheritance = 'ContainerInherit'; Propagation = 'InheritOnly' }
|
|
@{ Name = 'FilesOnly'; Inheritance = 'ObjectInherit'; Propagation = 'InheritOnly' }
|
|
@{ Name = 'ThisFolderSubfoldersAndFilesOneLevel'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'NoPropagateInherit' }
|
|
@{ Name = 'ThisFolderAndSubfoldersOneLevel'; Inheritance = 'ContainerInherit'; Propagation = 'NoPropagateInherit' }
|
|
@{ Name = 'ThisFolderAndFilesOneLevel'; Inheritance = 'ObjectInherit'; Propagation = 'NoPropagateInherit' }
|
|
@{ Name = 'SubfoldersAndFilesOnlyOneLevel'; Inheritance = 'ContainerInherit, ObjectInherit'; Propagation = 'InheritOnly, NoPropagateInherit' }
|
|
@{ Name = 'SubfoldersOnlyOneLevel'; Inheritance = 'ContainerInherit'; Propagation = 'InheritOnly, NoPropagateInherit' }
|
|
@{ Name = 'FilesOnlyOneLevel'; Inheritance = 'ObjectInherit'; Propagation = 'InheritOnly, NoPropagateInherit' }
|
|
)
|
|
$activeTargets = @{
|
|
ThisFolderOnly = @('Root')
|
|
ThisFolderSubfoldersAndFiles = @('Root', 'File', 'Child', 'ChildFile', 'Grandchild', 'GrandchildFile')
|
|
ThisFolderAndSubfolders = @('Root', 'Child', 'Grandchild')
|
|
ThisFolderAndFiles = @('Root', 'File', 'ChildFile', 'GrandchildFile')
|
|
SubfoldersAndFilesOnly = @('File', 'Child', 'ChildFile', 'Grandchild', 'GrandchildFile')
|
|
SubfoldersOnly = @('Child', 'Grandchild')
|
|
FilesOnly = @('File', 'ChildFile', 'GrandchildFile')
|
|
ThisFolderSubfoldersAndFilesOneLevel = @('Root', 'File', 'Child')
|
|
ThisFolderAndSubfoldersOneLevel = @('Root', 'Child')
|
|
ThisFolderAndFilesOneLevel = @('Root', 'File')
|
|
SubfoldersAndFilesOnlyOneLevel = @('File', 'Child')
|
|
SubfoldersOnlyOneLevel = @('Child')
|
|
FilesOnlyOneLevel = @('File')
|
|
}
|
|
$propagationCases = @($scopes | ForEach-Object { @{ Name = $_.Name; ActiveTargets = $activeTargets[$_.Name] } })
|
|
$scopeNames = @($scopes.Name)
|
|
$scopeCases = @(foreach ($scope in $scopes) {
|
|
foreach ($source in 'Path', 'SecurityDescriptor') {
|
|
foreach ($form in 'AppliesTo', 'Flags') {
|
|
@{ Name = $scope.Name; Inheritance = $scope.Inheritance; Propagation = $scope.Propagation; Source = $source; Form = $form }
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
BeforeAll {
|
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force
|
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath '..\NTFSSecurity\bin\Release\NTFSSecurity.psd1') -Force -ErrorAction Stop
|
|
$sandbox = New-TestSandbox -Name 'PermissionScopes'
|
|
Push-Location -LiteralPath $sandbox
|
|
$account = 'S-1-5-21-1-2-3-4801'
|
|
$keeper = 'S-1-5-21-1-2-3-4802'
|
|
}
|
|
|
|
AfterAll {
|
|
Pop-Location
|
|
Remove-TestSandbox -Sandbox $sandbox
|
|
Remove-Module -Name NTFSSecurity -Force -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
Describe 'Permission scope inventory' {
|
|
It 'Should cover every named -AppliesTo value' -ForEach @(@{ ScopeNames = $scopeNames }) {
|
|
(@([Enum]::GetNames([Security2.ApplyTo])) | Sort-Object) -join ',' |
|
|
Should -Be (($scopeNames | Sort-Object) -join ',')
|
|
}
|
|
}
|
|
|
|
Describe 'Access rule scopes' {
|
|
It 'Should add and remove <Name> using <Form> on <Source>, preserving the other account' -ForEach $scopeCases {
|
|
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'AccessScope' -Directory
|
|
$before = (Get-Acl -LiteralPath $folder).GetSecurityDescriptorSddlForm('Access')
|
|
$location = if ($Source -eq 'Path') { @{ Path = $folder } } else { @{ SecurityDescriptor = Get-NTFSSecurityDescriptor -Path $folder -ErrorAction Stop } }
|
|
$flags = @{ InheritanceFlags = $Inheritance; PropagationFlags = $Propagation }
|
|
$addScope = if ($Form -eq 'AppliesTo') { @{ AppliesTo = $Name } } else { $flags }
|
|
$removeScope = if ($Form -eq 'AppliesTo') { $flags } else { @{ AppliesTo = $Name } }
|
|
Add-NTFSAccess @location -Account $keeper -AccessRights Delete -AppliesTo ThisFolderOnly -ErrorAction Stop
|
|
|
|
$added = @(Add-NTFSAccess @location @addScope -Account $account -AccessRights ReadData -PassThru -ErrorAction Stop |
|
|
Where-Object -FilterScript { $_.Account.Sid -eq $account })
|
|
|
|
$added | Should -HaveCount 1
|
|
$added[0] | Should -BeOfType [Security2.FileSystemAccessRule2]
|
|
$added[0].InheritanceFlags | Should -Be ([Security.AccessControl.InheritanceFlags] $Inheritance)
|
|
$added[0].PropagationFlags | Should -Be ([Security.AccessControl.PropagationFlags] $Propagation)
|
|
$added[0].AccessRights.HasFlag([Security2.FileSystemRights2]::ReadData) | Should -BeTrue
|
|
[Security2.FileSystemSecurity2]::ConvertToApplyTo($added[0].InheritanceFlags, $added[0].PropagationFlags).ToString() | Should -Be $Name
|
|
if ($Source -eq 'SecurityDescriptor') {
|
|
(Get-Acl -LiteralPath $folder).GetSecurityDescriptorSddlForm('Access') | Should -BeExactly $before
|
|
}
|
|
|
|
$remaining = @(Remove-NTFSAccess @location @removeScope -Account $account -AccessRights ReadData -RemoveSpecific -PassThru -ErrorAction Stop)
|
|
|
|
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $account }) | Should -BeNullOrEmpty
|
|
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $keeper }) | Should -HaveCount 1
|
|
@(Get-NTFSAccess @location -Account $account -ErrorAction Stop) | Should -BeNullOrEmpty
|
|
}
|
|
}
|
|
|
|
Describe 'Access scopes on descendants' {
|
|
It 'Should apply <Name> only to its intended descendants, including the OneLevel boundary' -ForEach $propagationCases {
|
|
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'Propagation' -Directory
|
|
Add-NTFSAccess -Path $folder -Account $account -AccessRights ReadData -AppliesTo $Name -ErrorAction Stop
|
|
$paths = [ordered]@{
|
|
Root = $folder
|
|
File = Join-Path -Path $folder -ChildPath 'File.txt'
|
|
Child = Join-Path -Path $folder -ChildPath 'Child'
|
|
ChildFile = Join-Path -Path $folder -ChildPath 'Child\File.txt'
|
|
Grandchild = Join-Path -Path $folder -ChildPath 'Child\Grandchild'
|
|
GrandchildFile = Join-Path -Path $folder -ChildPath 'Child\Grandchild\File.txt'
|
|
}
|
|
Assert-TestSandboxPath -Sandbox $sandbox -Path @($paths.Values)
|
|
New-Item -ItemType Directory -Path $paths.Grandchild -Force | Out-Null
|
|
foreach ($key in 'File', 'ChildFile', 'GrandchildFile') {
|
|
Set-Content -LiteralPath $paths[$key] -Value $key
|
|
}
|
|
|
|
$actual = @(foreach ($key in $paths.Keys) {
|
|
$active = @(Get-NTFSAccess -Path $paths[$key] -Account $account -ErrorAction Stop | Where-Object -FilterScript {
|
|
-not $_.PropagationFlags.HasFlag([Security.AccessControl.PropagationFlags]::InheritOnly) -and
|
|
$_.AccessRights.HasFlag([Security2.FileSystemRights2]::ReadData)
|
|
})
|
|
if ($active.Count -gt 0) { $key }
|
|
})
|
|
|
|
($actual | Sort-Object) -join ',' | Should -Be (($ActiveTargets | Sort-Object) -join ',')
|
|
}
|
|
}
|
|
Describe 'Audit rule scopes' -Skip:(-not $canReadAudit) {
|
|
It 'Should add and remove <Name> using <Form> on <Source>, preserving the other account' -ForEach $scopeCases {
|
|
$folder = New-TestSandboxItem -Sandbox $sandbox -Name 'AuditScope' -Directory
|
|
$before = (Get-Acl -LiteralPath $folder -Audit).GetSecurityDescriptorSddlForm('Audit')
|
|
$location = if ($Source -eq 'Path') { @{ Path = $folder } } else { @{ SecurityDescriptor = Get-NTFSSecurityDescriptor -Path $folder -ErrorAction Stop } }
|
|
$flags = @{ InheritanceFlags = $Inheritance; PropagationFlags = $Propagation }
|
|
$addScope = if ($Form -eq 'AppliesTo') { @{ AppliesTo = $Name } } else { $flags }
|
|
$removeScope = if ($Form -eq 'AppliesTo') { $flags } else { @{ AppliesTo = $Name } }
|
|
Add-NTFSAudit @location -Account $keeper -AccessRights Delete -AuditFlags Failure -AppliesTo ThisFolderOnly -ErrorAction Stop
|
|
|
|
$added = @(Add-NTFSAudit @location @addScope -Account $account -AccessRights ReadData -AuditFlags 'Success, Failure' -PassThru -ErrorAction Stop |
|
|
Where-Object -FilterScript { $_.Account.Sid -eq $account })
|
|
|
|
$added | Should -HaveCount 1
|
|
$added[0] | Should -BeOfType [Security2.FileSystemAuditRule2]
|
|
$added[0].InheritanceFlags | Should -Be ([Security.AccessControl.InheritanceFlags] $Inheritance)
|
|
$added[0].PropagationFlags | Should -Be ([Security.AccessControl.PropagationFlags] $Propagation)
|
|
$added[0].AuditFlags | Should -Be ([Security.AccessControl.AuditFlags] 'Success, Failure')
|
|
[Security2.FileSystemSecurity2]::ConvertToApplyTo($added[0].InheritanceFlags, $added[0].PropagationFlags).ToString() | Should -Be $Name
|
|
if ($Source -eq 'SecurityDescriptor') {
|
|
(Get-Acl -LiteralPath $folder -Audit).GetSecurityDescriptorSddlForm('Audit') | Should -BeExactly $before
|
|
}
|
|
|
|
$remaining = @(Remove-NTFSAudit @location @removeScope -Account $account -AccessRights ReadData -AuditFlags 'Success, Failure' -RemoveSpecific -PassThru -ErrorAction Stop)
|
|
|
|
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $account }) | Should -BeNullOrEmpty
|
|
@($remaining | Where-Object -FilterScript { $_.Account.Sid -eq $keeper }) | Should -HaveCount 1
|
|
@(Get-NTFSAudit @location -Account $account -ErrorAction Stop) | Should -BeNullOrEmpty
|
|
}
|
|
}
|
|
|