mirror of https://github.com/raandree/NTFSSecurity
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
77 lines
3.3 KiB
77 lines
3.3 KiB
<#
|
|
Tests the inheritance cmdlets of the module built in NTFSSecurity\bin\Release on files in a sandbox folder.
|
|
Tests that change the audit section need the Security privilege and skip without it; CI runs them elevated.
|
|
#>
|
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
|
|
'PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'Pester shares variables between blocks.'
|
|
)]
|
|
param ()
|
|
|
|
BeforeDiscovery {
|
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force
|
|
$canChangeAudit = Test-PrivilegeHeld -Name 'SeSecurityPrivilege'
|
|
}
|
|
|
|
BeforeAll {
|
|
Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'TestHelpers.psm1') -Force
|
|
$modulePath = Join-Path -Path $PSScriptRoot -ChildPath '..\NTFSSecurity\bin\Release\NTFSSecurity.psd1'
|
|
Import-Module -Name $modulePath -Force -ErrorAction Stop
|
|
$sandbox = New-TestSandbox -Name 'Inheritance'
|
|
Push-Location -LiteralPath $sandbox
|
|
|
|
function New-SandboxFile {
|
|
$path = Join-Path -Path $sandbox -ChildPath ('File-{0}.txt' -f [guid]::NewGuid().ToString('N').Substring(0, 8))
|
|
Assert-TestSandboxPath -Sandbox $sandbox -Path $path
|
|
Set-Content -LiteralPath $path -Value 'Inheritance test'
|
|
$path
|
|
}
|
|
}
|
|
|
|
AfterAll {
|
|
Pop-Location
|
|
Remove-TestSandbox -Sandbox $sandbox
|
|
Remove-Module -Name NTFSSecurity -Force -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
Describe 'Set-NTFSInheritance' {
|
|
Context 'When -AccessInheritanceEnabled or -AuditInheritanceEnabled is omitted' {
|
|
BeforeEach {
|
|
$file = New-SandboxFile
|
|
Assert-TestSandboxPath -Sandbox $sandbox -Path $file
|
|
}
|
|
|
|
It 'Should change nothing and write no error when both are omitted' {
|
|
Set-NTFSInheritance -Path $file -ErrorVariable inheritanceErrors -ErrorAction SilentlyContinue
|
|
|
|
$inheritanceErrors | Should -BeNullOrEmpty
|
|
(Get-NTFSInheritance -Path $file).AccessInheritanceEnabled | Should -BeTrue
|
|
}
|
|
|
|
It 'Should leave a security descriptor unchanged when both are omitted' {
|
|
$sd = Get-NTFSSecurityDescriptor -Path $file
|
|
|
|
{ Set-NTFSInheritance -SecurityDescriptor $sd -ErrorAction Stop } | Should -Not -Throw
|
|
$sd.SecurityDescriptor.AreAccessRulesProtected | Should -BeFalse
|
|
}
|
|
|
|
It 'Should change only the access inheritance when -AuditInheritanceEnabled is omitted' {
|
|
$before = Get-NTFSInheritance -Path $file
|
|
|
|
Set-NTFSInheritance -Path $file -AccessInheritanceEnabled $false -ErrorVariable inheritanceErrors -ErrorAction SilentlyContinue
|
|
|
|
$inheritanceErrors | Should -BeNullOrEmpty
|
|
$after = Get-NTFSInheritance -Path $file
|
|
$after.AccessInheritanceEnabled | Should -BeFalse
|
|
$after.AuditInheritanceEnabled | Should -Be $before.AuditInheritanceEnabled
|
|
}
|
|
|
|
It 'Should change only the audit inheritance when -AccessInheritanceEnabled is omitted' -Skip:(-not $canChangeAudit) {
|
|
Set-NTFSInheritance -Path $file -AuditInheritanceEnabled $false -ErrorVariable inheritanceErrors -ErrorAction SilentlyContinue
|
|
|
|
$inheritanceErrors | Should -BeNullOrEmpty
|
|
$after = Get-NTFSInheritance -Path $file
|
|
$after.AccessInheritanceEnabled | Should -BeTrue
|
|
$after.AuditInheritanceEnabled | Should -BeFalse
|
|
}
|
|
}
|
|
}
|
|
|