mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-09-29 10:34:51 +02:00
80 lines
4.4 KiB
PowerShell
80 lines
4.4 KiB
PowerShell
# Executes only the exported writer's function definition with safe resolver and
|
|
# argument-builder fixtures. Native children emit diagnostics and exit; no auditpol
|
|
# command or Windows policy mutation is ever invoked.
|
|
$ErrorActionPreference = 'Stop'
|
|
$tokens = $null; $errors = $null
|
|
$path = Join-Path $PSScriptRoot '../modules/AuditProfiles.psm1'
|
|
$ast = [Management.Automation.Language.Parser]::ParseFile($path, [ref]$tokens, [ref]$errors)
|
|
if ($errors.Count) { throw ($errors | Out-String) }
|
|
$definition = $ast.Find({ param($node) $node -is [Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Set-WelaEffectiveAuditPolicy' }, $true)
|
|
if (-not $definition) { throw 'Native audit writer definition was not found.' }
|
|
. ([scriptblock]::Create($definition.Extent.Text))
|
|
Set-StrictMode -Version 2.0
|
|
$engine = (Get-Command -Name (Get-Process -Id $PID).Path -CommandType Application -ErrorAction Stop).Source
|
|
$guid = '0CCE922B-69AE-11D9-BED3-505054503030'
|
|
$script:assertions = 0; $script:lookups = 0
|
|
function Assert($Condition, [string]$Message) {
|
|
if (-not $Condition) { throw "FAIL: $Message" }
|
|
$script:assertions++
|
|
}
|
|
function Invoke-ExpectFailure([scriptblock]$Action, [string]$Pattern) {
|
|
$caught = ''
|
|
try { & $Action } catch { $caught = $_.ToString() }
|
|
Assert ($caught -match $Pattern) "Expected '$Pattern'; observed '$caught'"
|
|
return $caught
|
|
}
|
|
function Get-Command {
|
|
param($Name, $CommandType, $ErrorAction)
|
|
$script:lookups++
|
|
if ($Name -ne 'auditpol.exe' -or $CommandType -ne 'Application' -or $ErrorAction -ne 'Stop') {
|
|
throw 'Writer must resolve the auditpol application with a terminating lookup.'
|
|
}
|
|
if ($script:lookupFails) { throw 'Injected auditpol lookup failure' }
|
|
[pscustomobject]@{ Source = $script:resolvedSource }
|
|
}
|
|
function Get-WelaAuditSetArguments {
|
|
param($Guid, $Mask, $Mode)
|
|
return $script:nativeArguments
|
|
}
|
|
$script:lookupFails = $true
|
|
$script:resolvedSource = $engine
|
|
$script:nativeArguments = @('-NoProfile', '-Command', 'exit 0')
|
|
$global:LASTEXITCODE = 0
|
|
$null = Invoke-ExpectFailure { Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 1 } 'Injected auditpol lookup failure'
|
|
Assert ($script:lookups -eq 1) 'A stale native zero cannot bypass a failed executable lookup'
|
|
|
|
$script:lookupFails = $false
|
|
$script:resolvedSource = Join-Path ([IO.Path]::GetTempPath()) ('wela-missing-native-' + [guid]::NewGuid().ToString('N') + '.exe')
|
|
$global:LASTEXITCODE = 0
|
|
$null = Invoke-ExpectFailure { Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 1 } 'not recognized|failed'
|
|
Assert ($null -eq $global:LASTEXITCODE) 'An executable disappearing after lookup cannot retain an earlier success code'
|
|
|
|
$script:resolvedSource = $engine
|
|
$script:nativeArguments = @('-NoProfile', '-Command', "[Console]::Error.WriteLine('writer native failure diagnostic'); exit 7")
|
|
$global:LASTEXITCODE = 0
|
|
$caught = Invoke-ExpectFailure { Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 1 } 'failed \(7\)'
|
|
Assert ($caught -match 'writer native failure diagnostic') 'Native exit failure retains stderr diagnostics'
|
|
Assert ($global:LASTEXITCODE -eq 7) 'The newly executed process exit code is observed'
|
|
|
|
$script:nativeArguments = @('-NoProfile', '-Command', "[Console]::Error.WriteLine('non-fatal native diagnostic'); exit 0")
|
|
$global:LASTEXITCODE = 7
|
|
$PSNativeCommandUseErrorActionPreference = $true
|
|
Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 3
|
|
Assert ($global:LASTEXITCODE -eq 0) 'A fresh zero succeeds even with stderr and a previous failure'
|
|
Assert ($ErrorActionPreference -eq 'Stop' -and $PSNativeCommandUseErrorActionPreference) 'Native preferences remain local to the writer'
|
|
|
|
# A malformed/inert executable fixture returns without updating a process exit code.
|
|
# This proves absence of a new code cannot be mistaken for the previous zero.
|
|
$script:resolvedSource = { 'Fixture produced no native exit status' }
|
|
$script:nativeArguments = @()
|
|
$global:LASTEXITCODE = 0
|
|
$null = Invoke-ExpectFailure { Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 1 } 'failed \(\)'
|
|
Assert ($null -eq $global:LASTEXITCODE) 'Missing new native exit status is rejected'
|
|
|
|
$script:lookupFails = $true
|
|
$before = $script:lookups
|
|
Set-WelaEffectiveAuditPolicy -Guid $guid -Mask 0 -Mode minimum
|
|
Assert ($script:lookups -eq $before) 'An empty minimum policy does not resolve or execute a writer'
|
|
$global:LASTEXITCODE = 0 # Expected fixture failures must not fail the CI shell wrapper.
|
|
Write-Host "PASS: $script:assertions native audit writer assertions (safe native children; no policy changes)."
|