mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-01 20:14:43 +02:00
75 lines
5.2 KiB
PowerShell
75 lines
5.2 KiB
PowerShell
# Pure policy regressions. No Windows settings are read or changed.
|
|
$ErrorActionPreference = 'Stop'
|
|
Import-Module (Join-Path $PSScriptRoot '../modules/AuditProfiles.psm1') -Force
|
|
$config = Import-WelaAuditProfiles
|
|
$assertions = 0
|
|
function Assert-Equal($Actual, $Expected, [string]$Message) {
|
|
if ($Actual -cne $Expected) { throw "$Message : expected '$Expected', got '$Actual'." }
|
|
$script:assertions++
|
|
}
|
|
$expected = @{
|
|
'Group Membership' = @{ Guid = '0CCE9249-69AE-11D9-BED3-505054503030'; Mask = 1; Source = 'ms-sct' }
|
|
'Application Group Management' = @{ Guid = '0CCE9239-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'cis-client' }
|
|
'Authorization Policy Change' = @{ Guid = '0CCE9231-69AE-11D9-BED3-505054503030'; Mask = 1; Source = 'cis-client' }
|
|
'MPSSVC Rule-Level Policy Change' = @{ Guid = '0CCE9232-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'ms-wef' }
|
|
'IPsec Driver' = @{ Guid = '0CCE9213-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'ms-audit' }
|
|
'Kernel Object' = @{ Guid = '0CCE921F-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'asd' }
|
|
}
|
|
$current = @{}
|
|
foreach ($policy in $config.catalog) { $current[$policy.guid] = 0 }
|
|
foreach ($role in @('Client', 'MemberServer', 'DomainController', 'ADCS')) {
|
|
$plan = Get-WelaAuditProfilePlan -Profile 'wela-2.2.0' -Role $role -Build 26100 -Current $current
|
|
foreach ($name in $expected.Keys) {
|
|
$row = @($plan.policies | Where-Object { $_.id -eq $name })
|
|
Assert-Equal $row.Count 1 "$role/$name has exactly one plan row"
|
|
Assert-Equal $row[0].guid $expected[$name].Guid "$role/$name canonical GUID"
|
|
Assert-Equal $row[0].targetMask $expected[$name].Mask "$role/$name applies the intended mask"
|
|
Assert-Equal ($row[0].sourceIds -contains $expected[$name].Source) $true "$role/$name retains provenance"
|
|
}
|
|
$kernel = $plan.policies | Where-Object { $_.id -eq 'Kernel Object' }
|
|
Assert-Equal ($kernel.prerequisites -match 'SACL') $true "$role kernel auditing reports object-SACL dependency"
|
|
}
|
|
# The WELA extension must not overwrite another guide's semantics.
|
|
$inherited = $current.Clone()
|
|
$inherited[$expected['Group Membership'].Guid] = 2
|
|
$inherited[$expected['Authorization Policy Change'].Guid] = 2
|
|
$cis = Get-WelaAuditProfilePlan -Profile 'cis-win11-v4-l1' -Role Client -Build 26100 -Current $inherited
|
|
foreach ($name in @('Group Membership', 'Authorization Policy Change')) {
|
|
$row = $cis.policies | Where-Object { $_.id -eq $name }
|
|
Assert-Equal $row.mode 'minimum' "CIS $name is a minimum"
|
|
Assert-Equal $row.targetMask 3 "CIS $name preserves inherited failure auditing"
|
|
}
|
|
$wef = Get-WelaAuditProfilePlan -Profile 'microsoft-wef-reviewed-2026-09' -Role Client -Build 26100 -Current $current
|
|
Assert-Equal (($wef.policies | Where-Object { $_.id -eq 'Authorization Policy Change' }).targetMask) 3 'WEF authorization auditing retains both outcomes'
|
|
$server = Get-WelaAuditProfilePlan -Profile 'microsoft-sct-server2025-2602' -Role MemberServer -Build 26100 -Current $current
|
|
Assert-Equal (($server.policies | Where-Object { $_.id -eq 'Authorization Policy Change' }).targetMask) 1 'Server 2025 SCT authorization target remains success'
|
|
$asd = Get-WelaAuditProfilePlan -Profile 'asd-native-2021-10' -Role Client -Build 26100 -Current $current
|
|
Assert-Equal (($asd.policies | Where-Object { $_.id -eq 'Kernel Object' }).targetMask) 3 'ASD kernel target remains both outcomes'
|
|
Assert-Equal (($asd.policies | Where-Object { $_.id -eq 'Detailed File Share' }).mode) 'not-configured' 'ASD detailed-share setting is not silently enabled'
|
|
# Exercise the actual shared apply path using an in-memory provider.
|
|
$script:policyState = $current.Clone()
|
|
$script:writes = @{}
|
|
$plan = Get-WelaAuditProfilePlan -Profile 'wela-2.2.0' -Role Client -Build 26100 -Current $script:policyState
|
|
$result = Invoke-WelaAuditProfilePlan -Plan $plan -ReadPolicy { $script:policyState } -WritePolicy {
|
|
param($Guid, $Mask)
|
|
$script:policyState[$Guid] = $Mask
|
|
$script:writes[$Guid] = $Mask
|
|
} -ReadContext { [pscustomobject]@{ Role = 'Client'; Build = 26100 } } -Confirm:$false
|
|
Assert-Equal $result.success $true 'Shared apply reports verified success with matching readback'
|
|
$kernelResult = $result.results | Where-Object { $_.id -eq 'Kernel Object' }
|
|
Assert-Equal ($kernelResult.prerequisites -match 'SACL') $true 'Apply result retains kernel SACL prerequisite'
|
|
Assert-Equal ($kernelResult.sourceIds -contains 'asd') $true 'Apply result identifies ASD kernel requirement'
|
|
Assert-Equal ($kernelResult.evidence -match 'ASD') $true 'Apply result retains source evidence'
|
|
Assert-Equal $result.role 'Client' 'Apply result retains selected role'
|
|
Assert-Equal $result.build 26100 'Apply result retains selected build'
|
|
foreach ($name in $expected.Keys) {
|
|
Assert-Equal $script:writes[$expected[$name].Guid] $expected[$name].Mask "Apply requests correct $name mask"
|
|
}
|
|
$script:writes = @{}
|
|
$result = Invoke-WelaAuditProfilePlan -Plan $plan -ReadPolicy { $script:policyState } -WritePolicy {
|
|
param($Guid, $Mask)
|
|
$script:writes[$Guid] = $Mask
|
|
} -ReadContext { [pscustomobject]@{ Role = 'Client'; Build = 26100 } } -Confirm:$false
|
|
Assert-Equal $script:writes.Count 0 'Reapply is idempotent after all controls match'
|
|
Write-Host "PASS: $assertions native-audit-control assertions (mocked; no host changes)."
|