summaryrefslogtreecommitdiff
path: root/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
diff options
context:
space:
mode:
Diffstat (limited to 'tests/Agent.Windows.Tests/SecurityPolicyTests.cs')
-rw-r--r--tests/Agent.Windows.Tests/SecurityPolicyTests.cs58
1 files changed, 35 insertions, 23 deletions
diff --git a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
index 9f13f56..10415ce 100644
--- a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
+++ b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs
@@ -338,6 +338,8 @@ public sealed class SecurityPolicyTests
public void Recovery_after_crash_restores_acl_loopback_and_dynamic_wfp_state()
{
AppContainerProfile profile = AppContainerProfile.EnsureFixed();
+ // Pre-clean any residual loopback exemption from prior test failures.
+ LoopbackExemption.Remove(profile.Sid);
using TestDirectory directory = new();
string journals = Path.Combine(directory.Path, "journals");
string resource = Path.Combine(directory.Path, "resource");
@@ -371,18 +373,26 @@ public sealed class SecurityPolicyTests
// BFE owns and deletes every object in this dynamic session.
}
- RecoveryResult recovered = new RecoveryManager(journals, audit).RecoverAll();
-
- Assert.True(recovered.IsClean);
- Assert.Equal(1, recovered.JournalsRecovered);
- Assert.Equal(3, recovered.ResourcesRecovered);
- Assert.False(LoopbackExemption.Contains(profile.Sid));
- byte[] aclAfter = FileSystemAclExtensions.GetAccessControl(new DirectoryInfo(resource), AccessControlSections.Access)
- .GetSecurityDescriptorBinaryForm();
- Assert.Equal(Convert.ToHexString(aclBefore), Convert.ToHexString(aclAfter));
- Assert.Equal(Convert.ToHexString(childAclBefore), Convert.ToHexString(AccessDescriptor(child)));
- Assert.Empty(AccessRules(child, profile.Sid));
- Assert.Empty(Directory.EnumerateFiles(journals));
+ try
+ {
+ RecoveryResult recovered = new RecoveryManager(journals, audit).RecoverAll();
+
+ Assert.True(recovered.IsClean);
+ Assert.Equal(1, recovered.JournalsRecovered);
+ Assert.Equal(3, recovered.ResourcesRecovered);
+ Assert.False(LoopbackExemption.Contains(profile.Sid));
+ byte[] aclAfter = FileSystemAclExtensions.GetAccessControl(new DirectoryInfo(resource), AccessControlSections.Access)
+ .GetSecurityDescriptorBinaryForm();
+ Assert.Equal(Convert.ToHexString(aclBefore), Convert.ToHexString(aclAfter));
+ Assert.Equal(Convert.ToHexString(childAclBefore), Convert.ToHexString(AccessDescriptor(child)));
+ Assert.Empty(AccessRules(child, profile.Sid));
+ Assert.Empty(Directory.EnumerateFiles(journals));
+ }
+ finally
+ {
+ // Ensure loopback exemption is always cleaned up, even if assertions fail.
+ LoopbackExemption.Remove(profile.Sid);
+ }
}
[Theory]
@@ -395,6 +405,8 @@ public sealed class SecurityPolicyTests
[InlineData("wfp")]
public void Independent_process_crash_is_fully_recovered_on_next_start(string scenario)
{
+ // Pre-clean any residual loopback exemption from prior test failures.
+ LoopbackExemption.Remove(AppContainerProfile.EnsureFixed().Sid);
using TestDirectory directory = new();
string resourceDirectory = Path.Combine(directory.Path, "resource");
string resourceFile = Path.Combine(directory.Path, "resource.txt");
@@ -550,7 +562,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument edit = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"overwrite","content":"after"}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_edit", edit.RootElement, TestContext.Current.CancellationToken);
@@ -584,7 +596,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument mkdir = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"mkdir"}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "dir", mkdir.RootElement, TestContext.Current.CancellationToken);
@@ -615,7 +627,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument rmdir = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"rmdir"}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "dir", rmdir.RootElement, TestContext.Current.CancellationToken);
@@ -643,7 +655,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument rmdir = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"rmdir"}""");
await Assert.ThrowsAsync<ToolValidationException>(async () => await backend.ExecuteAsync(taskId, "dir", rmdir.RootElement, TestContext.Current.CancellationToken));
@@ -667,7 +679,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument list = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(workspace)}},"operation":"list"}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "dir", list.RootElement, TestContext.Current.CancellationToken);
@@ -693,7 +705,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
string badTarget = Path.Combine(outside.Path, "escaped");
using JsonDocument mkdir = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(badTarget)}},"operation":"mkdir"}""");
@@ -719,7 +731,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument tail = JsonDocument.Parse($$"""{"root":{{JsonSerializer.Serialize(binaryFile)}},"mode":"tail","query":"","tail_lines":10}""");
await Assert.ThrowsAsync<ToolValidationException>(async () => await backend.ExecuteAsync(taskId, "file_search", tail.RootElement, TestContext.Current.CancellationToken));
@@ -755,7 +767,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument tail = JsonDocument.Parse($$"""{"root":{{JsonSerializer.Serialize(textFile)}},"mode":"tail","query":"","tail_lines":10}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_search", tail.RootElement, TestContext.Current.CancellationToken);
@@ -780,7 +792,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument rename = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(source)}},"operation":"rename","new_path":{{JsonSerializer.Serialize(dest)}}}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_edit", rename.RootElement, TestContext.Current.CancellationToken);
@@ -811,7 +823,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument rename = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(source)}},"operation":"rename","new_path":{{JsonSerializer.Serialize(dest)}}}""");
await Assert.ThrowsAsync<ToolValidationException>(async () => await backend.ExecuteAsync(taskId, "file_edit", rename.RootElement, TestContext.Current.CancellationToken));
@@ -838,7 +850,7 @@ public sealed class SecurityPolicyTests
16 * 1024 * 1024, 1024 * 1024, 1000, 10000);
var backend = new WindowsToolBackend(settings, audit);
Guid taskId = Guid.NewGuid();
- await backend.BeginTaskAsync(taskId, TestContext.Current.CancellationToken);
+ await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken);
using JsonDocument rename = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(source)}},"operation":"rename","new_path":{{JsonSerializer.Serialize(dest)}}}""");
ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_edit", rename.RootElement, TestContext.Current.CancellationToken);
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-19 19:06:53 +0000