diff options
Diffstat (limited to 'tests/Agent.Windows.Tests/SecurityPolicyTests.cs')
| -rw-r--r-- | tests/Agent.Windows.Tests/SecurityPolicyTests.cs | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs index 10415ce..7489dad 100644 --- a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs +++ b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs @@ -457,7 +457,7 @@ public sealed class SecurityPolicyTests { string auditPath = Path.Combine(directory.Path, "crash-audit.jsonl"); using JsonDocument audit = JsonDocument.Parse(File.ReadLines(auditPath).Single(line => line.Contains("process.start", StringComparison.Ordinal))); - int sandboxPid = int.Parse(audit.RootElement.GetProperty("Data").GetProperty("pid").GetString()!, + int sandboxPid = int.Parse(audit.RootElement.GetProperty("data").GetProperty("pid").GetString()!, System.Globalization.CultureInfo.InvariantCulture); Assert.True(SpinWait.SpinUntil(() => !ProcessExists(sandboxPid), TimeSpan.FromSeconds(5)), $"Orphan sandbox PID {sandboxPid} survived broker crash."); } @@ -562,7 +562,8 @@ public sealed class SecurityPolicyTests 16 * 1024 * 1024, 1024 * 1024, 1000, 10000); var backend = new WindowsToolBackend(settings, audit); Guid taskId = Guid.NewGuid(); - await backend.BeginTaskAsync(taskId, Guid.NewGuid(), TestContext.Current.CancellationToken); + Guid sessionId = Guid.NewGuid(); + await backend.BeginTaskAsync(taskId, sessionId, TestContext.Current.CancellationToken); using JsonDocument edit = JsonDocument.Parse($$"""{"path":{{JsonSerializer.Serialize(target)}},"operation":"overwrite","content":"after"}"""); ToolExecutionResult result = await backend.ExecuteAsync(taskId, "file_edit", edit.RootElement, TestContext.Current.CancellationToken); @@ -576,7 +577,11 @@ public sealed class SecurityPolicyTests Assert.Empty(Directory.EnumerateFiles(Path.Combine(directory.Path, "journals"))); string backups = Path.Combine(directory.Path, "backups"); Assert.True(!Directory.Exists(backups) || !Directory.EnumerateFileSystemEntries(backups).Any()); - Assert.Contains(audit.Events, item => item.Event == "wfp.remove" && item.Data["residual_filters"] == "0"); + Assert.Contains(audit.Events, item => item.Event == "network.rule.remove" && item.Data["residual_filters"] == "0"); + Assert.Contains(audit.Events, item => item.Event == "task.start" && item.SessionId == sessionId); + Assert.Contains(audit.Events, item => item.Event == "tool.call" && item.SessionId == sessionId); + Assert.Contains(audit.Events, item => item.Event == "file.write" && item.SessionId == sessionId); + Assert.Contains(audit.Events, item => item.Event == "task.end" && item.SessionId == sessionId); Assert.Single(audit.Events, item => item.Event == "acl.apply"); Assert.Single(audit.Events, item => item.Event == "acl.restore"); } @@ -925,7 +930,7 @@ public sealed class SecurityPolicyTests Assert.False(deniedPort.Accepted); } allowJournal.CompleteAndDelete(); - Assert.Contains(audit.Events, item => item.Event == "wfp.remove" && item.Data["residual_filters"] == "0"); + Assert.Contains(audit.Events, item => item.Event == "network.rule.remove" && item.Data["residual_filters"] == "0"); } private static RestrictedProcessResult Curl(RestrictedProcessLauncher launcher, Guid taskId, string curl, string url, string cwd) => |