bastion 0.60.0
This commit is contained in:
Privatae
+81
@@ -0,0 +1,81 @@
|
||||
# Runs install.ps1's elevation block (an ordinary account installing for the
|
||||
# whole machine) with Start-Process stood in: Windows' prompt answered yes, or
|
||||
# declined. pwsh on Linux:
|
||||
# pwsh -NoProfile -File testdata/install_ps1_elevate.ps1 ../deploy/install.ps1
|
||||
# Exits 0 when every case holds, and prints the first that does not.
|
||||
param([string]$Script)
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$src = Get-Content -Raw $Script
|
||||
$m = [regex]::Match($src, '(?ms)^if \(\$Service -and -not \$isAdmin\) \{\r?\n.*?^\}\r?\n')
|
||||
if (-not $m.Success) { Write-Output 'FAIL: install.ps1 has no elevation block'; exit 1 }
|
||||
# The account's SID comes from a Windows API pwsh on Linux does not have.
|
||||
$text = $m.Value.Replace('([Security.Principal.WindowsIdentity]::GetCurrent()).User.Value', "'S-1-5-21-1-2-3-1001'")
|
||||
$block = [scriptblock]::Create($text)
|
||||
|
||||
# A temp folder with quotes in its name, as under a profile like O'Brien, or
|
||||
# O’Brien typed with a typographic apostrophe, which PowerShell also reads
|
||||
# as a single quote.
|
||||
$dir = Join-Path ([IO.Path]::GetTempPath()) ("o'brien-o$([char]0x2019)neil two-spaces-" + [guid]::NewGuid().ToString())
|
||||
New-Item -ItemType Directory -Path $dir | Out-Null
|
||||
$env:LOCALAPPDATA = $dir
|
||||
$env:TMPDIR = $dir
|
||||
function Write-Host { param($Object) $script:out += "$Object`n" }
|
||||
|
||||
function Run-Case([string]$answer, [bool]$installed, [string]$pair) {
|
||||
$script:out = ''; $script:cmd = ''; $script:pairSeen = ''
|
||||
$Service = $true; $isAdmin = $false; $serviceInstalled = $installed; $Shared = $false
|
||||
$elevatedDone = $false; $fellBack = $false; $Pair = $pair
|
||||
$installScript = 'https://privatae.ai/bastion/install.ps1'
|
||||
function Start-Process {
|
||||
param($FilePath, $Verb, [switch]$Wait, [switch]$PassThru, $WindowStyle, $ArgumentList)
|
||||
if ($answer -eq 'no') { throw 'The operation was canceled by the user.' }
|
||||
if ($ArgumentList[-2] -ne '-EncodedCommand') { throw "the elevated command is not passed encoded: $($ArgumentList -join ' ')" }
|
||||
$script:cmd = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($ArgumentList[-1]))
|
||||
# The elevated command must parse as PowerShell, whatever the temp
|
||||
# folder is called.
|
||||
$errs = $null; $toks = $null
|
||||
$ast = [System.Management.Automation.Language.Parser]::ParseInput($script:cmd, [ref]$toks, [ref]$errs)
|
||||
if ($errs) { throw "the elevated command does not parse: $($errs[0].Message)" }
|
||||
# Each value as the elevated PowerShell reads it: the string after
|
||||
# the named parameter, quotes undone by the parser itself.
|
||||
$arg = {
|
||||
param($name)
|
||||
foreach ($c in $ast.FindAll({ $args[0] -is [System.Management.Automation.Language.CommandAst] }, $true)) {
|
||||
$el = $c.CommandElements
|
||||
for ($i = 0; $i -lt $el.Count - 1; $i++) {
|
||||
if ($el[$i] -is [System.Management.Automation.Language.CommandParameterAst] -and $el[$i].ParameterName -eq $name) {
|
||||
return $el[$i + 1].Value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
$pfArg = & $arg 'PairFile'
|
||||
if ($pfArg) { $script:pairSeen = [IO.File]::ReadAllText($pfArg) }
|
||||
$log = & $arg 'LiteralPath'
|
||||
Set-Content -LiteralPath $log -Value 'Installed: C:\Program Files\Privatae\privatae-bastion.exe'
|
||||
return [pscustomobject]@{ ExitCode = 0 }
|
||||
}
|
||||
$threw = $null
|
||||
try { . $block } catch { $threw = $_.Exception.Message }
|
||||
return @{ threw = $threw; out = $script:out; cmd = $script:cmd; pairSeen = $script:pairSeen;
|
||||
service = $Service; done = $elevatedDone; fellBack = $fellBack }
|
||||
}
|
||||
function Fail([string]$why) { Write-Output "FAIL: $why"; exit 1 }
|
||||
|
||||
$r = Run-Case 'yes' $false 'skp_INVENTEDCODE'
|
||||
if ($r.threw -or -not $r.done) { Fail "a yes did not finish: $($r.threw)" }
|
||||
if ($r.cmd -match 'skp_') { Fail "the code is in the elevated command line: $($r.cmd)" }
|
||||
if ($r.pairSeen -ne 'skp_INVENTEDCODE') { Fail "the elevated step could not read the code: '$($r.pairSeen)'" }
|
||||
if ($r.cmd -notmatch "-Personal -OwnerSid 'S-1-5-21-1-2-3-1001'") { Fail "kind or owner: $($r.cmd)" }
|
||||
if ($r.cmd -notmatch "o''brien-o$([char]0x2019)$([char]0x2019)neil") { Fail "the temp folder's quotes are not doubled: $($r.cmd)" }
|
||||
if ($r.out -notmatch 'Installed: C:\\Program Files') { Fail "the elevated step's output is not shown: $($r.out)" }
|
||||
if (Get-ChildItem -LiteralPath $dir -Filter 'privatae-bastion-pair-*' -ErrorAction SilentlyContinue) { Fail 'the code file was left behind' }
|
||||
|
||||
$r = Run-Case 'no' $false ''
|
||||
if ($r.threw -or $r.done -or $r.service -or -not $r.fellBack -or $r.out -notmatch 'installed for your account only') { Fail "a no must fall back to this account: $($r.threw) $($r.out)" }
|
||||
|
||||
$r = Run-Case 'no' $true ''
|
||||
if (-not $r.threw -or $r.threw -notmatch 'installed for the whole machine') { Fail "beside the service, a no must install nothing: $($r.threw)" }
|
||||
|
||||
Remove-Item -Recurse -Force $dir
|
||||
Write-Output 'ok: install.ps1 elevates for the whole machine, passes the code in a file, shows the output, falls back on a no'
|
||||
+8
-5
@@ -5,8 +5,11 @@
|
||||
param([string]$Script)
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$src = Get-Content -Raw $Script
|
||||
$m = [regex]::Match($src, '(?ms)^if \(\$Pair\) \{\r?\n.*?^\}\r?\n')
|
||||
if (-not $m.Success) { Write-Output 'FAIL: install.ps1 has no top-level if ($Pair) { … } block'; exit 1 }
|
||||
# The block that pairs: of every `if ($Pair) { … }`, the one that hands the
|
||||
# code to `pair -`.
|
||||
$m = [regex]::Matches($src, '(?ms)^( *)if \(\$Pair\) \{\r?\n.*?^\1\}\r?\n') |
|
||||
Where-Object { $_.Value.Contains('$Pair | & $exe pair -') } | Select-Object -First 1
|
||||
if (-not $m) { Write-Output 'FAIL: install.ps1 has no if ($Pair) { … } block that pairs'; exit 1 }
|
||||
$block = [scriptblock]::Create($m.Value)
|
||||
|
||||
$dir = Join-Path ([IO.Path]::GetTempPath()) ([guid]::NewGuid().ToString())
|
||||
@@ -26,11 +29,11 @@ function Get-Process { @() }
|
||||
function Start-Sleep { }
|
||||
function Write-Host { param($Object) $script:out += "$Object`n" }
|
||||
|
||||
function Run-Case([string]$rc, [bool]$networked) {
|
||||
function Run-Case([string]$rc, [bool]$service) {
|
||||
$script:calls = @(); $script:out = ''
|
||||
if (Test-Path $log) { Remove-Item $log }
|
||||
$env:FAKE_RC = $rc
|
||||
$Pair = 'skp_INVENTEDCODE'; $Networked = $networked
|
||||
$Pair = 'skp_INVENTEDCODE'; $Service = $service
|
||||
$threw = $null
|
||||
try { . $block } catch { $threw = $_.Exception.Message }
|
||||
$l = if (Test-Path $log) { Get-Content -Raw $log } else { '' }
|
||||
@@ -52,7 +55,7 @@ $r = Run-Case '1' $false
|
||||
if (-not $r.threw -or $r.calls -ne '') { Fail "a failed pair must throw before starting anything: $($r.threw) $($r.calls)" }
|
||||
|
||||
$r = Run-Case '0' $true
|
||||
if ($r.threw -or $r.calls -ne 'restart-service' -or $r.out -notmatch 'Windows service PrivataeBastion') { Fail "networked restarts the service: $($r.threw) $($r.calls)" }
|
||||
if ($r.threw -or $r.calls -ne 'restart-service' -or $r.out -notmatch 'Windows service PrivataeBastion') { Fail "the service is restarted: $($r.threw) $($r.calls)" }
|
||||
|
||||
Remove-Item -Recurse -Force $dir
|
||||
Write-Output 'ok: install.ps1 -Pair pairs over stdin, treats exit 3 as success, stops on a failure, restarts task or service'
|
||||
|
||||
Reference in New Issue
Block a user