test(agent): cover policy management end to end

.github/workflows/ci.yml

@@ -354,8 +354,6 @@ jobs:
           $VSINSTALLDIR = $(vswhere.exe -latest -requires Microsoft.VisualStudio.Component.VC.Llvm.Clang -property installationPath)
           Write-Output "LIBCLANG_PATH=$VSINSTALLDIR\VC\Tools\Llvm\x64\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
-          # Install Visual Studio Developer PowerShell Module for cmdlets such as Enter-VsDevShell
-          Install-Module VsDevShell -Force
         shell: pwsh
 
       - name: Configure Windows (arm) runner
@@ -696,9 +694,6 @@ jobs:
           # NASM is required by aws-lc-rs (used as rustls crypto backend)
           choco install nasm
 
-          # Install Visual Studio Developer PowerShell Module for cmdlets such as Enter-VsDevShell
-          Install-Module VsDevShell -Force
-
           # We need to add the NASM binary folder to the PATH manually.
           Write-Output "$Env:ProgramFiles\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
         shell: pwsh
@@ -707,9 +702,31 @@ jobs:
         id: find_mc
         if: ${{ matrix.os == 'windows' }}
         run: |
-          Enter-VsDevShell
-          $path = (Get-Command -Type Application mc).Source | Split-Path -Parent
+          $sdkRoots = @(
+            $Env:WindowsSdkDir
+            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
+            "${Env:ProgramFiles(x86)}\Windows Kits\10"
+          ) | Where-Object { $_ } | Select-Object -Unique
+          $candidates = @()
+          if ($Env:WindowsSdkVerBinPath) {
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
+          }
+          foreach ($root in $sdkRoots) {
+            $bin = Join-Path $root "bin"
+            $candidates += Join-Path $bin "x64\mc.exe"
+            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
+              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
+              Sort-Object { [version]$_.Name } -Descending |
+              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
+          }
+          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
+          if (-Not $mc) {
+            throw "mc.exe was not found in the installed Windows SDK"
+          }
+          $path = Split-Path -Parent $mc
           Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
         shell: pwsh
 
       - name: Build
@@ -975,6 +992,37 @@ jobs:
         if: ${{ matrix.os == 'windows' }}
         uses: microsoft/setup-msbuild@v3
 
+      - name: Find mc.exe
+        id: find_mc
+        if: ${{ matrix.os == 'windows' }}
+        run: |
+          $sdkRoots = @(
+            $Env:WindowsSdkDir
+            (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue)
+            "${Env:ProgramFiles(x86)}\Windows Kits\10"
+          ) | Where-Object { $_ } | Select-Object -Unique
+          $candidates = @()
+          if ($Env:WindowsSdkVerBinPath) {
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "mc.exe"
+            $candidates += Join-Path $Env:WindowsSdkVerBinPath "x64\mc.exe"
+          }
+          foreach ($root in $sdkRoots) {
+            $bin = Join-Path $root "bin"
+            $candidates += Join-Path $bin "x64\mc.exe"
+            $candidates += Get-ChildItem -LiteralPath $bin -Directory -ErrorAction SilentlyContinue |
+              Where-Object Name -Match '^\d+\.\d+\.\d+\.\d+$' |
+              Sort-Object { [version]$_.Name } -Descending |
+              ForEach-Object { Join-Path $_.FullName "x64\mc.exe" }
+          }
+          $mc = $candidates | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf } | Select-Object -First 1
+          if (-Not $mc) {
+            throw "mc.exe was not found in the installed Windows SDK"
+          }
+          $path = Split-Path -Parent $mc
+          Write-Output "windows_sdk_ver_bin_path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+          Write-Output $path | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
+        shell: pwsh
+
       - name: Build
         run: |
           if ($Env:RUNNER_OS -eq "Windows") {
@@ -985,6 +1033,7 @@ jobs:
             $Env:DAGENT_TUN2SOCKS_EXE = "${{ steps.tun2socks.outputs.tun2socks-executable-path }}"
             $Env:DAGENT_WINTUN_DLL = "${{ steps.tun2socks.outputs.wintun-library-path }}"
             $Env:DAGENT_MULTI_PWSH_EXECUTABLE = "${{ steps.multi-pwsh.outputs.executable-path }}"
+            $Env:WindowsSdkVerBinPath = '${{ steps.find_mc.outputs.windows_sdk_ver_bin_path }}'
           }
 
           if ($Env:RUNNER_OS -eq "Linux") {
@@ -1122,6 +1171,20 @@ jobs:
         run: dotnet test utils/dotnet/GatewayUtils.sln
         shell: pwsh
 
+  agent-installer-event-log-tests:
+    name: Agent installer Event Log lifecycle tests
+    runs-on: windows-2022
+    needs: [preflight]
+
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+
+      - name: Tests
+        run: dotnet test package/AgentWindowsManaged.Tests/DevolutionsAgent.Installer.Tests.csproj
+        shell: pwsh
 
   winapi-sanitizer-tests:
     name: Windows API sanitizer tests
@@ -1283,12 +1346,14 @@ jobs:
     name: Agent policy end-to-end test
     runs-on: windows-2022
     needs: [preflight]
+    env:
+      AGENT_POLICY_TEST_SHA: ${{ inputs.ref || github.event.pull_request.head.sha || needs.preflight.outputs.ref }}
 
     steps:
       - name: Checkout ${{ github.repository }}
         uses: actions/checkout@v6
         with:
-          ref: ${{ needs.preflight.outputs.ref }}
+          ref: ${{ env.AGENT_POLICY_TEST_SHA }}
 
       - name: Setup Rust cache
         uses: ./.github/actions/setup-rust-cache
@@ -1311,8 +1376,13 @@ jobs:
           Add-Content -Path $env:GITHUB_PATH -Value $toolsDir
 
       - name: Build Agent policy test executables
+        id: build-policy-executables
         shell: pwsh
         run: |
+          $actualCommit = git rev-parse HEAD
+          if ($LASTEXITCODE -ne 0 -or $actualCommit -ne $env:AGENT_POLICY_TEST_SHA) {
+            throw "Agent policy tests must build the requested commit $env:AGENT_POLICY_TEST_SHA, got $actualCommit"
+          }
           cargo build --locked -p devolutions-agent --features dev-skip-broker-signature
           if ($LASTEXITCODE -ne 0) {
             exit $LASTEXITCODE
@@ -1322,7 +1392,18 @@ jobs:
             exit $LASTEXITCODE
           }
 
+      - name: Run Agent policy tester as standard user
+        shell: pwsh
+        run: |
+          ./crates/agent-policy-tester/run-unelevated.ps1
+          $exitCode = $LASTEXITCODE
+          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester-unelevated.out
+          if ($exitCode -ne 0) {
+            exit $exitCode
+          }
+
       - name: Run Agent policy tester as LocalSystem
+        if: ${{ !cancelled() && steps.build-policy-executables.outcome == 'success' }}
         shell: pwsh
         run: |
           $scriptPath = Resolve-Path -Path "./crates/agent-policy-tester/run-as-system.ps1"
@@ -1333,6 +1414,10 @@ jobs:
             exit $exitCode
           }
 
+      - name: Run policy route authorization tests
+        shell: pwsh
+        run: cargo test --locked -p now-package-broker --features dev-skip-broker-signature
+
       - name: Show sccache stats
         if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
         shell: pwsh
@@ -1366,7 +1451,7 @@ jobs:
   success:
     name: Success
     if: ${{ always() }}
-    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
+    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, agent-installer-event-log-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
     runs-on: ubuntu-latest
 
     steps:

crates/agent-policy-tester/Cargo.toml

@@ -12,6 +12,8 @@ fastrand = "2"
 serde_json = "1"
 tempfile = "3"
 tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "time"] }
+win-api-wrappers = { path = "../win-api-wrappers" }
+windows = { version = "0.61", features = ["Win32_Security", "Win32_System_Threading"] }
 
 [lints]
 workspace = true

crates/agent-policy-tester/run-as-system.ps1

@@ -4,11 +4,18 @@ $workspacePath = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
 $testerPath = Join-Path $workspacePath "target/debug/agent-policy-tester.exe"
 $agentPath = Join-Path $workspacePath "target/debug/devolutions-agent.exe"
 $outputPath = Join-Path $PSScriptRoot "agent-policy-tester.out"
-$stagingPath = Join-Path $env:ProgramData "dgw-agent-policy-tester-$([guid]::NewGuid().ToString('N'))"
+$stagingPath = Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) "dgw-agent-policy-tester-$([guid]::NewGuid().ToString('N'))"
 $stagedTesterPath = Join-Path $stagingPath "agent-policy-tester.exe"
+$exitCode = 1
 
 try {
     Set-Content -LiteralPath $outputPath -Value ""
+    if (-not [System.Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) {
+        throw "This runner requires LocalSystem"
+    }
+    if ([System.IO.DriveInfo]::new([System.IO.Path]::GetPathRoot($workspacePath)).DriveType -ne 'Fixed') {
+        throw "Use a local fixed-volume workspace path visible to LocalSystem, not a mapped drive"
+    }
     Add-Type -TypeDefinition @'
 using System;
 using System.ComponentModel;
@@ -61,7 +68,6 @@ public static class AgentPolicyTesterNativeDirectory
     if (Get-ChildItem -LiteralPath $stagingPath -Force) {
         throw "The atomically protected staged tester directory was not empty"
     }
-
     Copy-Item -LiteralPath $testerPath -Destination $stagedTesterPath
     & icacls.exe $stagedTesterPath /setowner '*S-1-5-18' 2>&1 | Out-File $outputPath -Append
     if ($LASTEXITCODE -ne 0) {
@@ -76,7 +82,7 @@ public static class AgentPolicyTesterNativeDirectory
     "Staged policy tester at $stagedTesterPath" | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagingPath | Format-List Owner, Sddl | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagedTesterPath | Format-List Owner, Sddl | Out-File $outputPath -Append
-    & $stagedTesterPath $agentPath 2>&1 | Out-File $outputPath -Append
+    & $stagedTesterPath $agentPath elevated 2>&1 | Out-File $outputPath -Append
     $exitCode = $LASTEXITCODE
 } catch {
     $_ | Out-File $outputPath -Append
@@ -88,6 +94,7 @@ public static class AgentPolicyTesterNativeDirectory
         } catch {
             if ($attempt -eq 19) {
                 "Failed to remove $stagingPath after 20 attempts: $_" | Out-File $outputPath -Append
+                $exitCode = 1
             } else {
                 Start-Sleep -Milliseconds 250
             }