Repository navigation
Fix file permissions check - #833
Merged
Tess Gauthier (tgauth) merged 8 commits intoMay 11, 2026
Merged
Conversation
Collaborator
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Pull request overview
This PR tightens Windows OpenSSH file/folder permission validation by treating WRITE_DAC, WRITE_OWNER, and DELETE as unsafe “write-like” rights, and adds regression coverage to ensure the new checks behave as expected.
Changes:
- Expand Windows secure permission checks to flag
WRITE_DAC,WRITE_OWNER, andDELETEon files/folders. - Add Pester negative tests for private keys, host keys, and
authorized_keyswhen another account has those rights. - Add Setup test coverage to confirm sshd logs an Operational warning (but still starts) when the ProgramData\ssh folder grants those rights.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| regress/pesterTests/Userkey_fileperm.Tests.ps1 | Adds negative ssh private-key tests for ChangePermissions/TakeOwnership/Delete. |
| regress/pesterTests/Setup.Tests.ps1 | Adds Operational event-log warning tests for insecure ssh folder rights. |
| regress/pesterTests/Hostkey_fileperm.Tests.ps1 | Adds negative sshd host-key tests for ChangePermissions/TakeOwnership/Delete. |
| regress/pesterTests/Authorized_keys_fileperm.Tests.ps1 | Adds negative authorized_keys tests for ChangePermissions/TakeOwnership/Delete. |
| contrib/win32/win32compat/w32-sshfileperm.c | Extends “write-like” access mask checks to include WRITE_DAC/WRITE_OWNER/DELETE. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Collaborator
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Tess Gauthier (tgauth)
requested review from
Travis Plunk (TravisEz13) and
Vivian Thiebaut (vthiebaut10)
April 13, 2026 17:59
Vivian Thiebaut (vthiebaut10)
approved these changes
Apr 13, 2026
|
Azure Pipelines: 1 pipeline(s) require an authorized user to comment /azp run to run. |
Tess Gauthier (tgauth)
changed the title
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
|
Azure Pipelines: 1 pipeline(s) require an authorized user to comment /azp run to run. |
Collaborator
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Collaborator
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Collaborator
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Vivian Thiebaut (vthiebaut10)
approved these changes
May 11, 2026
Tess Gauthier (tgauth)
merged commit May 11, 2026
b91ebb3
into
PowerShell:latestw_all
7 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
WRITE_DAC,WRITE_OWNER, andDELETE