Add Pester test for insecure policy folder warning

Adds dsc_settings_policy_security.tests.ps1 that validates on both
Windows and Linux that an insecure dsc policy folder emits a warning
about the settings file not being used, and does not cause a non-zero
exit code. Also fixes minor issue with the t! macro call passing path
to the Windows-specific message.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Steve Lee (POWERSHELL HE/HIM) (from Dev Box)

dsc/tests/dsc_settings_policy_security.tests.ps1

@@ -0,0 +1,88 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+Describe 'tests for policy folder security validation' {
+    BeforeDiscovery {
+        $isElevated = if ($IsWindows) {
+            ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
+                [Security.Principal.WindowsBuiltInRole]::Administrator)
+        } else {
+            (id -u) -eq 0
+        }
+    }
+
+    Context 'Windows policy folder with insecure ACL emits warning' -Skip:(!$IsWindows -or !$isElevated) {
+        BeforeAll {
+            $script:policyDirPath = Join-Path $env:ProgramData "dsc"
+            $script:policyFilePath = Join-Path $script:policyDirPath "dsc.settings.json"
+            $script:existedBefore = Test-Path $script:policyDirPath
+
+            if (-not $script:existedBefore) {
+                New-Item -ItemType Directory -Path $script:policyDirPath -Force | Out-Null
+            }
+
+            # Write a simple policy settings file
+            @{ tracing = @{ level = "TRACE" } } | ConvertTo-Json -Depth 5 | Set-Content -Path $script:policyFilePath
+
+            # Grant Everyone write access to make the folder insecure
+            icacls $script:policyDirPath /grant "Everyone:(OI)(CI)(W)" /T | Out-Null
+        }
+
+        AfterAll {
+            # Remove the Everyone ACE to restore security
+            icacls $script:policyDirPath /remove "Everyone" /T | Out-Null
+
+            Remove-Item -Path $script:policyFilePath -ErrorAction SilentlyContinue
+            if (-not $script:existedBefore) {
+                Remove-Item -Recurse -Force -Path $script:policyDirPath -ErrorAction SilentlyContinue
+            }
+        }
+
+        It 'Should emit a warning about insecure policy folder' {
+            dsc -l warn resource list 2> $TestDrive/tracing.txt
+            "$TestDrive/tracing.txt" | Should -FileContentMatch "is not secure, settings file will not be used"
+        }
+
+        It 'Should not exit with an error code' {
+            dsc -l warn resource list 2> $TestDrive/tracing.txt
+            $LASTEXITCODE | Should -Be 0
+        }
+    }
+
+    Context 'Linux policy folder with insecure permissions emits warning' -Skip:($IsWindows -or !$isElevated) {
+        BeforeAll {
+            $script:policyDirPath = "/etc/dsc"
+            $script:policyFilePath = Join-Path $script:policyDirPath "dsc.settings.json"
+            $script:existedBefore = Test-Path $script:policyDirPath
+
+            if (-not $script:existedBefore) {
+                New-Item -ItemType Directory -Path $script:policyDirPath -Force | Out-Null
+            }
+
+            # Write a simple policy settings file
+            @{ tracing = @{ level = "TRACE" } } | ConvertTo-Json -Depth 5 | Set-Content -Path $script:policyFilePath
+
+            # Make the folder world-writable (insecure)
+            chmod 777 $script:policyDirPath
+        }
+
+        AfterAll {
+            chmod 755 $script:policyDirPath
+
+            Remove-Item -Path $script:policyFilePath -ErrorAction SilentlyContinue
+            if (-not $script:existedBefore) {
+                Remove-Item -Recurse -Force -Path $script:policyDirPath -ErrorAction SilentlyContinue
+            }
+        }
+
+        It 'Should emit a warning about insecure policy folder' {
+            dsc -l warn resource list 2> $TestDrive/tracing.txt
+            "$TestDrive/tracing.txt" | Should -FileContentMatch "is not secure, settings file will not be used"
+        }
+
+        It 'Should not exit with an error code' {
+            dsc -l warn resource list 2> $TestDrive/tracing.txt
+            $LASTEXITCODE | Should -Be 0
+        }
+    }
+}

lib/dsc-lib/src/util.rs

@@ -202,7 +202,6 @@ pub fn get_exe_path() -> Result<PathBuf, DscError> {
 fn get_settings_policy_file_path() -> String
 {
     // $env:ProgramData+"\dsc\dsc.settings.json"
-    // This location is writable only by admins, but readable by all users
     let Ok(local_program_data_path) = std::env::var("ProgramData") else { return String::new(); };
     let dsc_folder = Path::new(&local_program_data_path).join("dsc");
     let settings_path = dsc_folder.join("dsc.settings.json").display().to_string();
@@ -212,7 +211,7 @@ fn get_settings_policy_file_path() -> String
     }
 
     if !verify_windows_acl(&dsc_folder) {
-        let required = t!("util.policyFolderNotSecureWindows");
+        let required = t!("util.policyFolderNotSecureWindows", path = dsc_folder.display());
         warn!("{}", t!("util.policyFolderNotSecure", path = dsc_folder.display(), required = required));
         return String::new();
     }