RubyGems - bolt - Versions diffs - 0.19.1 → 0.20.0 - Mend

bolt 0.19.1 → 0.20.0

Potentially problematic release.

This version of bolt might be problematic. Click here for more details.

Files changed (1261) hide show

data/vendored/puppet/lib/puppet/util/windows/access_control_list.rb DELETED

@@ -1,113 +0,0 @@
-# Windows Access Control List
-#
-# Represents a list of access control entries (ACEs).
-#
-# @see https://msdn.microsoft.com/en-us/library/windows/desktop/aa374872(v=vs.85).aspx
-# @api private
-class Puppet::Util::Windows::AccessControlList
-  include Enumerable
-  ACCESS_ALLOWED_ACE_TYPE                 = 0x0
-  ACCESS_DENIED_ACE_TYPE                  = 0x1
-  # Construct an ACL.
-  #
-  # @param acl [Enumerable] A list of aces to copy from.
-  def initialize(acl = nil)
-    if acl
-      @aces = acl.map(&:dup)
-    else
-      @aces = []
-    end
-  end
-  # Enumerate each ACE in the list.
-  #
-  # @yieldparam ace [Hash] the ace
-  def each
-    @aces.each {|ace| yield ace}
-  end
-  # Allow the +sid+ to access a resource with the specified access +mask+.
-  #
-  # @param sid [String] The SID that the ACE is granting access to
-  # @param mask [int] The access mask granted to the SID
-  # @param flags [int] The flags assigned to the ACE, e.g. +INHERIT_ONLY_ACE+
-  def allow(sid, mask, flags = 0)
-    @aces << Puppet::Util::Windows::AccessControlEntry.new(sid, mask, flags, ACCESS_ALLOWED_ACE_TYPE)
-  end
-  # Deny the +sid+ access to a resource with the specified access +mask+.
-  #
-  # @param sid [String] The SID that the ACE is denying access to
-  # @param mask [int] The access mask denied to the SID
-  # @param flags [int] The flags assigned to the ACE, e.g. +INHERIT_ONLY_ACE+
-  def deny(sid, mask, flags = 0)
-    @aces << Puppet::Util::Windows::AccessControlEntry.new(sid, mask, flags, ACCESS_DENIED_ACE_TYPE)
-  end
-  # Reassign all ACEs currently assigned to +old_sid+ to +new_sid+ instead.
-  # If an ACE is inherited or is not assigned to +old_sid+, then it will
-  # be copied as-is to the new ACL, preserving its order within the ACL.
-  #
-  # @param old_sid [String] The old SID, e.g. 'S-1-5-18'
-  # @param new_sid [String] The new SID
-  # @return [AccessControlList] The copied ACL.
-  def reassign!(old_sid, new_sid)
-    new_aces = []
-    prepend_needed = false
-    aces_to_prepend = []
-    @aces.each do |ace|
-      new_ace = ace.dup
-      if ace.sid == old_sid
-        if ace.inherited?
-          # create an explicit ACE granting or denying the
-          # new_sid the rights that the inherited ACE
-          # granted or denied the old_sid. We mask off all
-          # flags except those affecting inheritance of the
-          # ACE we're creating.
-          inherit_mask = Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
-            Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
-            Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
-          explicit_ace = Puppet::Util::Windows::AccessControlEntry.new(new_sid, ace.mask, ace.flags & inherit_mask, ace.type)
-          aces_to_prepend << explicit_ace
-        else
-          new_ace.sid = new_sid
-          prepend_needed = old_sid == Puppet::Util::Windows::SID::LocalSystem
-        end
-      end
-      new_aces << new_ace
-    end
-    @aces = []
-    if prepend_needed
-      mask = Puppet::Util::Windows::File::STANDARD_RIGHTS_ALL | Puppet::Util::Windows::File::SPECIFIC_RIGHTS_ALL
-      ace = Puppet::Util::Windows::AccessControlEntry.new(
-              Puppet::Util::Windows::SID::LocalSystem,
-              mask)
-      @aces << ace
-    end
-    @aces.concat(aces_to_prepend)
-    @aces.concat(new_aces)
-  end
-  def inspect
-    str = ""
-    @aces.each do |ace|
-      str << "  #{ace.inspect}\n"
-    end
-    str
-  end
-  def ==(other)
-    self.class == other.class &&
-      self.to_a == other.to_a
-  end
-  alias eql? ==
-end

data/vendored/puppet/lib/puppet/util/windows/adsi.rb DELETED

@@ -1,545 +0,0 @@
-module Puppet::Util::Windows::ADSI
-  require 'ffi'
-  class << self
-    extend FFI::Library
-    def connectable?(uri)
-      begin
-        !! connect(uri)
-      rescue
-        false
-      end
-    end
-    def connect(uri)
-      begin
-        WIN32OLE.connect(uri)
-      rescue WIN32OLERuntimeError => e
-        raise Puppet::Error.new( _("ADSI connection error: %{e}") % { e: e }, e )
-      end
-    end
-    def create(name, resource_type)
-      Puppet::Util::Windows::ADSI.connect(computer_uri).Create(resource_type, name)
-    end
-    def delete(name, resource_type)
-      Puppet::Util::Windows::ADSI.connect(computer_uri).Delete(resource_type, name)
-    end
-    # taken from winbase.h
-    MAX_COMPUTERNAME_LENGTH = 31
-    def computer_name
-      unless @computer_name
-        max_length = MAX_COMPUTERNAME_LENGTH + 1 # NULL terminated
-        FFI::MemoryPointer.new(max_length * 2) do |buffer| # wide string
-          FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
-            buffer_size.write_dword(max_length) # length in TCHARs
-            if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Failed to get computer name"))
-            end
-            @computer_name = buffer.read_wide_string(buffer_size.read_dword)
-          end
-        end
-      end
-      @computer_name
-    end
-    def computer_uri(host = '.')
-      "WinNT://#{host}"
-    end
-    def wmi_resource_uri( host = '.' )
-      "winmgmts:{impersonationLevel=impersonate}!//#{host}/root/cimv2"
-    end
-    # This method should *only* be used to generate WinNT://<SID> style monikers
-    # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not usable
-    # to resolve an account with WIN32OLE.connect
-    # Valid input is a SID::Principal, S-X-X style SID string or any valid
-    # account name with or without domain prefix
-    # @api private
-    def sid_uri_safe(sid)
-      return sid_uri(sid) if sid.kind_of?(Puppet::Util::Windows::SID::Principal)
-      begin
-        sid = Puppet::Util::Windows::SID.name_to_principal(sid)
-        sid_uri(sid)
-      rescue Puppet::Util::Windows::Error, Puppet::Error
-        nil
-      end
-    end
-    # This method should *only* be used to generate WinNT://<SID> style monikers
-    # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not useable
-    # to resolve an account with WIN32OLE.connect
-    def sid_uri(sid)
-      raise Puppet::Error.new( _("Must use a valid SID::Principal") ) if !sid.kind_of?(Puppet::Util::Windows::SID::Principal)
-      "WinNT://#{sid.sid}"
-    end
-    def uri(resource_name, resource_type, host = '.')
-      "#{computer_uri(host)}/#{resource_name},#{resource_type}"
-    end
-    def wmi_connection
-      connect(wmi_resource_uri)
-    end
-    def execquery(query)
-      wmi_connection.execquery(query)
-    end
-    ffi_convention :stdcall
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
-    # BOOL WINAPI GetComputerName(
-    #   _Out_    LPTSTR lpBuffer,
-    #   _Inout_  LPDWORD lpnSize
-    # );
-    ffi_lib :kernel32
-    attach_function_private :GetComputerNameW,
-      [:lpwstr, :lpdword], :win32_bool
-  end
-  module Shared
-    def localized_domains
-      @localized_domains ||= [
-        # localized version of BUILTIN
-        # for instance VORDEFINIERT on German Windows
-        Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
-        # localized version of NT AUTHORITY (can't use S-1-5)
-        # for instance AUTORITE NT on French Windows
-        Puppet::Util::Windows::SID.name_to_principal('SYSTEM').domain.upcase
-      ]
-    end
-    def uri(name, host = '.')
-      host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
-      # group or user
-      account_type = self.name.split('::').last.downcase
-      Puppet::Util::Windows::ADSI.uri(name, account_type, host)
-    end
-    def parse_name(name)
-      if name =~ /\//
-        raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
-      end
-      matches = name.scan(/((.*)\\)?(.*)/)
-      domain = matches[0][1] || '.'
-      account = matches[0][2]
-      return account, domain
-    end
-    # returns Puppet::Util::Windows::SID::Principal[]
-    # may contain objects that represent unresolvable SIDs
-    def get_sids(adsi_child_collection)
-      sids = []
-      adsi_child_collection.each do |m|
-        sids << Puppet::Util::Windows::SID.ads_to_principal(m)
-      end
-      sids
-    end
-    def name_sid_hash(names)
-      return {} if names.nil? || names.empty?
-      sids = names.map do |name|
-        sid = Puppet::Util::Windows::SID.name_to_principal(name)
-        raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
-        [sid.sid, sid]
-      end
-      Hash[ sids ]
-    end
-  end
-  class User
-    extend Enumerable
-    extend Puppet::Util::Windows::ADSI::Shared
-    extend FFI::Library
-    # https://msdn.microsoft.com/en-us/library/aa746340.aspx
-    # IADsUser interface
-    require 'puppet/util/windows/sid'
-    attr_accessor :native_user
-    attr_reader :name, :sid
-    def initialize(name, native_user = nil)
-      @name = name
-      @native_user = native_user
-    end
-    def native_user
-      @native_user ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(@name)))
-    end
-    def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_user.objectSID)
-    end
-    def uri
-      self.class.uri(sid.account, sid.domain)
-    end
-    def self.logon(name, password)
-      Puppet::Util::Windows::User.password_is?(name, password)
-    end
-    def [](attribute)
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_user.Get(attribute)
-    end
-    def []=(attribute, value)
-      native_user.Put(attribute, value)
-    end
-    def commit
-      begin
-        native_user.SetInfo unless native_user.nil?
-      rescue WIN32OLERuntimeError => e
-        # ERROR_BAD_USERNAME 2202L from winerror.h
-        if e.message =~ /8007089A/m
-          raise Puppet::Error.new(
-           _("Puppet is not able to create/delete domain users with the user resource."),
-           e
-          )
-        end
-        raise Puppet::Error.new( _("User update failed: %{e}") % { e: e }, e )
-      end
-      self
-    end
-    def password_is?(password)
-      self.class.logon(name, password)
-    end
-    def add_flag(flag_name, value)
-      flag = native_user.Get(flag_name) rescue 0
-      native_user.Put(flag_name, flag | value)
-      commit
-    end
-    def password=(password)
-      if !password.nil?
-        native_user.SetPassword(password)
-        commit
-      end
-      fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
-      add_flag("UserFlags", fADS_UF_DONT_EXPIRE_PASSWD)
-    end
-    def groups
-      # https://msdn.microsoft.com/en-us/library/aa746342.aspx
-      # WIN32OLE objects aren't enumerable, so no map
-      groups = []
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_user.Groups.each {|g| groups << g.Name} rescue nil
-      groups
-    end
-    def add_to_groups(*group_names)
-      group_names.each do |group_name|
-        Puppet::Util::Windows::ADSI::Group.new(group_name).add_member_sids(sid)
-      end
-    end
-    alias add_to_group add_to_groups
-    def remove_from_groups(*group_names)
-      group_names.each do |group_name|
-        Puppet::Util::Windows::ADSI::Group.new(group_name).remove_member_sids(sid)
-      end
-    end
-    alias remove_from_group remove_from_groups
-    def add_group_sids(*sids)
-      group_names = sids.map { |s| s.domain_account }
-      add_to_groups(*group_names)
-    end
-    def remove_group_sids(*sids)
-      group_names = sids.map { |s| s.domain_account }
-      remove_from_groups(*group_names)
-    end
-    def group_sids
-      self.class.get_sids(native_user.Groups)
-    end
-    def set_groups(desired_groups, minimum = true)
-      return if desired_groups.nil?
-      desired_groups = desired_groups.split(',').map(&:strip)
-      current_hash = Hash[ self.group_sids.map { |sid| [sid.sid, sid] } ]
-      desired_hash = self.class.name_sid_hash(desired_groups)
-      # First we add the user to all the groups it should be in but isn't
-      if !desired_groups.empty?
-        groups_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
-        add_group_sids(*groups_to_add)
-      end
-      # Then we remove the user from all groups it is in but shouldn't be, if
-      # that's been requested
-      if !minimum
-        if desired_hash.empty?
-          groups_to_remove = current_hash.values
-        else
-          groups_to_remove = (current_hash.keys - desired_hash.keys).map { |sid| current_hash[sid] }
-        end
-        remove_group_sids(*groups_to_remove)
-      end
-    end
-    def self.create(name)
-      # Windows error 1379: The specified local group already exists.
-      raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
-      new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
-    end
-    # UNLEN from lmcons.h - https://stackoverflow.com/a/2155176
-    MAX_USERNAME_LENGTH = 256
-    def self.current_user_name
-      user_name = ''
-      max_length = MAX_USERNAME_LENGTH + 1 # NULL terminated
-      FFI::MemoryPointer.new(max_length * 2) do |buffer| # wide string
-        FFI::MemoryPointer.new(:dword, 1) do |buffer_size|
-          buffer_size.write_dword(max_length) # length in TCHARs
-          if GetUserNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"))
-          end
-          # buffer_size includes trailing NULL
-          user_name = buffer.read_wide_string(buffer_size.read_dword - 1)
-        end
-      end
-      user_name
-    end
-    def self.current_user_sid
-      Puppet::Util::Windows::SID.name_to_principal(current_user_name)
-    end
-    def self.exists?(name_or_sid)
-      well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
-        return true if sid.account_type == :SidTypeUser
-        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
-        # so try to resolve it
-        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
-        well_known = sid.account_type == :SidTypeWellKnownGroup
-        return false if sid.account_type != :SidTypeAlias && !well_known
-        name_or_sid = "#{sid.domain}\\#{sid.account}"
-      end
-      user = Puppet::Util::Windows::ADSI.connect(User.uri(*User.parse_name(name_or_sid)))
-      # otherwise, verify that the account is actually a User account
-      user.Class == 'User'
-    rescue
-      # special accounts like SYSTEM cannot resolve via moniker like WinNT://./SYSTEM,user
-      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
-      # may indicate either a group like Service or an account like SYSTEM
-      well_known
-    end
-    def self.delete(name)
-      Puppet::Util::Windows::ADSI.delete(name, 'user')
-    end
-    def self.each(&block)
-      wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
-      users = []
-      wql.each do |u|
-        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-        # values are returned as UTF-8
-        users << new(u.name)
-      end
-      users.each(&block)
-    end
-    ffi_convention :stdcall
-    # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724432(v=vs.85).aspx
-    # BOOL WINAPI GetUserName(
-    #   _Out_    LPTSTR lpBuffer,
-    #   _Inout_  LPDWORD lpnSize
-    # );
-    ffi_lib :advapi32
-    attach_function_private :GetUserNameW,
-      [:lpwstr, :lpdword], :win32_bool
-  end
-  class UserProfile
-    def self.delete(sid)
-      begin
-        Puppet::Util::Windows::ADSI.wmi_connection.Delete("Win32_UserProfile.SID='#{sid}'")
-      rescue WIN32OLERuntimeError => e
-        # https://social.technet.microsoft.com/Forums/en/ITCG/thread/0f190051-ac96-4bf1-a47f-6b864bfacee5
-        # Prior to Vista SP1, there's no built-in way to programmatically
-        # delete user profiles (except for delprof.exe). So try to delete
-        # but warn if we fail
-        raise e unless e.message.include?('80041010')
-        Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
-      end
-    end
-  end
-  class Group
-    extend Enumerable
-    extend Puppet::Util::Windows::ADSI::Shared
-    # https://msdn.microsoft.com/en-us/library/aa706021.aspx
-    # IADsGroup interface
-    attr_accessor :native_group
-    attr_reader :name, :sid
-    def initialize(name, native_group = nil)
-      @name = name
-      @native_group = native_group
-    end
-    def uri
-      self.class.uri(sid.account, sid.domain)
-    end
-    def native_group
-      @native_group ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(name)))
-    end
-    def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_group.objectSID)
-    end
-    def commit
-      begin
-        native_group.SetInfo unless native_group.nil?
-      rescue WIN32OLERuntimeError => e
-        # ERROR_BAD_USERNAME 2202L from winerror.h
-        if e.message =~ /8007089A/m
-          raise Puppet::Error.new(
-            _("Puppet is not able to create/delete domain groups with the group resource."),
-            e
-          )
-        end
-        raise Puppet::Error.new( _("Group update failed: %{error}") % { error: e }, e )
-      end
-      self
-    end
-    def add_member_sids(*sids)
-      sids.each do |sid|
-        native_group.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
-      end
-    end
-    def remove_member_sids(*sids)
-      sids.each do |sid|
-        native_group.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
-      end
-    end
-    # returns Puppet::Util::Windows::SID::Principal[]
-    # may contain objects that represent unresolvable SIDs
-    # qualified account names are returned by calling #domain_account
-    def members
-      self.class.get_sids(native_group.Members)
-    end
-    alias member_sids members
-    def set_members(desired_members, inclusive = true)
-      return if desired_members.nil?
-      current_hash = Hash[ self.member_sids.map { |sid| [sid.sid, sid] } ]
-      desired_hash = self.class.name_sid_hash(desired_members)
-      # First we add all missing members
-      if !desired_hash.empty?
-        members_to_add = (desired_hash.keys - current_hash.keys).map { |sid| desired_hash[sid] }
-        add_member_sids(*members_to_add)
-      end
-      # Then we remove all extra members if inclusive
-      if inclusive
-        if desired_hash.empty?
-          members_to_remove = current_hash.values
-        else
-          members_to_remove = (current_hash.keys - desired_hash.keys).map { |sid| current_hash[sid] }
-        end
-        remove_member_sids(*members_to_remove)
-      end
-    end
-    def self.create(name)
-      # Windows error 2224: The account already exists.
-      raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists? name
-      new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
-    end
-    def self.exists?(name_or_sid)
-      well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
-        return true if sid.account_type == :SidTypeGroup
-        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
-        # so try to resolve it
-        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
-        well_known = sid.account_type == :SidTypeWellKnownGroup
-        return false if sid.account_type != :SidTypeAlias && !well_known
-        name_or_sid = "#{sid.domain}\\#{sid.account}"
-      end
-      user = Puppet::Util::Windows::ADSI.connect(Group.uri(*Group.parse_name(name_or_sid)))
-      user.Class == 'Group'
-    rescue
-      # special groups like Authenticated Users cannot resolve via moniker like WinNT://./Authenticated Users,group
-      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
-      # may indicate either a group like Service or an account like SYSTEM
-      well_known
-    end
-    def self.delete(name)
-      Puppet::Util::Windows::ADSI.delete(name, 'group')
-    end
-    def self.each(&block)
-      wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = "TRUE"')
-      groups = []
-      wql.each do |g|
-        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-        # values are returned as UTF-8
-        groups << new(g.name)
-      end
-      groups.each(&block)
-    end
-  end
-end