bolt 0.20.0 → 0.20.2

data/vendored/puppet/lib/puppet/provider/user/hpux.rb

@@ -0,0 +1,95 @@
+Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
+  desc "User management for HP-UX. This provider uses the undocumented `-F`
+    switch to HP-UX's special `usermod` binary to work around the fact that
+    its standard `usermod` cannot make changes while the user is logged in.
+    New functionality provides for changing trusted computing passwords and
+    resetting password expirations under trusted computing."
+
+  defaultfor :operatingsystem => "hp-ux"
+  confine :operatingsystem => "hp-ux"
+
+  commands :modify => "/usr/sam/lbin/usermod.sam", :delete => "/usr/sam/lbin/userdel.sam", :add => "/usr/sam/lbin/useradd.sam"
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :home, :flag => "-d", :method => :dir
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  has_features :manages_homedir, :allows_duplicates, :manages_passwords
+
+  def deletecmd
+    super.insert(1,"-F")
+  end
+
+  def modifycmd(param,value)
+     cmd = super(param, value)
+     cmd << "-F"
+     if trusted then
+       # Append an additional command to reset the password age to 0
+       # until a workaround with expiry module can be found for trusted
+       # computing.
+       cmd << ";"
+       cmd << "/usr/lbin/modprpw"
+       cmd << "-v"
+       cmd << "-l"
+       cmd << "#{resource.name}"
+     end
+     cmd
+  end
+
+  def password
+    # Password management routine for trusted and non-trusted systems
+    #temp=""
+    while ent = Etc.getpwent() do
+      if ent.name == resource.name
+        temp=ent.name
+        break
+      end
+    end
+    Etc.endpwent()
+    if !temp
+      return nil
+    end
+
+    ent = Etc.getpwnam(resource.name)
+    if ent.passwd == "*"
+      # Either no password or trusted password, check trusted
+      file_name="/tcb/files/auth/#{resource.name.chars.first}/#{resource.name}"
+      if File.file?(file_name)
+        # Found the tcb user for the specific user, now get passwd
+        File.open(file_name).each do |line|
+          if ( line =~ /u_pwd/ )
+            temp_passwd=line.split(":")[1].split("=")[1]
+            ent.passwd = temp_passwd
+            return ent.passwd
+          end
+        end
+      else
+        debug "No trusted computing user file #{file_name} found."
+      end
+    else
+      return ent.passwd
+    end
+  end
+
+  def trusted
+    # Check to see if the HP-UX box is running in trusted compute mode
+    # UID for root should always be 0
+    trusted_sys = exec_getprpw('root','-m uid')
+    if trusted_sys.chomp == "uid=0"
+      return true
+    else
+      return false
+    end
+  end
+
+  def exec_getprpw(user,opts)
+    Puppet::Util::Execution.execute("/usr/lbin/getprpw #{opts} #{user}", { :combine => true })
+  end
+end

data/vendored/puppet/lib/puppet/provider/user/ldap.rb

@@ -0,0 +1,128 @@
+require 'puppet/provider/ldap'
+
+Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
+  desc "User management via LDAP.
+
+    This provider requires that you have valid values for all of the
+    LDAP-related settings in `puppet.conf`, including `ldapbase`.  You will
+    almost definitely need settings for `ldapuser` and `ldappassword` in order
+    for your clients to write to LDAP.
+
+    Note that this provider will automatically generate a UID for you if
+    you do not specify one, but it is a potentially expensive operation,
+    as it iterates across all existing users to pick the appropriate next one."
+
+  confine :feature => :ldap, :false => (Puppet[:ldapuser] == "")
+
+  has_feature :manages_passwords, :manages_shell
+
+  manages(:posixAccount, :person).at("ou=People").named_by(:uid).and.maps :name => :uid,
+    :password => :userPassword,
+    :comment => :cn,
+    :uid => :uidNumber,
+    :gid => :gidNumber,
+    :home => :homeDirectory,
+    :shell => :loginShell
+
+  # Use the last field of a space-separated array as
+  # the sn.  LDAP requires a surname, for some stupid reason.
+  manager.generates(:sn).from(:cn).with do |cn|
+    cn[0].split(/\s+/)[-1]
+  end
+
+  # Find the next uid after the current largest uid.
+  provider = self
+  manager.generates(:uidNumber).with do
+    largest = 500
+    if existing = provider.manager.search
+      existing.each do |hash|
+        next unless value = hash[:uid]
+        num = value[0].to_i
+        largest = num if num > largest
+      end
+    end
+    largest + 1
+  end
+
+  # Convert our gid to a group name, if necessary.
+  def gid=(value)
+    value = group2id(value) unless value.is_a?(Integer)
+
+    @property_hash[:gid] = value
+  end
+
+  # Find all groups this user is a member of in ldap.
+  def groups
+    # We want to cache the current result, so we know if we
+    # have to remove old values.
+    unless @property_hash[:groups]
+      unless result = group_manager.search("memberUid=#{name}")
+        return @property_hash[:groups] = :absent
+      end
+
+      return @property_hash[:groups] = result.collect { |r| r[:name] }.sort.join(",")
+    end
+    @property_hash[:groups]
+  end
+
+  # Manage the list of groups this user is a member of.
+  def groups=(values)
+    should = values.split(",")
+
+    if groups == :absent
+      is = []
+    else
+      is = groups.split(",")
+    end
+
+    modes = {}
+    [is, should].flatten.uniq.each do |group|
+      # Skip it when they're in both
+      next if is.include?(group) and should.include?(group)
+
+      # We're adding a group.
+      modes[group] = :add and next unless is.include?(group)
+
+      # We're removing a group.
+      modes[group] = :remove and next unless should.include?(group)
+    end
+
+    modes.each do |group, form|
+      self.fail "Could not find ldap group #{group}" unless ldap_group = group_manager.find(group)
+
+      current = ldap_group[:members]
+
+      if form == :add
+        if current.is_a?(Array) and ! current.empty?
+          new = current + [name]
+        else
+          new = [name]
+        end
+      else
+        new = current - [name]
+        new = :absent if new.empty?
+      end
+
+      group_manager.update(group, {:ensure => :present, :members => current}, {:ensure => :present, :members => new})
+    end
+  end
+
+  # Convert a gropu name to an id.
+  def group2id(group)
+    Puppet::Type.type(:group).provider(:ldap).name2id(group)
+  end
+
+  private
+
+  def group_manager
+    Puppet::Type.type(:group).provider(:ldap).manager
+  end
+
+  def group_properties(values)
+    if values.empty? or values == :absent
+      {:ensure => :present}
+    else
+      {:ensure => :present, :members => values}
+    end
+  end
+end

data/vendored/puppet/lib/puppet/provider/user/openbsd.rb

@@ -0,0 +1,76 @@
+require 'puppet/error'
+
+Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
+  desc "User management via `useradd` and its ilk for OpenBSD. Note that you
+    will need to install Ruby's shadow password library (package known as
+    `ruby-shadow`) if you wish to manage user passwords."
+
+  commands :add      => "useradd",
+           :delete   => "userdel",
+           :modify   => "usermod",
+           :password => "passwd"
+
+  defaultfor :operatingsystem => :openbsd
+  confine    :operatingsystem => :openbsd
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :password, :method => :sp_pwdp
+  options :loginclass, :flag => '-L', :method => :sp_loginclass
+  options :expiry, :method => :sp_expire,
+    :munge => proc { |value|
+      if value == :absent
+        ''
+      else
+        # OpenBSD uses a format like "january 1 1970"
+        Time.parse(value).strftime('%B %d %Y')
+      end
+    },
+    :unmunge => proc { |value|
+      if value == -1
+        :absent
+      else
+        # Expiry is days after 1970-01-01
+        (Date.new(1970,1,1) + value).strftime('%Y-%m-%d')
+      end
+    }
+
+  [:expiry, :password, :loginclass].each do |shadow_property|
+    define_method(shadow_property) do
+      if Puppet.features.libshadow?
+        if ent = Shadow::Passwd.getspnam(@resource.name)
+          method = self.class.option(shadow_property, :method)
+          # ruby-shadow may not be new enough (< 2.4.1) and therefore lack the
+          # sp_loginclass field.
+          begin
+            return unmunge(shadow_property, ent.send(method))
+          rescue
+            #TRANSLATORS 'ruby-shadow' is a Ruby gem library
+            Puppet.warning _("ruby-shadow doesn't support %{method}") % { method: method }
+          end
+        end
+      end
+      :absent
+    end
+  end
+
+  has_features :manages_homedir, :manages_expiry, :system_users
+  has_features :manages_shell
+  if Puppet.features.libshadow?
+    has_features :manages_passwords, :manages_loginclass
+  end
+
+  def loginclass=(value)
+    set("loginclass", value)
+  end
+
+  def modifycmd(param, value)
+    cmd = super
+    if param == :groups
+      idx = cmd.index('-G')
+      cmd[idx] = '-S'
+    end
+    cmd
+  end
+end

data/vendored/puppet/lib/puppet/provider/user/pw.rb

@@ -0,0 +1,98 @@
+require 'puppet/provider/nameservice/pw'
+require 'open3'
+
+Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::PW do
+  desc "User management via `pw` on FreeBSD and DragonFly BSD."
+
+  commands :pw => "pw"
+  has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry, :manages_shell
+
+  defaultfor :operatingsystem => [:freebsd, :dragonfly]
+  confine    :operatingsystem => [:freebsd, :dragonfly]
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :expiry, :method => :expire, :munge => proc { |value|
+    value = '0000-00-00' if value == :absent
+    value.split("-").reverse.join("-")
+  }
+
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  def addcmd
+    cmd = [command(:pw), "useradd", @resource[:name]]
+    @resource.class.validproperties.each do |property|
+      next if property == :ensure or property == :password
+      if value = @resource.should(property) and value != ""
+        cmd << flag(property) << munge(property,value)
+      end
+    end
+
+    cmd << "-o" if @resource.allowdupe?
+    cmd << "-m" if @resource.managehome?
+    cmd
+  end
+
+  def modifycmd(param, value)
+    if param == :expiry
+      # FreeBSD uses DD-MM-YYYY rather than YYYY-MM-DD
+      value = value.split("-").reverse.join("-")
+    end
+    cmd = super(param, value)
+    cmd << "-m" if @resource.managehome?
+    cmd
+  end
+
+  def deletecmd
+    cmd = super
+    cmd << "-r" if @resource.managehome?
+    cmd
+  end
+
+  def create
+    super
+
+    # Set the password after create if given
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+  # use pw to update password hash
+  def password=(cryptopw)
+    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
+    stdin, _, _ = Open3.popen3("pw user mod #{@resource[:name]} -H 0")
+    stdin.puts(cryptopw)
+    stdin.close
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
+  end
+
+  # get password from /etc/master.passwd
+  def password
+    Puppet.debug "checking password for user '#{@resource[:name]}' method called"
+    current_passline = `getent passwd #{@resource[:name]}`
+    current_password = current_passline.chomp.split(':')[1] if current_passline
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called : '#{current_password}'"
+    current_password
+  end
+
+  # Get expiry from system and convert to Puppet-style date
+  def expiry
+    expiry = self.get(:expiry)
+    expiry = :absent if expiry == 0
+
+    if expiry != :absent
+      t = Time.at(expiry)
+      expiry = "%4d-%02d-%02d" % [t.year, t.month, t.mday]
+    end
+
+    expiry
+  end
+end
+

data/vendored/puppet/lib/puppet/provider/user/user_role_add.rb

@@ -0,0 +1,233 @@
+require 'puppet/util'
+require 'puppet/util/user_attr'
+require 'date'
+
+Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source => :useradd do
+
+  desc "User and role management on Solaris, via `useradd` and `roleadd`."
+
+  defaultfor :osfamily => :solaris
+
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "passwd", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :shell, :flag => "-s"
+  options :roles, :flag => "-R"
+  options :auths, :flag => "-A"
+  options :profiles, :flag => "-P"
+  options :password_min_age, :flag => "-n"
+  options :password_max_age, :flag => "-x"
+  options :password_warn_days, :flag => "-w"
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  def shell=(value)
+    check_valid_shell
+    set("shell", value)
+  end
+
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age, :manages_shell
+
+  def check_valid_shell
+    unless File.exists?(@resource.should(:shell))
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must exist")
+    end
+    unless File.executable?(@resource.should(:shell).to_s)
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must be executable")
+    end
+  end
+
+  #must override this to hand the keyvalue pairs
+  def add_properties
+    cmd = []
+    Puppet::Type.type(:user).validproperties.each do |property|
+      #skip the password because we can't create it with the solaris useradd
+      next if [:ensure, :password, :password_min_age, :password_max_age, :password_warn_days].include?(property)
+      # 1680 Now you can set the hashed passwords on solaris:lib/puppet/provider/user/user_role_add.rb
+      # the value needs to be quoted, mostly because -c might
+      # have spaces in it
+      if value = @resource.should(property) and value != ""
+        if property == :keys
+          cmd += build_keys_cmd(value)
+        else
+          cmd << flag(property) << value
+        end
+      end
+    end
+    cmd
+  end
+
+  def user_attributes
+    @user_attributes ||= UserAttr.get_attributes_by_name(@resource[:name])
+  end
+
+  def flush
+    @user_attributes = nil
+  end
+
+  def command(cmd)
+    cmd = ("role_#{cmd}").intern if is_role? or (!exists? and @resource[:ensure] == :role)
+    super(cmd)
+  end
+
+  def is_role?
+    user_attributes and user_attributes[:type] == "role"
+  end
+
+  def run(cmd, msg)
+      execute(cmd)
+  rescue Puppet::ExecutionFailure => detail
+      raise Puppet::Error, "Could not #{msg} #{@resource.class.name} #{@resource.name}: #{detail}", detail.backtrace
+  end
+
+  def transition(type)
+    cmd = [command(:modify)]
+    cmd << "-K" << "type=#{type}"
+    cmd += add_properties
+    cmd << @resource[:name]
+  end
+
+  def create
+    if is_role?
+      run(transition("normal"), "transition role to")
+    else
+      run(addcmd, "create")
+      if cmd = passcmd
+        run(cmd, "change password policy for")
+      end
+    end
+    # added to handle case when password is specified
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+  def destroy
+    run(deletecmd, "delete "+ (is_role? ? "role" : "user"))
+  end
+
+  def create_role
+    if exists? and !is_role?
+      run(transition("role"), "transition user to")
+    else
+      run(addcmd, "create role")
+    end
+  end
+
+  def roles
+    user_attributes[:roles] if user_attributes
+  end
+
+  def auths
+    user_attributes[:auths] if user_attributes
+  end
+
+  def profiles
+    user_attributes[:profiles] if user_attributes
+  end
+
+  def project
+    user_attributes[:project] if user_attributes
+  end
+
+  def managed_attributes
+    [:name, :type, :roles, :auths, :profiles, :project]
+  end
+
+  def remove_managed_attributes
+    managed = managed_attributes
+    user_attributes.select { |k,v| !managed.include?(k) }.inject({}) { |hash, array| hash[array[0]] = array[1]; hash }
+  end
+
+  def keys
+    if user_attributes
+      #we have to get rid of all the keys we are managing another way
+      remove_managed_attributes
+    end
+  end
+
+  def build_keys_cmd(keys_hash)
+    cmd = []
+    keys_hash.each do |k,v|
+      cmd << "-K" << "#{k}=#{v}"
+    end
+    cmd
+  end
+
+  def keys=(keys_hash)
+    run([command(:modify)] + build_keys_cmd(keys_hash) << @resource[:name], "modify attribute key pairs")
+  end
+
+
+  # This helper makes it possible to test this on stub data without having to
+  # do too many crazy things!
+  def target_file_path
+    "/etc/shadow"
+  end
+  private :target_file_path
+
+  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return it
+  #No abstraction, all esoteric knowledge of file formats, yay
+  def shadow_entry
+    return @shadow_entry if defined? @shadow_entry
+    @shadow_entry = File.readlines(target_file_path).
+      reject { |r| r =~ /^[^\w]/ }.
+      # PUP-229: don't suppress the empty fields
+      collect { |l| l.chomp.split(':', -1) }.
+      find { |user, _| user == @resource[:name] }
+  end
+
+  def password
+    return :absent unless shadow_entry
+    shadow_entry[1]
+  end
+
+  def password_min_age
+    return :absent unless shadow_entry
+    shadow_entry[3].empty? ? -1 : shadow_entry[3]
+  end
+
+  def password_max_age
+    return :absent unless shadow_entry
+    shadow_entry[4].empty? ? -1 : shadow_entry[4]
+  end
+
+  def password_warn_days
+    return :absent unless shadow_entry
+    shadow_entry[5].empty? ? -1 : shadow_entry[5]
+  end
+
+  # Read in /etc/shadow, find the line for our used and rewrite it with the
+  # new pw.  Smooth like 80 grit sandpaper.
+  #
+  # Now uses the `replace_file` mechanism to minimize the chance that we lose
+  # data, but it is still terrible.  We still skip platform locking, so a
+  # concurrent `vipw -s` session will have no idea we risk data loss.
+  def password=(cryptopw)
+    begin
+      shadow = File.read(target_file_path)
+
+      # Go Mifune loves the race here where we can lose data because
+      # /etc/shadow changed between reading it and writing it.
+      # --daniel 2012-02-05
+      Puppet::Util.replace_file(target_file_path, 0640) do |fh|
+        shadow.each_line do |line|
+          line_arr = line.split(':')
+          if line_arr[0] == @resource[:name]
+            line_arr[1] = cryptopw
+            line_arr[2] = (Date.today - Date.new(1970,1,1)).to_i.to_s
+            line = line_arr.join(':')
+          end
+          fh.print line
+        end
+      end
+    rescue => detail
+      self.fail Puppet::Error, "Could not write replace #{target_file_path}: #{detail}", detail
+    end
+  end
+end