chef 10.34.6-x86-mingw32 → 11.6.2-x86-mingw32

data/lib/chef/chef_fs/raw_request.rb

@@ -0,0 +1,79 @@
+class Chef
+  module ChefFS
+    module RawRequest
+      def self.raw_json(chef_rest, api_path)
+        JSON.parse(raw_request(chef_rest, api_path), :create_additions => false)
+      end
+
+      def self.raw_request(chef_rest, api_path)
+        api_request(chef_rest, :GET, chef_rest.create_url(api_path), {}, false)
+      end
+
+      def self.api_request(chef_rest, method, url, headers={}, data=false)
+        json_body = data
+        #        json_body = data ? Chef::JSONCompat.to_json(data) : nil
+        # Force encoding to binary to fix SSL related EOFErrors
+        # cf. http://tickets.opscode.com/browse/CHEF-2363
+        # http://redmine.ruby-lang.org/issues/5233
+        #        json_body.force_encoding(Encoding::BINARY) if json_body.respond_to?(:force_encoding)
+        headers = build_headers(chef_rest, method, url, headers, json_body)
+
+        chef_rest.retriable_rest_request(method, url, json_body, headers) do |rest_request|
+          response = rest_request.call {|r| r.read_body}
+
+          response_body = chef_rest.decompress_body(response)
+
+          if response.kind_of?(Net::HTTPSuccess)
+            response_body
+          elsif redirect_location = redirected_to(response)
+            if [:GET, :HEAD].include?(method)
+              chef_rest.follow_redirect do
+                api_request(chef_rest, method, chef_rest.create_url(redirect_location))
+              end
+            else
+              raise Exceptions::InvalidRedirect, "#{method} request was redirected from #{url} to #{redirect_location}. Only GET and HEAD support redirects."
+            end
+          else
+            # have to decompress the body before making an exception for it. But the body could be nil.
+            response.body.replace(chef_rest.decompress_body(response)) if response.body.respond_to?(:replace)
+
+            if response['content-type'] =~ /json/
+              exception = response_body
+              msg = "HTTP Request Returned #{response.code} #{response.message}: "
+              msg << (exception["error"].respond_to?(:join) ? exception["error"].join(", ") : exception["error"].to_s)
+              Chef::Log.info(msg)
+            end
+            response.error!
+          end
+        end
+      end
+
+      private
+
+      # Copied so that it does not automatically inflate an object
+      # This is also used by knife raw_essentials
+
+      ACCEPT_ENCODING = "Accept-Encoding".freeze
+      ENCODING_GZIP_DEFLATE = "gzip;q=1.0,deflate;q=0.6,identity;q=0.3".freeze
+
+      def self.redirected_to(response)
+        return nil  unless response.kind_of?(Net::HTTPRedirection)
+        # Net::HTTPNotModified is undesired subclass of Net::HTTPRedirection so test for this
+        return nil  if response.kind_of?(Net::HTTPNotModified)
+        response['location']
+      end
+
+      def self.build_headers(chef_rest, method, url, headers={}, json_body=false, raw=false)
+        #        headers                 = @default_headers.merge(headers)
+        #headers['Accept']       = "application/json" unless raw
+        headers['Accept']       = "application/json" unless raw
+        headers["Content-Type"] = 'application/json' if json_body
+        headers['Content-Length'] = json_body.bytesize.to_s if json_body
+        headers[Chef::REST::RESTRequest::ACCEPT_ENCODING] = Chef::REST::RESTRequest::ENCODING_GZIP_DEFLATE
+        headers.merge!(chef_rest.authentication_headers(method, url, json_body)) if chef_rest.sign_requests?
+        headers.merge!(Chef::Config[:custom_http_headers]) if Chef::Config[:custom_http_headers]
+        headers
+      end
+    end
+  end
+end

data/lib/chef/client.rb

@@ -24,7 +24,8 @@ require 'chef/mixin/path_sanity'
 require 'chef/log'
 require 'chef/rest'
 require 'chef/api_client'
-require 'chef/platform'
+require 'chef/api_client/registration'
+require 'chef/platform/query_helpers'
 require 'chef/node'
 require 'chef/role'
 require 'chef/file_cache'
@@ -41,6 +42,7 @@ require 'chef/formatters/doc'
 require 'chef/formatters/minimal'
 require 'chef/version'
 require 'chef/resource_reporter'
+require 'chef/run_lock'
 require 'ohai'
 require 'rbconfig'
 
@@ -101,6 +103,7 @@ class Chef
       self.class.run_start_notifications.each do |notification|
         notification.call(run_status)
       end
+      @events.run_started(run_status)
     end
 
     # Callback to fire notifications that the run completed successfully
@@ -127,8 +130,8 @@ class Chef
     #--
     # TODO: timh/cw: 5-19-2010: json_attribs should be moved to RunContext?
     attr_reader :json_attribs
-
     attr_reader :run_status
+    attr_reader :events
 
     # Creates a new Chef::Client.
     def initialize(json_attribs=nil, args={})
@@ -138,15 +141,6 @@ class Chef
       @runner = nil
       @ohai = Ohai::System.new
 
-      # If we want why-run output and user hasn't explicitly specified a format
-      # we need to use a formatter that will render whyrun output.
-      if Chef::Config.why_run
-        if Chef::Config.formatter == "null"
-          Chef::Log.warn("Forcing formatter of 'doc' to capture whyrun output.")
-          Chef::Config[:formatter] = 'doc'
-        end
-      end
-
       event_handlers = configure_formatters
       event_handlers += Array(Chef::Config[:event_handlers])
 
@@ -156,7 +150,31 @@ class Chef
     end
 
     def configure_formatters
-      [Chef::Formatters.new(Chef::Config.formatter, STDOUT, STDERR)]
+      formatters_for_run.map do |formatter_name, output_path|
+        if output_path.nil?
+          Chef::Formatters.new(formatter_name, STDOUT, STDERR)
+        else
+          io = File.open(output_path, "a+")
+          io.sync = true
+          Chef::Formatters.new(formatter_name, io, io)
+        end
+      end
+    end
+
+    def formatters_for_run
+      if Chef::Config.formatters.empty?
+        [default_formatter]
+      else
+        Chef::Config.formatters
+      end
+    end
+
+    def default_formatter
+      if (STDOUT.tty? && !Chef::Config[:force_logger]) || Chef::Config[:force_formatter]
+        [:doc]
+      else
+        [:null]
+      end
     end
 
     # Do a full run for this Chef::Client.  Calls:
@@ -167,23 +185,47 @@ class Chef
     # === Returns
     # boolean:: Return value from #do_run. Should always returns true.
     def run
+      # win32-process gem exposes some form of :fork for Process
+      # class. So we are seperately ensuring that the platform we're
+      # running on is not windows before forking.
       if(Chef::Config[:client_fork] && Process.respond_to?(:fork) && !Chef::Platform.windows?)
         Chef::Log.info "Forking chef instance to converge..."
         pid = fork do
-          Chef::Log.info "Forked instance now converging"
-          do_run
-          exit
+          [:INT, :TERM].each {|s| trap(s, "EXIT") }
+          client_solo = Chef::Config[:solo] ? "chef-solo" : "chef-client"
+          $0 = "#{client_solo} worker: ppid=#{Process.ppid};start=#{Time.new.strftime("%R:%S")};"
+          begin
+            Chef::Log.debug "Forked instance now converging"
+            do_run
+          rescue Exception
+            exit 1
+          else
+            exit 0
+          end
         end
-        Chef::Log.info "Fork successful. Waiting for new chef pid: #{pid}"
+        Chef::Log.debug "Fork successful. Waiting for new chef pid: #{pid}"
         result = Process.waitpid2(pid)
-        raise "Forked convergence run failed" unless result.last.success?
-        Chef::Log.info "Forked child successfully reaped (pid: #{pid})"
+        handle_child_exit(result)
+        Chef::Log.debug "Forked child successfully reaped (pid: #{pid})"
         true
       else
         do_run
       end
     end
 
+    def handle_child_exit(pid_and_status)
+      status = pid_and_status[1]
+      return true if status.success?
+      message = if status.signaled?
+        "Chef run process terminated by signal #{status.termsig} (#{Signal.list.invert[status.termsig]})"
+      else
+        "Chef run process exited unsuccessfully (exit code #{status.exitstatus})"
+      end
+      raise Exceptions::ChildConvergeError, message
+    end
+
+
+
     # Configures the Chef::Cookbook::FileVendor class to fetch file from the
     # server or disk as appropriate, creates the run context for this run, and
     # sanity checks the cookbook collection.
@@ -192,7 +234,9 @@ class Chef
     def setup_run_context
       if Chef::Config[:solo]
         Chef::Cookbook::FileVendor.on_create { |manifest| Chef::Cookbook::FileSystemFileVendor.new(manifest, Chef::Config[:cookbook_path]) }
-        cookbook_collection = Chef::CookbookCollection.new(Chef::CookbookLoader.new(Chef::Config[:cookbook_path]))
+        cl = Chef::CookbookLoader.new(Chef::Config[:cookbook_path])
+        cl.load_cookbooks
+        cookbook_collection = Chef::CookbookCollection.new(cl)
         run_context = Chef::RunContext.new(node, cookbook_collection, @events)
       else
         Chef::Cookbook::FileVendor.on_create { |manifest| Chef::Cookbook::RemoteFileVendor.new(manifest, rest) }
@@ -212,7 +256,7 @@ class Chef
         Chef::Log.debug("Saving the current state of node #{node_name}")
         if(@original_runlist)
           @node.run_list(*@original_runlist)
-          @node.set[:runlist_override_history] = {Time.now.to_i => @override_runlist.inspect}
+          @node.automatic_attrs[:runlist_override_history] = {Time.now.to_i => @override_runlist.inspect}
         end
         @node.save
       end
@@ -248,7 +292,7 @@ class Chef
     def build_node
       # Allow user to override the environment of a node by specifying
       # a config parameter.
-      if Chef::Config[:environment] && !Chef::Config[:environment].chomp.empty?
+      if Chef::Config[:environment] && !Chef::Config[:environment].chop.empty?
         @node.chef_environment(Chef::Config[:environment])
       end
 
@@ -329,7 +373,7 @@ class Chef
       else
         @events.registration_start(node_name, config)
         Chef::Log.info("Client key #{config[:client_key]} is not present - registering")
-        Chef::REST.new(config[:client_url], config[:validation_client_name], config[:validation_key]).register(client_name, config[:client_key])
+        Chef::ApiClient::Registration.new(node_name, config[:client_key]).run
         @events.registration_completed
       end
       # We now have the client key, and should use it from now on.
@@ -385,12 +429,31 @@ class Chef
       runner.converge
       @events.converge_complete
       true
-    rescue Exception => e
+    rescue Exception
       # TODO: should this be a separate #converge_failed(exception) method?
       @events.converge_complete
       raise
     end
 
+    def do_windows_admin_check
+      if Chef::Platform.windows?
+        Chef::Log.debug("Checking for administrator privileges....")
+
+        if !has_admin_privileges?
+          message = "chef-client doesn't have administrator privileges on node #{node_name}."
+          if Chef::Config[:fatal_windows_admin_check]
+            Chef::Log.fatal(message)
+            Chef::Log.fatal("fatal_windows_admin_check is set to TRUE.")
+            raise Chef::Exceptions::WindowsNotAdmin, message
+          else
+            Chef::Log.warn("#{message} This might cause unexpected resource failures.")
+          end
+        else
+          Chef::Log.debug("chef-client has administrator privileges on node #{node_name}.")
+        end
+      end
+    end
+
     private
 
     # Do a full run for this Chef::Client.  Calls:
@@ -404,24 +467,28 @@ class Chef
     # === Returns
     # true:: Always returns true.
     def do_run
-      run_context = nil
-
-      @events.run_start(Chef::VERSION)
-      Chef::Log.info("*** Chef #{Chef::VERSION} ***")
-      enforce_path_sanity
-      run_ohai
-      @events.ohai_completed(node)
-      register unless Chef::Config[:solo]
+      runlock = RunLock.new(Chef::Config)
+      runlock.acquire
+      # don't add code that may fail before entering this section to be sure to release lock
+      begin
+        run_context = nil
+        @events.run_start(Chef::VERSION)
+        Chef::Log.info("*** Chef #{Chef::VERSION} ***")
+        enforce_path_sanity
+        run_ohai
+        @events.ohai_completed(node)
+        register unless Chef::Config[:solo]
 
-      load_node
+        load_node
 
-      begin
         build_node
 
         run_status.start_clock
         Chef::Log.info("Starting Chef Run for #{node.name}")
         run_started
 
+        do_windows_admin_check
+
         run_context = setup_run_context
 
         converge(run_context)
@@ -442,11 +509,13 @@ class Chef
           run_status.exception = e
           run_failed
         end
+        Chef::Application.debug_stacktrace(e)
         @events.run_failed(e)
         raise
       ensure
-        run_status = nil
+        @run_status = nil
         run_context = nil
+        runlock.release
         GC.start
       end
       true
@@ -496,6 +565,13 @@ class Chef
       end
 
     end
+
+    def has_admin_privileges?
+      require 'chef/win32/security'
+
+      Chef::ReservedNames::Win32::Security.has_admin_privileges?
+    end
+
   end
 end
 
@@ -503,3 +579,4 @@ end
 require 'chef/cookbook_loader'
 require 'chef/cookbook_version'
 require 'chef/cookbook/synchronizer'
+

data/lib/chef/config.rb

@@ -2,7 +2,8 @@
 # Author:: Adam Jacob (<adam@opscode.com>)
 # Author:: Christopher Brown (<cb@opscode.com>)
 # Author:: AJ Christensen (<aj@opscode.com>)
-# Author:: Mark Mzyk (mmzyk@opscode.com)
+# Author:: Mark Mzyk (<mmzyk@opscode.com>)
+# Author:: Kyle Goodwin (<kgoodwin@primerevenue.com>)
 # Copyright:: Copyright (c) 2008 Opscode, Inc.
 # License:: Apache License, Version 2.0
 #
@@ -19,7 +20,9 @@
 # limitations under the License.
 
 require 'chef/log'
+require 'chef/exceptions'
 require 'mixlib/config'
+require 'chef/util/selinux'
 
 class Chef
   class Config
@@ -48,9 +51,6 @@ class Chef
     end
 
     def self.platform_specific_path(path)
-      #10.times { puts "* " * 40}
-      #pp caller
-
       if RUBY_PLATFORM =~ /mswin|mingw|windows/
         # turns /etc/chef/client.rb into C:/chef/client.rb
         system_drive = ENV['SYSTEMDRIVE'] ? ENV['SYSTEMDRIVE'] : ""
@@ -61,6 +61,14 @@ class Chef
       path
     end
 
+    def self.add_formatter(name, file_path=nil)
+      formatters << [name, file_path]
+    end
+
+    def self.formatters
+      @formatters ||= []
+    end
+
     # Override the config dispatch to set the value of multiple server options simultaneously
     #
     # === Parameters
@@ -69,14 +77,7 @@ class Chef
     config_attr_writer :chef_server_url do |url|
       url = url.strip
       configure do |c|
-        [ :registration_url,
-          :template_url,
-          :remotefile_url,
-          :search_url,
-          :chef_server_url,
-          :role_url ].each do |u|
-            c[u] = url
-        end
+        c[:chef_server_url] = url
       end
       url
     end
@@ -104,35 +105,19 @@ class Chef
         begin
           f = File.new(location.to_str, "a")
           f.sync = true
-        rescue Errno::ENOENT => error
-          raise Chef::Exceptions::ConfigurationError("Failed to open or create log file at #{location.to_str}")
+        rescue Errno::ENOENT
+          raise Chef::Exceptions::ConfigurationError, "Failed to open or create log file at #{location.to_str}"
         end
           f
       end
     end
 
-    # Override the config dispatch to set the value of authorized_openid_providers when openid_providers (deprecated) is used
-    #
-    # === Parameters
-    # providers<Array>:: An array of openid providers that are authorized to login to the chef server
-    #
-    config_attr_writer :openid_providers do |providers|
-      configure { |c| c[:authorized_openid_providers] = providers }
-      providers
-    end
-
     # Turn on "path sanity" by default. See also: http://wiki.opscode.com/display/chef/User+Environment+PATH+Sanity
     enforce_path_sanity(true)
 
     # Formatted Chef Client output is a beta feature, disabled by default:
     formatter "null"
 
-    # Used when OpenID authentication is enabled in the Web UI
-    authorized_openid_identifiers nil
-    authorized_openid_providers nil
-    openid_cstore_couchdb false
-    openid_cstore_path "/var/chef/openid/cstore"
-
     # The number of times the client should retry when registering with the server
     client_registration_retries 5
 
@@ -144,64 +129,72 @@ class Chef
     # An array of paths to search for knife exec scripts if they aren't in the current directory
     script_path []
 
-    # Where files are stored temporarily during uploads
-    sandbox_path "/var/chef/sandboxes"
-
     # Where cookbook files are stored on the server (by content checksum)
     checksum_path "/var/chef/checksums"
 
-    # CouchDB database name to use
-    couchdb_database "chef"
-
-    couchdb_url "http://localhost:5984"
-
     # Where chef's cache files should be stored
     file_cache_path platform_specific_path("/var/chef/cache")
 
+    # By default, chef-client (or solo) creates a lockfile in
+    # `file_cache_path`/chef-client-running.pid
+    # If `lockfile` is explicitly set, this path will be used instead.
+    #
+    # If your `file_cache_path` resides on a NFS (or non-flock()-supporting
+    # fs), it's recommended to set this to something like
+    # '/tmp/chef-client-running.pid'
+    lockfile nil
+
     # Where backups of chef-managed files should go
     file_backup_path platform_specific_path("/var/chef/backup")
 
     ## Daemonization Settings ##
     # What user should Chef run as?
     user nil
-    # What group should the chef-server, -solr, -solr-indexer run as
     group nil
     umask 0022
 
+    # Valid log_levels are:
+    # * :debug
+    # * :info
+    # * :warn
+    # * :fatal
+    # These work as you'd expect. There is also a special `:auto` setting.
+    # When set to :auto, Chef will auto adjust the log verbosity based on
+    # context. When a tty is available (usually becase the user is running chef
+    # in a console), the log level is set to :warn, and output formatters are
+    # used as the primary mode of output. When a tty is not available, the
+    # logger is the primary mode of output, and the log level is set to :info
+    log_level :auto
+
+    # Using `force_formatter` causes chef to default to formatter output when STDOUT is not a tty
+    force_formatter false
+
+    # Using `force_logger` causes chef to default to logger output when STDOUT is a tty
+    force_logger false
+
     http_retry_count 5
     http_retry_delay 5
     interval nil
     json_attribs nil
-    log_level :info
     log_location STDOUT
     # toggle info level log items that can create a lot of output
     verbose_logging true
     node_name nil
-    node_path "/var/chef/node"
-    diff_disable            false
+    diff_disabled           false
     diff_filesize_threshold 10000000
     diff_output_threshold   1000000
 
     pid_file nil
 
-    chef_server_url   "http://localhost:4000"
-    registration_url  "http://localhost:4000"
-    template_url      "http://localhost:4000"
-    role_url          "http://localhost:4000"
-    remotefile_url    "http://localhost:4000"
-    search_url        "http://localhost:4000"
-
-    client_url "http://localhost:4042"
+    chef_server_url   "https://localhost:443"
 
     rest_timeout 300
-    yum_timeout 120
-    run_command_stderr_timeout 120
-    run_command_stdout_timeout 120
+    yum_timeout 900
     solo  false
     splay nil
     why_run false
     color false
-    client_fork false
+    client_fork true
     enable_reporting true
     enable_reporting_url_fatals false
 
@@ -213,32 +206,16 @@ class Chef
     ssl_ca_path nil
     ssl_ca_file nil
 
-
     # Where should chef-solo look for role files?
     role_path platform_specific_path("/var/chef/roles")
 
     data_bag_path platform_specific_path("/var/chef/data_bags")
 
+    environment_path platform_specific_path("/var/chef/environments")
+
     # Where should chef-solo download recipes from?
     recipe_url nil
 
-    solr_url "http://localhost:8983/solr"
-    solr_jetty_path "/var/chef/solr-jetty"
-    solr_data_path "/var/chef/solr/data"
-    solr_home_path "/var/chef/solr"
-    solr_heap_size "256M"
-    solr_java_opts nil
-
-    # Parameters for connecting to RabbitMQ
-    amqp_host '0.0.0.0'
-    amqp_port '5672'
-    amqp_user 'chef'
-    amqp_pass 'testing'
-    amqp_vhost '/chef'
-    # Setting this to a UUID string also makes the queue durable
-    # (persist across rabbitmq restarts)
-    amqp_consumer_id "default"
-
     # Sets the version of the signed header authentication protocol to use (see
     # the 'mixlib-authorization' project for more detail). Currently, versions
     # 1.0 and 1.1 are available; however, the chef-server must first be
@@ -263,6 +240,32 @@ class Chef
     # `node_name` of the client.
     client_key platform_specific_path("/etc/chef/client.pem")
 
+    # This secret is used to decrypt encrypted data bag items.
+    encrypted_data_bag_secret platform_specific_path("/etc/chef/encrypted_data_bag_secret")
+
+    # We have to check for the existence of the default file before setting it
+    # since +Chef::Config[:encrypted_data_bag_secret]+ is read by older
+    # bootstrap templates to determine if the local secret should be uploaded to
+    # node being bootstrapped. This should be removed in Chef 12.
+    unless File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret"))
+      encrypted_data_bag_secret(nil)
+    end
+
+    # As of Chef 11.0, version "1" is the default encrypted data bag item
+    # format. Version "2" is available which adds encrypt-then-mac protection.
+    # To maintain compatibility, versions other than 1 must be opt-in.
+    #
+    # Set this to `2` if you have chef-client 11.6.0+ in your infrastructure:
+    data_bag_encrypt_version 1
+
+    # When reading data bag items, any supported version is accepted. However,
+    # if all encrypted data bags have been generated with the version 2 format,
+    # it is recommended to disable support for earlier formats to improve
+    # security. For example, the version 2 format is identical to version 1
+    # except for the addition of an HMAC, so an attacker with MITM capability
+    # could downgrade an encrypted data bag to version 1 as part of an attack.
+    data_bag_decrypt_minimum_version 0
+
     # If there is no file in the location given by `client_key`, chef-client
     # will temporarily use the "validator" identity to generate one. If the
     # `client_key` is not present and the `validation_key` is also not present,
@@ -271,41 +274,35 @@ class Chef
     # The `validation_key` is never used if the `client_key` exists.
     validation_key platform_specific_path("/etc/chef/validation.pem")
     validation_client_name "chef-validator"
-    web_ui_client_name "chef-webui"
-    web_ui_key "/etc/chef/webui.pem"
-    web_ui_admin_user_name  "admin"
-    web_ui_admin_default_password "p@ssw0rd1"
 
-    # Server Signing CA
-    #
-    # In truth, these don't even have to change
-    signing_ca_cert "/var/chef/ca/cert.pem"
-    signing_ca_key "/var/chef/ca/key.pem"
-    signing_ca_user nil
-    signing_ca_group nil
-    signing_ca_country "US"
-    signing_ca_state "Washington"
-    signing_ca_location "Seattle"
-    signing_ca_org "Chef User"
-    signing_ca_domain "opensource.opscode.com"
-    signing_ca_email "opensource-cert@opscode.com"
+    # Zypper package provider gpg checks. Set to true to enable package
+    # gpg signature checking. This will be default in the
+    # future. Setting to false disables the warnings.
+    # Leaving this set to nil or false is a security hazard!
+    zypper_check_gpg nil
 
     # Report Handlers
     report_handlers []
 
-    # Event Handlers
-    event_handlers []
-
     # Exception Handlers
     exception_handlers []
 
     # Start handlers
     start_handlers []
 
-    # Checksum Cache
-    # Uses Moneta on the back-end
-    cache_type "BasicFile"
-    cache_options({ :path => platform_specific_path("/var/chef/cache/checksums"), :skip_expires => true })
+    # Syntax Check Cache. Knife keeps track of files that is has already syntax
+    # checked by storing files in this directory. `syntax_check_cache_path` is
+    # the new (and preferred) configuration setting. If not set, knife will
+    # fall back to using cache_options[:path].
+    #
+    # Because many users will have knife configs with cache_options (generated
+    # by `knife configure`), the default for now is to *not* set
+    # syntax_check_cache_path, and thus fallback to cache_options[:path]. We
+    # leave that value to the same default as was previously set.
+    syntax_check_cache_path nil
+
+    # Deprecated:
+    cache_options({ :path => platform_specific_path("/var/chef/cache/checksums") })
 
     # Set to false to silence Chef 11 deprecation warnings:
     chef11_deprecation_warnings true
@@ -321,17 +318,29 @@ class Chef
       principal_valid_regex_part = '[^"\/\\\\\[\]\:;|=,+*?<>]+'
       user_valid_regex [ /^(#{principal_valid_regex_part}\\)?#{principal_valid_regex_part}$/ ]
       group_valid_regex [ /^(#{principal_valid_regex_part}\\)?#{principal_valid_regex_part}$/ ]
+
+      fatal_windows_admin_check false
     else
-      user_valid_regex [ /^([-a-zA-Z0-9_.]+)$/, /^\d+$/ ]
-      group_valid_regex [ /^([-a-zA-Z0-9_.\\ ]+)$/, /^\d+$/ ]
+      user_valid_regex [ /^([-a-zA-Z0-9_.]+[\\@]?[-a-zA-Z0-9_.]+)$/, /^\d+$/ ]
+      group_valid_regex [ /^([-a-zA-Z0-9_.\\@^ ]+)$/, /^\d+$/ ]
     end
 
     # returns a platform specific path to the user home dir
     windows_home_path = ENV['SYSTEMDRIVE'] + ENV['HOMEPATH'] if ENV['SYSTEMDRIVE'] && ENV['HOMEPATH']
-    user_home (ENV['HOME'] || windows_home_path || ENV['USERPROFILE'])
+    user_home(ENV['HOME'] || windows_home_path || ENV['USERPROFILE'])
+
+    # Enable file permission fixup for selinux. Fixup will be done
+    # only if selinux is enabled in the system.
+    enable_selinux_file_permission_fixup true
+
+    # Use atomic updates (i.e. move operation) while updating contents
+    # of the files resources. When set to false copy operation is
+    # used to update files.
+    file_atomic_update true
 
-    # CHEF-4631
-    # Enables the concatanation behavior instead of merging
-    deep_merge_array_concat true
+    # If false file staging is will be done via tempfiles that are
+    # created under ENV['TMP'] otherwise tempfiles will be created in
+    # the directory that files are going to reside.
+    file_staging_uses_destdir false
   end
 end