chef 11.4.4 → 11.6.0.hotfix.1

data/spec/support/shared/functional/securable_resource.rb

@@ -18,12 +18,12 @@
 # limitations under the License.
 #
 
-# TODO test that these work when you are logged on as a user joined to a domain (rather than local computer)
-# TODO test that you can set users from other domains
-
 require 'etc'
 
 shared_context "setup correct permissions" do
+  if windows?
+    include_context "use Windows permissions"
+  end
 
   # I could not get this to work with :requires_unprivileged_user for whatever
   # reason. The setup when running as root is the same as non-root, except we
@@ -39,10 +39,20 @@ shared_context "setup correct permissions" do
     File.chown(Etc.getpwnam('nobody').uid, 1337, path)
   end
 
-  # FIXME: windows
+  before :each, :windows_only do
+    so = SecurableObject.new(path)
+    so.owner = SID.Administrator
+    so.group = SID.Administrators
+    dacl = ACL.create(denied_acl(SID.Guest, expected_modify_perms) +
+                      allowed_acl(SID.Guest, expected_read_perms))
+    so.dacl = dacl
+  end
 end
 
 shared_context "setup broken permissions" do
+  if windows?
+    include_context "use Windows permissions"
+  end
 
   before :each, :unix_only do
     File.chmod(0644, path)
@@ -52,13 +62,21 @@ shared_context "setup broken permissions" do
     File.chown(0, 0, path)
   end
 
-  # FIXME: windows
+  before :each, :windows_only do
+    so = SecurableObject.new(path)
+    so.owner = SID.Guest
+    so.group = SID.Everyone
+    dacl = ACL.create(allowed_acl(SID.Guest, expected_modify_perms))
+    so.set_dacl(dacl, true)
+  end
 end
 
 shared_context "use Windows permissions", :windows_only do
   if windows?
     SID ||= Chef::ReservedNames::Win32::Security::SID
     ACE ||= Chef::ReservedNames::Win32::Security::ACE
+    ACL ||= Chef::ReservedNames::Win32::Security::ACL
+    SecurableObject ||= Chef::ReservedNames::Win32::Security::SecurableObject
   end
 
   def get_security_descriptor(path)
@@ -126,7 +144,7 @@ shared_context "use Windows permissions", :windows_only do
   end
 end
 
-shared_examples_for "a securable resource" do
+shared_examples_for "a securable resource with existing target" do
 
   include_context "diff disabled"
 
@@ -211,10 +229,65 @@ shared_examples_for "a securable resource" do
   context "on Windows", :windows_only do
     include_context "use Windows permissions"
 
-    before(:each) do
-      resource.run_action(:delete)
+    describe "when setting owner" do
+      before do
+        resource.owner('Administrator')
+        resource.run_action(:create)
+      end
+
+      it "should set the owner" do
+        descriptor.owner.should == SID.Administrator
+      end
+
+      it "is marked as updated only if changes are made" do
+        resource.updated_by_last_action?.should == expect_updated?
+      end
+    end
+
+    describe "when setting group" do
+      before do
+        resource.group('Administrators')
+        resource.run_action(:create)
+      end
+
+      it "should set the group" do
+        descriptor.group.should == SID.Administrators
+      end
+
+      it "is marked as updated only if changes are made" do
+        resource.updated_by_last_action?.should == expect_updated?
+      end
     end
 
+    describe "when setting rights and deny_rights" do
+      before do
+        resource.deny_rights(:modify, 'Guest')
+        resource.rights(:read, 'Guest')
+        resource.run_action(:create)
+      end
+
+      it "should set the rights and deny_rights" do
+        explicit_aces.should == denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms)
+      end
+
+      it "is marked as updated only if changes are made" do
+        resource.updated_by_last_action?.should == expect_updated?
+      end
+    end
+  end
+end
+
+shared_examples_for "a securable resource without existing target" do
+
+  include_context "diff disabled"
+
+  context "on Unix", :unix_only do
+    pending "if we need any securable resource tests on Unix without existing target resource."
+  end
+
+  context "on Windows", :windows_only do
+    include_context "use Windows permissions"
+
     it "sets owner to Administrators on create if owner is not specified" do
       File.exist?(path).should == false
       resource.run_action(:create)
@@ -428,5 +501,33 @@ shared_examples_for "a securable resource" do
       end
     end
 
+    it "does not inherit aces if inherits is set to false" do
+      # We need at least one ACE if we're creating a securable without
+      # inheritance
+      resource.rights(:full_control, 'Administrators')
+      resource.inherits(false)
+      resource.run_action(:create)
+
+      descriptor.dacl.each do | ace |
+        ace.inherited?.should == false
+      end
+    end
+
+    it "has the inheritable acls of parent directory if no acl is specified" do
+      File.exist?(path).should == false
+
+      parent_acls = parent_inheritable_acls
+
+      resource.run_action(:create)
+
+      descriptor.dacl.each_with_index do |ace, index|
+        # On Windows Server 2003 OS creates a default non-inheritable
+        # ACL during file creation unless otherwise specified.
+        ace.inherited?.should == true unless windows_win2k3?
+        ace.should == parent_acls.dacl[index]
+      end
+    end
+
   end
 end
+

data/spec/support/shared/functional/securable_resource_with_reporting.rb

@@ -1,4 +1,25 @@
 
+ALL_EXPANDED_PERMISSIONS = ["generic read",
+                            "generic write",
+                            "generic execute",
+                            "generic all",
+                            "delete",
+                            "read permissions",
+                            "change permissions",
+                            "take ownership",
+                            "synchronize",
+                            "access system security",
+                            "read data / list directory",
+                            "write data / add file",
+                            "append data / add subdirectory",
+                            "read extended attributes",
+                            "write extended attributes",
+                            "execute / traverse",
+                            "delete child",
+                            "read attributes",
+                            "write attributes"]
+
+
 shared_examples_for "a securable resource with reporting" do
 
   include_context "diff disabled"
@@ -15,6 +36,18 @@ shared_examples_for "a securable resource with reporting" do
   # let(:default_mode) { ((0100666 - File.umask) & 07777).to_s(8) }
 
   describe "reading file security metadata for reporting on unix", :unix_only => true do
+    # According to POSIX standard created files get either the
+    # effective gid of the process or inherits the gid of the parent
+    # directory based on file system. Since it's hard to guess what
+    # would happen on each platform we create a dummy file and see
+    # what the group name should be.
+    before do
+      FileUtils.touch(path)
+      @expected_gid = File.stat(path).gid
+      @expected_group_name = Etc.getgrgid(@expected_gid).name
+      FileUtils.rm_rf(path)
+    end
+
     context "when the target file doesn't exist" do
       before do
         resource.action(:create)
@@ -31,7 +64,7 @@ shared_examples_for "a securable resource with reporting" do
           resource.run_action(:create)
           # TODO: most stable way to specify?
           resource.owner.should == Etc.getpwuid(Process.uid).name
-          resource.group.should == Etc.getgrgid(Process.gid).name
+          resource.group.should == @expected_group_name
           resource.mode.should == "0#{default_mode}"
         end
       end
@@ -140,7 +173,7 @@ shared_examples_for "a securable resource with reporting" do
         it "sets the current values on current resource as strings" do
           # TODO: most stable way to specify?
           current_resource.owner.should == Etc.getpwuid(Process.uid).name
-          current_resource.group.should == Etc.getgrgid(Process.gid).name
+          current_resource.group.should == @expected_group_name
           current_resource.mode.should == "0#{((0100666 - File.umask) & 07777).to_s(8)}"
         end
       end
@@ -173,28 +206,23 @@ shared_examples_for "a securable resource with reporting" do
       end
 
       context "and group is specified with a String (group name)" do
-
-        let(:expected_group_name) { Etc.getgrgid(Process.gid).name }
-
         before do
-          resource.group(expected_group_name)
+          resource.group(@expected_group_name)
         end
 
         it "sets the group on new_resource to the group name (String) of the group" do
-          current_resource.group.should == expected_group_name
+          current_resource.group.should == @expected_group_name
         end
 
       end
 
       context "and group is specified with an Integer (gid)" do
-        let(:expected_gid) { Process.gid }
-
         before do
-          resource.group(expected_gid)
+          resource.group(@expected_gid)
         end
 
         it "sets the group on new_resource to the gid (Integer)" do
-          current_resource.group.should == expected_gid
+          current_resource.group.should == @expected_gid
         end
 
       end
@@ -233,26 +261,6 @@ shared_examples_for "a securable resource with reporting" do
       pending "windows reporting not yet fully supported"
     end
 
-    ALL_EXPANDED_PERMISSIONS = ["generic read",
-                                "generic write",
-                                "generic execute",
-                                "generic all",
-                                "delete",
-                                "read permissions",
-                                "change permissions",
-                                "take ownership",
-                                "synchronize",
-                                "access system security",
-                                "read data / list directory",
-                                "write data / add file",
-                                "append data / add subdirectory",
-                                "read extended attributes",
-                                "write extended attributes",
-                                "execute / traverse",
-                                "delete child",
-                                "read attributes",
-                                "write attributes"]
-
 
     context "when the target file doesn't exist" do
 

data/spec/support/shared/integration/integration_helper.rb

@@ -0,0 +1,166 @@
+#
+# Author:: John Keiser (<jkeiser@opscode.com>)
+# Author:: Ho-Sheng Hsiao (<hosh@opscode.com>)
+# Copyright:: Copyright (c) 2012, 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'tmpdir'
+require 'fileutils'
+require 'chef/config'
+require 'chef_zero/rspec'
+require 'json'
+require 'support/shared/integration/knife_support'
+require 'spec_helper'
+
+module IntegrationSupport
+  include ChefZero::RSpec
+
+  def self.extended(base)
+    base.before :each do
+      # We mess with Chef::Config a lot.  Save and restore it.
+      @old_chef_config = Chef::Config.configuration
+      Chef::Config.configuration = Chef::Config.configuration.dup
+      Chef::Config.repo_mode = nil
+      Chef::Config.versioned_cookbooks = nil
+    end
+    base.after :each do
+      Chef::Config.configuration = @old_chef_config
+    end
+  end
+
+  def when_the_repository(description, *args, &block)
+    context "When the local repository #{description}", *args do
+      before :each do
+        raise "Can only create one directory per test" if @repository_dir
+        @repository_dir = Dir.mktmpdir('chef_repo')
+        @old_chef_repo_path = Chef::Config.chef_repo_path
+        @old_paths = {}
+        Chef::Config.chef_repo_path = @repository_dir
+        %w(client cookbook data_bag environment node role user).each do |object_name|
+          @old_paths[object_name] = Chef::Config["#{object_name}_path".to_sym]
+          Chef::Config["#{object_name}_path".to_sym] = nil
+        end
+      end
+
+      after :each do
+        if @repository_dir
+          begin
+            %w(client cookbook data_bag environment node role user).each do |object_name|
+              Chef::Config["#{object_name}_path".to_sym] = @old_paths[object_name]
+            end
+            Chef::Config.chef_repo_path = @old_chef_repo_path
+            FileUtils.remove_entry_secure(@repository_dir)
+          ensure
+            @old_chef_repo_path = nil
+            @old_paths = nil
+            @repository_dir = nil
+          end
+        end
+      end
+
+      def directory(relative_path, &block)
+        old_parent_path = @parent_path
+        @parent_path = path_to(relative_path)
+        FileUtils.mkdir_p(@parent_path)
+        instance_eval(&block) if block
+        @parent_path = old_parent_path
+      end
+
+      def file(relative_path, contents)
+        filename = path_to(relative_path)
+        dir = File.dirname(filename)
+        FileUtils.mkdir_p(dir) unless dir == '.'
+        File.open(filename, 'w') do |file|
+          raw = case contents
+                when Hash
+                  JSON.pretty_generate(contents)
+                when Array
+                  contents.join("\n")
+                else
+                  contents
+                end
+          file.write(raw)
+        end
+      end
+
+      def symlink(relative_path, relative_dest)
+        filename = path_to(relative_path)
+        dir = File.dirname(filename)
+        FileUtils.mkdir_p(dir) unless dir == '.'
+        dest_filename = path_to(relative_dest)
+        File.symlink(dest_filename, filename)
+      end
+
+      def path_to(relative_path)
+        File.expand_path(relative_path, (@parent_path || @repository_dir))
+      end
+
+      def self.path_to(relative_path)
+        File.expand_path(relative_path, (@parent_path || @repository_dir))
+      end
+
+      def self.directory(relative_path, &block)
+        before :each do
+          directory(relative_path, &block)
+        end
+      end
+
+      def self.file(relative_path, contents)
+        before :each do
+          file(relative_path, contents)
+        end
+      end
+
+      def self.symlink(relative_path, relative_dest)
+        before :each do
+          symlink(relative_path, relative_dest)
+        end
+      end
+
+      def self.cwd(relative_path)
+        before :each do
+          @old_cwd = Dir.pwd
+          Dir.chdir(path_to(relative_path))
+        end
+        after :each do
+          Dir.chdir(@old_cwd)
+        end
+      end
+
+      instance_eval(&block)
+    end
+  end
+
+  # Versioned cookbooks
+
+  def with_versioned_cookbooks(_metadata = {}, &block)
+    _m = { :versioned_cookbooks => true }.merge(_metadata)
+    context 'with versioned cookbooks', _m do
+      before(:each) { Chef::Config[:versioned_cookbooks] = true }
+      after(:each)  { Chef::Config[:versioned_cookbooks] = false }
+      instance_eval(&block)
+    end
+  end
+
+  def without_versioned_cookbooks(_metadata = {}, &block)
+    _m = { :versioned_cookbooks => false }.merge(_metadata)
+    context 'with versioned cookbooks', _m do
+      # Just make sure this goes back to default
+      before(:each) { Chef::Config[:versioned_cookbooks] = false }
+      instance_eval(&block)
+    end
+  end
+end