chef 12.0.3-x86-mingw32 → 12.1.0.rc.0-x86-mingw32

data/lib/chef/provider/package/zypper.rb

@@ -38,24 +38,23 @@ class Chef
           version=''
           oud_version=''
           Chef::Log.debug("#{@new_resource} checking zypper")
-          status = popen4("zypper --non-interactive info #{@new_resource.package_name}") do |pid, stdin, stdout, stderr|
-            stdout.each do |line|
-              case line
-              when /^Version: (.+)$/
-                version = $1
-                Chef::Log.debug("#{@new_resource} version #{$1}")
-              when /^Installed: Yes$/
-                is_installed=true
-                Chef::Log.debug("#{@new_resource} is installed")
-
-              when /^Installed: No$/
-                is_installed=false
-                Chef::Log.debug("#{@new_resource} is not installed")
-              when /^Status: out-of-date \(version (.+) installed\)$/
-                is_out_of_date=true
-                oud_version=$1
-                Chef::Log.debug("#{@new_resource} out of date version #{$1}")
-              end
+          status = shell_out("zypper --non-interactive info #{@new_resource.package_name}")
+          status.stdout.each_line do |line|
+            case line
+            when /^Version: (.+)$/
+              version = $1
+              Chef::Log.debug("#{@new_resource} version #{$1}")
+            when /^Installed: Yes$/
+              is_installed=true
+              Chef::Log.debug("#{@new_resource} is installed")
+
+            when /^Installed: No$/
+              is_installed=false
+              Chef::Log.debug("#{@new_resource} is not installed")
+            when /^Status: out-of-date \(version (.+) installed\)$/
+              is_out_of_date=true
+              oud_version=$1
+              Chef::Log.debug("#{@new_resource} out of date version #{$1}")
             end
           end
 

data/lib/chef/provider/powershell_script.rb

@@ -24,8 +24,8 @@ class Chef
 
       protected
       EXIT_STATUS_EXCEPTION_HANDLER = "\ntrap [Exception] {write-error -exception ($_.Exception.Message);exit 1}".freeze
-      EXIT_STATUS_NORMALIZATION_SCRIPT = "\nif ($? -ne $true) { if ( $LASTEXITCODE -ne 0) {exit $LASTEXITCODE} else { exit 1 }}".freeze
-      EXIT_STATUS_RESET_SCRIPT = "\n$LASTEXITCODE=0".freeze
+      EXIT_STATUS_NORMALIZATION_SCRIPT = "\nif ($? -ne $true) { if ( $LASTEXITCODE ) {exit $LASTEXITCODE} else { exit 1 }}".freeze
+      EXIT_STATUS_RESET_SCRIPT = "\n$global:LASTEXITCODE=$null".freeze
 
       # Process exit codes are strange with PowerShell. Unless you
       # explicitly call exit in Powershell, the powershell.exe
@@ -43,7 +43,7 @@ class Chef
                         code.to_s +
                         EXIT_STATUS_NORMALIZATION_SCRIPT )
         convert_boolean_return = @new_resource.convert_boolean_return
-        @code = <<EOH
+        self.code = <<EOH
 new-variable -name interpolatedexitcode -visibility private -value $#{convert_boolean_return}
 new-variable -name chefscriptresult -visibility private
 $chefscriptresult = {
@@ -52,7 +52,7 @@ $chefscriptresult = {
 if ($interpolatedexitcode -and $chefscriptresult.gettype().name -eq 'boolean') { exit [int32](!$chefscriptresult) } else { exit 0 }
 EOH
         Chef::Log.debug("powershell_script provider called with script code:\n\n#{code}\n")
-        Chef::Log.debug("powershell_script provider will execute transformed code:\n\n#{@code}\n")
+        Chef::Log.debug("powershell_script provider will execute transformed code:\n\n#{self.code}\n")
       end
 
       public

data/lib/chef/provider/registry_key.rb

@@ -60,9 +60,9 @@ class Chef
         @registry ||= Chef::Win32::Registry.new(@run_context, @new_resource.architecture)
       end
 
-     def values_to_hash(values)
+      def values_to_hash(values)
         if values
-         @name_hash = Hash[values.map { |val| [val[:name], val] }]
+          @name_hash = Hash[values.map { |val| [val[:name], val] }]
         else
           @name_hash = {}
         end

data/lib/chef/provider/remote_directory.rb

@@ -44,7 +44,7 @@ class Chef
         # Transfer files
         files_to_transfer.each do |cookbook_file_relative_path|
           create_cookbook_file(cookbook_file_relative_path)
-          # parent directories and file being transfered are removed from the purge list
+          # parent directories and file being transferred are removed from the purge list
           Pathname.new(Chef::Util::PathHelper.cleanpath(::File.join(@new_resource.path, cookbook_file_relative_path))).descend do |d|
             files_to_purge.delete(d.to_s)
           end

data/lib/chef/provider/script.rb

@@ -18,10 +18,13 @@
 
 require 'tempfile'
 require 'chef/provider/execute'
+require 'forwardable'
 
 class Chef
   class Provider
     class Script < Chef::Provider::Execute
+      extend Forwardable
+
       provides :bash
       provides :csh
       provides :perl
@@ -29,30 +32,43 @@ class Chef
       provides :ruby
       provides :script
 
+      def_delegators :@new_resource, :interpreter, :flags
+
+      attr_accessor :code
+
       def initialize(new_resource, run_context)
         super
-        @code = @new_resource.code
+        self.code = new_resource.code
+      end
+
+      def command
+        "\"#{interpreter}\" #{flags} \"#{script_file.path}\""
+      end
+
+      def load_current_resource
+        super
+        # @todo Chef-13: change this to an exception
+        if code.nil?
+          Chef::Log.warn "#{@new_resource}: No code attribute was given, resource does nothing, this behavior is deprecated and will be removed in Chef-13"
+        end
       end
 
       def action_run
-        script_file.puts(@code)
+        script_file.puts(code)
         script_file.close
 
         set_owner_and_group
 
-        @new_resource.command("\"#{interpreter}\" #{flags} \"#{script_file.path}\"")
         super
-        converge_by(nil) do
-          # ensure script is unlinked at end of converge!
-          unlink_script_file
-        end
+
+        unlink_script_file
       end
 
       def set_owner_and_group
         # FileUtils itself implements a no-op if +user+ or +group+ are nil
         # You can prove this by running FileUtils.chown(nil,nil,'/tmp/file')
         # as an unprivileged user.
-        FileUtils.chown(@new_resource.user, @new_resource.group, script_file.path)
+        FileUtils.chown(new_resource.user, new_resource.group, script_file.path)
       end
 
       def script_file
@@ -60,16 +76,9 @@ class Chef
       end
 
       def unlink_script_file
-        @script_file && @script_file.close!
+        script_file && script_file.close!
       end
 
-      def interpreter
-        @new_resource.interpreter
-      end
-
-      def flags
-        @new_resource.flags
-      end
     end
   end
 end

data/lib/chef/provider/service.rb

@@ -150,7 +150,7 @@ class Chef
       end
 
       def reload_service
-        raise Chef::Exceptions::UnsupportedAction, "#{self.to_s} does not support :restart"
+        raise Chef::Exceptions::UnsupportedAction, "#{self.to_s} does not support :reload"
       end
 
       protected

data/lib/chef/provider/service/freebsd.rb

@@ -180,7 +180,7 @@ class Chef
         def set_service_enable(value)
           lines = read_rc_conf
           # Remove line that set the old value
-          lines.delete_if { |line| line =~ /^#{Regexp.escape(service_enable_variable_name)}=/ }
+          lines.delete_if { |line| line =~ /^\#?\s*#{Regexp.escape(service_enable_variable_name)}=/ }
           # And append the line that sets the new value at the end
           lines << "#{service_enable_variable_name}=\"#{value}\""
           write_rc_conf(lines)

data/lib/chef/provider/service/openbsd.rb

@@ -0,0 +1,216 @@
+#
+# Author:: Scott Bonds (<scott@ggr.com>)
+# Copyright:: Copyright (c) 2014 Scott Bonds
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef/mixin/command'
+require 'chef/mixin/shell_out'
+require 'chef/provider/service/init'
+require 'chef/resource/service'
+
+class Chef
+  class Provider
+    class Service
+      class Openbsd < Chef::Provider::Service::Init
+
+        provides :service, os: [ "openbsd" ]
+
+        include Chef::Mixin::ShellOut
+
+        attr_reader :init_command, :rc_conf, :rc_conf_local, :enabled_state_found
+
+        RC_CONF_PATH = '/etc/rc.conf'
+        RC_CONF_LOCAL_PATH = '/etc/rc.conf.local'
+
+        def initialize(new_resource, run_context)
+          super
+          @rc_conf = ::File.read(RC_CONF_PATH) rescue ''
+          @rc_conf_local = ::File.read(RC_CONF_LOCAL_PATH) rescue ''
+          @init_command = ::File.exist?(rcd_script_path) ? rcd_script_path : nil
+          new_resource.supports[:status] = true
+          new_resource.status_command("#{default_init_command} check")
+        end
+
+        def load_current_resource
+          @current_resource = Chef::Resource::Service.new(new_resource.name)
+          current_resource.service_name(new_resource.service_name)
+
+          Chef::Log.debug("#{current_resource} found at #{init_command}")
+
+          determine_current_status!
+          determine_enabled_status!
+          current_resource
+        end
+
+        def define_resource_requirements
+          shared_resource_requirements
+
+          requirements.assert(:start, :enable, :reload, :restart) do |a|
+            a.assertion { init_command }
+            a.failure_message Chef::Exceptions::Service, "#{new_resource}: unable to locate the rc.d script"
+          end
+
+          requirements.assert(:all_actions) do |a|
+            a.assertion { enabled_state_found }
+            # for consistency with original behavior, this will not fail in non-whyrun mode;
+            # rather it will silently set enabled state=>false
+            a.whyrun "Unable to determine enabled/disabled state, assuming this will be correct for an actual run.  Assuming disabled."
+          end
+
+          requirements.assert(:start, :enable, :reload, :restart) do |a|
+            a.assertion { init_command && builtin_service_enable_variable_name != nil }
+            a.failure_message Chef::Exceptions::Service, "Could not find the service name in #{init_command} and rcvar"
+            # No recovery in whyrun mode - the init file is present but not correct.
+          end
+        end
+
+        def enable_service
+          if !is_enabled?
+            if is_builtin?
+              if is_enabled_by_default?
+                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, '')
+              else
+                # add line with blank string, which means enable
+                update_rcl rc_conf_local + "\n" + "#{builtin_service_enable_variable_name}=\"\"\n"
+              end
+            else
+              # add to pkg_scripts, most recent addition goes last
+              old_services_list = rc_conf_local.match(/^pkg_scripts="(.*)"/)
+              old_services_list = old_services_list ? old_services_list[1].split(' ') : []
+              new_services_list = old_services_list + [new_resource.service_name]
+              if rc_conf_local.match(/^pkg_scripts="(.*)"/)
+                new_rcl = rc_conf_local.sub(/^pkg_scripts="(.*)"/, "pkg_scripts=\"#{new_services_list.join(' ')}\"")
+              else
+                new_rcl = rc_conf_local + "\n" + "pkg_scripts=\"#{new_services_list.join(' ')}\"\n"
+              end
+              update_rcl new_rcl
+            end
+          end
+        end
+
+        def disable_service
+          if is_enabled?
+            if is_builtin?
+              if is_enabled_by_default?
+                # add line to disable
+                update_rcl rc_conf_local + "\n" + "#{builtin_service_enable_variable_name}=\"NO\"\n"
+              else
+                # remove line to disable
+                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, '')
+              end
+            else
+              # remove from pkg_scripts
+              old_list = rc_conf_local.match(/^pkg_scripts="(.*)"/)
+              old_list = old_list ? old_list[1].split(' ') : []
+              new_list = old_list - [new_resource.service_name]
+              update_rcl rc_conf_local.sub(/^pkg_scripts="(.*)"/, pkg_scripts="#{new_list.join(' ')}")
+            end
+          end
+        end
+
+        private
+
+        def rcd_script_found?
+          !init_command.nil?
+        end
+
+        def rcd_script_path
+          "/etc/rc.d/#{new_resource.service_name}"
+        end
+
+        def update_rcl(value)
+          FileUtils.touch RC_CONF_LOCAL_PATH if !::File.exists? RC_CONF_LOCAL_PATH
+          ::File.write(RC_CONF_LOCAL_PATH, value)
+          @rc_conf_local = value
+        end
+
+        # The variable name used in /etc/rc.conf.local for enabling this service
+        def builtin_service_enable_variable_name
+          @bsevn ||= begin
+            result = nil
+            if rcd_script_found?
+              ::File.open(init_command) do |rcscript|
+                if m = rcscript.read.match(/^# \$OpenBSD: (\w+)[(.rc),]?/)
+                  result = m[1] + "_flags"
+                end
+              end
+            end
+            # Fallback allows us to keep running in whyrun mode when
+            # the script does not exist.
+            result || new_resource.service_name
+          end
+        end
+
+        def is_builtin?
+          result = false
+          var_name = builtin_service_enable_variable_name
+          if var_name
+            if rc_conf.match(/^#{Regexp.escape(var_name)}=(.*)/)
+              result = true
+            end
+          end
+          result
+        end
+
+        def is_enabled_by_default?
+          result = false
+          var_name = builtin_service_enable_variable_name
+          if var_name
+            if m = rc_conf.match(/^#{Regexp.escape(var_name)}=(.*)/)
+              if !(m[1] =~ /"?[Nn][Oo]"?/)
+                result = true
+              end
+            end
+          end
+          result
+        end
+
+        def determine_enabled_status!
+          result = false # Default to disabled if the service doesn't currently exist at all
+          @enabled_state_found = false
+          if is_builtin?
+            var_name = builtin_service_enable_variable_name
+            if var_name
+              if m = rc_conf_local.match(/^#{Regexp.escape(var_name)}=(.*)/)
+                @enabled_state_found = true
+                if !(m[1] =~ /"?[Nn][Oo]"?/) # e.g. looking for httpd_flags=NO
+                  result = true
+                end
+              end
+            end
+            if !@enabled_state_found
+              result = is_enabled_by_default?
+            end
+          else
+            var_name = @new_resource.service_name
+            if var_name
+              if m = rc_conf_local.match(/^pkg_scripts="(.*)"/)
+                @enabled_state_found = true
+                if m[1].include?(var_name) # e.g. looking for 'gdm' in pkg_scripts="gdm unbound"
+                  result = true
+                end
+              end
+            end
+          end
+
+          current_resource.enabled result
+        end
+        alias :is_enabled? :determine_enabled_status!
+
+      end
+    end
+  end
+end

data/lib/chef/provider/service/upstart.rb

@@ -41,7 +41,7 @@ class Chef
         # In chef, when we ask a service to start, we expect it to have started before performing the next step
         # since we have top down dependencies. Which is to say we may follow witha resource next that requires
         # that service to be running. According to [2] we can trust that sending a 'goal' such as start will not
-        # return until that 'goal' is reached, or some error has occured.
+        # return until that 'goal' is reached, or some error has occurred.
         #
         # [1] http://upstart.ubuntu.com/wiki/JobStates
         # [2] http://www.netsplit.com/2008/04/27/upstart-05-events/

data/lib/chef/provider/service/windows.rb

@@ -20,6 +20,7 @@
 
 require 'chef/provider/service/simple'
 if RUBY_PLATFORM =~ /mswin|mingw32|windows/
+  require 'chef/win32/error'
   require 'win32/service'
 end
 
@@ -29,6 +30,7 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
   provides :windows_service, os: "windows"
 
   include Chef::Mixin::ShellOut
+  include Chef::ReservedNames::Win32::API::Error rescue LoadError
 
   #Win32::Service.get_start_type
   AUTO_START = 'auto start'
@@ -67,6 +69,22 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
 
   def start_service
     if Win32::Service.exists?(@new_resource.service_name)
+      # reconfiguration is idempotent, so just do it.
+      new_config = {
+        service_name: @new_resource.service_name,
+        service_start_name: @new_resource.run_as_user,
+        password: @new_resource.run_as_password,
+      }.reject { |k,v| v.nil? || v.length == 0 }
+
+      Win32::Service.configure(new_config)
+      Chef::Log.info "#{@new_resource} configured with #{new_config.inspect}"
+
+      # it would be nice to check if the user already has the logon privilege, but that turns out to be
+      # nontrivial.
+      if new_config.has_key?(:service_start_name)
+        grant_service_logon(new_config[:service_start_name])
+      end
+
       state = current_state
       if state == RUNNING
         Chef::Log.debug "#{@new_resource} already started - nothing to do"
@@ -79,7 +97,17 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
           shell_out!(@new_resource.start_command)
         else
           spawn_command_thread do
-            Win32::Service.start(@new_resource.service_name)
+            begin
+              Win32::Service.start(@new_resource.service_name)
+            rescue SystemCallError => ex
+              if ex.errno == ERROR_SERVICE_LOGON_FAILED
+                Chef::Log.error ex.message
+                raise Chef::Exceptions::Service,
+                "Service #{@new_resource} did not start due to a logon failure (error #{ERROR_SERVICE_LOGON_FAILED}): possibly the specified user '#{@new_resource.run_as_user}' does not have the 'log on as a service' privilege, or the password is incorrect."
+              else
+                raise ex
+              end
+            end
           end
           wait_for_state(RUNNING)
         end
@@ -209,6 +237,76 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
   end
 
   private
+  def make_policy_text(username)
+    text = <<-EOS
+[Unicode]
+Unicode=yes
+[Privilege Rights]
+SeServiceLogonRight = \\\\#{canonicalize_username(username)},*S-1-5-80-0
+[Version]
+signature="$CHICAGO$"
+Revision=1
+EOS
+  end
+
+  def grant_logfile_name(username)
+    Chef::Util::PathHelper.canonical_path("#{Dir.tmpdir}/logon_grant-#{clean_username_for_path(username)}-#{$$}.log", prefix=false)
+  end
+
+  def grant_policyfile_name(username)
+    Chef::Util::PathHelper.canonical_path("#{Dir.tmpdir}/service_logon_policy-#{clean_username_for_path(username)}-#{$$}.inf", prefix=false)
+  end
+
+  def grant_dbfile_name(username)
+    "#{ENV['TEMP']}\\secedit.sdb"
+  end
+
+  def grant_service_logon(username)
+    logfile = grant_logfile_name(username)
+    policy_file = ::File.new(grant_policyfile_name(username), 'w')
+    policy_text = make_policy_text(username)
+    dbfile = grant_dbfile_name(username)        # this is just an audit file.
+
+    begin
+      Chef::Log.debug "Policy file text:\n#{policy_text}"
+      policy_file.puts(policy_text)
+      policy_file.close   # need to flush the buffer.
+
+      # it would be nice to do this with APIs instead, but the LSA_* APIs are
+      # particularly onerous and life is short.
+      cmd = %Q{secedit.exe /configure /db "#{dbfile}" /cfg "#{policy_file.path}" /areas USER_RIGHTS SECURITYPOLICY SERVICES /log "#{logfile}"}
+      Chef::Log.debug "Granting logon-as-service privilege with: #{cmd}"
+      runner = shell_out(cmd)
+
+      if runner.exitstatus != 0
+        Chef::Log.fatal "Logon-as-service grant failed with output: #{runner.stdout}"
+        raise Chef::Exceptions::Service, <<-EOS
+Logon-as-service grant failed with policy file #{policy_file.path}.
+You can look at #{logfile} for details, or do `secedit /analyze #{dbfile}`.
+The failed command was `#{cmd}`.
+EOS
+      end
+
+      Chef::Log.info "Grant logon-as-service to user '#{username}' successful."
+
+      ::File.delete(dbfile) rescue nil
+      ::File.delete(policy_file)
+      ::File.delete(logfile) rescue nil     # logfile is not always present at end.
+    end
+    true
+  end
+
+  # remove characters that make for broken or wonky filenames.
+  def clean_username_for_path(username)
+    username.gsub(/[\/\\. ]+/, '_')
+  end
+
+  # the security policy file only seems to accept \\username, so fix .\username or .\\username.
+  # TODO: this probably has to be fixed to handle various valid Windows names correctly.
+  def canonicalize_username(username)
+    username.sub(/^\.?\\+/, '')
+  end
+
   def current_state
     Win32::Service.status(@new_resource.service_name).current_state
   end