chef 12.0.3 → 12.1.0.rc.0

data/lib/chef/shell/ext.rb

@@ -211,8 +211,8 @@ E
       def version
         puts  "This is the chef-shell.\n" +
               " Chef Version: #{::Chef::VERSION}\n" +
-              " http://www.opscode.com/chef\n" +
-              " http://docs.opscode.com/"
+              " http://www.chef.io/\n" +
+              " http://docs.chef.io/"
         :ucanhaz_automation
       end
       alias :shell :version

data/lib/chef/util/diff.rb

@@ -176,10 +176,7 @@ class Chef
       end
 
       def encode_diff_for_json(diff_str)
-        if Object.const_defined? :Encoding
-          diff_str.encode!('UTF-8', :invalid => :replace, :undef => :replace, :replace => '?')
-        end
-        return diff_str
+        diff_str.encode!('UTF-8', :invalid => :replace, :undef => :replace, :replace => '?')
       end
 
     end

data/lib/chef/util/dsc/configuration_generator.rb

@@ -25,9 +25,9 @@ class Chef::Util::DSC
       @config_directory = config_directory
     end
 
-    def configuration_document_from_script_code(code, configuration_flags, shellout_flags)
+    def configuration_document_from_script_code(code, configuration_flags, imports, shellout_flags)
       Chef::Log.debug("DSC: DSC code:\n '#{code}'")
-      generated_script_path = write_document_generation_script(code, 'chef_dsc')
+      generated_script_path = write_document_generation_script(code, 'chef_dsc', imports)
       begin
         configuration_document_from_script_path(generated_script_path, 'chef_dsc', configuration_flags, shellout_flags)
       ensure
@@ -80,18 +80,42 @@ class Chef::Util::DSC
       merged_configuration_flags
     end
 
-    def configuration_code(code, configuration_name)
-      "$ProgressPreference = 'SilentlyContinue';Configuration '#{configuration_name}'\n{\n\tnode 'localhost'\n{\n\t#{code}\n}}\n"
+    def configuration_code(code, configuration_name, imports)
+      <<-EOF
+$ProgressPreference = 'SilentlyContinue';
+Configuration '#{configuration_name}'
+{
+  #{generate_import_resource_statements(imports).join("  \n")}
+  node 'localhost'
+  {
+    #{code}
+  }
+}
+      EOF
+    end
+
+    def generate_import_resource_statements(imports)
+      if imports
+        imports.map do |resource_module, resources|
+          if resources.length == 0 || resources.include?('*')
+            "Import-DscResource -ModuleName #{resource_module}"
+          else
+            "Import-DscResource -ModuleName #{resource_module} -Name #{resources.join(',')}"
+          end
+        end
+      else
+        []
+      end
     end
 
     def configuration_document_generation_code(configuration_script, configuration_name)
       ". '#{configuration_script}';#{configuration_name}"
     end
 
-    def write_document_generation_script(code, configuration_name)
+    def write_document_generation_script(code, configuration_name, imports)
       script_path = "#{@config_directory}/chef_dsc_config.ps1"
       ::File.open(script_path, 'wt') do | script |
-        script.write(configuration_code(code, configuration_name))
+        script.write(configuration_code(code, configuration_name, imports))
       end
       script_path
     end

data/lib/chef/util/dsc/lcm_output_parser.rb

@@ -18,6 +18,7 @@
 
 require 'chef/log'
 require 'chef/util/dsc/resource_info'
+require 'chef/exceptions'
 
 class Chef
   class Util
@@ -53,8 +54,7 @@ class Chef
           #   ]
           #
           def self.parse(lcm_output)
-            return [] unless lcm_output
-
+            lcm_output ||= ""
             current_resource = Hash.new
 
             resources = []
@@ -96,7 +96,11 @@ class Chef
               resources.push(current_resource)
             end
 
-            build_resource_info(resources)
+            if resources.length > 0
+              build_resource_info(resources)
+            else
+              raise Chef::Exceptions::LCMParser, "Could not parse:\n#{lcm_output}"
+            end
           end
 
           def self.parse_line(line)

data/lib/chef/util/dsc/local_configuration_manager.rb

@@ -27,14 +27,14 @@ class Chef::Util::DSC
       clear_execution_time
     end
 
-    def test_configuration(configuration_document)
-      status = run_configuration_cmdlet(configuration_document)
+    def test_configuration(configuration_document, shellout_flags)
+      status = run_configuration_cmdlet(configuration_document, false, shellout_flags)
       log_what_if_exception(status.stderr) unless status.succeeded?
       configuration_update_required?(status.return_value)
     end
 
-    def set_configuration(configuration_document)
-      run_configuration_cmdlet(configuration_document, true)
+    def set_configuration(configuration_document, shellout_flags)
+      run_configuration_cmdlet(configuration_document, true, shellout_flags)
     end
 
     def last_operation_execution_time_seconds
@@ -45,7 +45,7 @@ class Chef::Util::DSC
 
     private
 
-    def run_configuration_cmdlet(configuration_document, apply_configuration = false)
+    def run_configuration_cmdlet(configuration_document, apply_configuration, shellout_flags)
       Chef::Log.debug("DSC: Calling DSC Local Config Manager to #{apply_configuration ? "set" : "test"} configuration document.")
       test_only_parameters = ! apply_configuration ? '-whatif; if (! $?) { exit 1 }' : ''
 
@@ -57,9 +57,9 @@ class Chef::Util::DSC
         save_configuration_document(configuration_document)
         cmdlet = ::Chef::Util::Powershell::Cmdlet.new(@node, "#{command_code}")
         if apply_configuration
-          status = cmdlet.run!
+          status = cmdlet.run!({}, shellout_flags)
         else
-          status = cmdlet.run
+          status = cmdlet.run({}, shellout_flags)
         end
       ensure
         end_operation_timing
@@ -103,7 +103,7 @@ EOH
       Chef::Log.debug("DSC: DSC returned the following '-whatif' output from test operation:\n#{what_if_output}")
       begin
         Parser::parse(what_if_output)
-      rescue Chef::Util::DSC::LocalConfigurationManager::Parser => e
+      rescue Chef::Exceptions::LCMParser => e
         Chef::Log::warn("Could not parse LCM output: #{e}")
         [Chef::Util::DSC::ResourceInfo.new('Unknown DSC Resources', true, ['Unknown changes because LCM output was not parsable.'])]
       end

data/lib/chef/util/file_edit.rb

@@ -47,7 +47,7 @@ class Chef
       end
 
       #search the file line by line and match each line with the given regex
-      #if matched, replace the match (all occurances)  with the replace parameter
+      #if matched, replace the match (all occurrences)  with the replace parameter
       def search_file_replace(regex, replace)
         @changes = (editor.replace(regex, replace) > 0) || @changes
       end
@@ -59,7 +59,7 @@ class Chef
       end
 
       #search the file line by line and match each line with the given regex
-      #if matched, delete the match (all occurances) from the line
+      #if matched, delete the match (all occurrences) from the line
       def search_file_delete(regex)
         search_file_replace(regex, '')
       end

data/lib/chef/util/path_helper.rb

@@ -26,7 +26,7 @@ class Chef
         if Chef::Platform.windows?
           # Find the first slash, not counting trailing slashes
           end_slash = path.size
-          while true
+          loop do
             slash = path.rindex(/[#{Regexp.escape(File::SEPARATOR)}#{Regexp.escape(path_separator)}]/, end_slash - 1)
             if !slash
               return end_slash == path.size ? '.' : path_separator
@@ -101,9 +101,6 @@ class Chef
 
       # Produces a comparable path.
       def self.canonical_path(path, add_prefix=true)
-        # Rather than find an equivalent for File.absolute_path on 1.8.7, just bail out
-        raise NotImplementedError, "This feature is not supported on Ruby versions < 1.9" if RUBY_VERSION.to_f < 1.9
-
         # First remove extra separators and resolve any relative paths
         abs_path = File.absolute_path(path)
 

data/lib/chef/util/windows/net_use.rb

@@ -46,9 +46,9 @@ class Chef::Util::Windows::NetUse < Chef::Util::Windows
     USE_INFO_2.collect { |field| field[1].class == Fixnum ? 'i' : 'L' }.join
 
   SIZEOF_USE_INFO_2 = #sizeof(USE_INFO_2)
-    USE_INFO_2.inject(0){|sum,item|
-    sum + (item[1].class == Fixnum ? 4 : PTR_SIZE)
-  }
+    USE_INFO_2.inject(0) do |sum, item|
+      sum + (item[1].class == Fixnum ? 4 : PTR_SIZE)
+    end
 
   def use_info_2(args)
     USE_INFO_2.collect { |field|

data/lib/chef/version.rb

@@ -17,7 +17,7 @@
 
 class Chef
   CHEF_ROOT = File.dirname(File.expand_path(File.dirname(__FILE__)))
-  VERSION = '12.0.3'
+  VERSION = '12.1.0.rc.0'
 end
 
 #

data/lib/chef/win32/api.rb

@@ -159,6 +159,7 @@ class Chef
         host.typedef :pointer, :PDWORD32 # Pointer to a DWORD32.
         host.typedef :pointer, :PDWORD64 # Pointer to a DWORD64.
         host.typedef :pointer, :PFLOAT # Pointer to a FLOAT.
+        host.typedef :pointer, :PGENERICMAPPING #Pointer to GENERIC_MAPPING
         host.typedef :pointer, :PHALF_PTR # Pointer to a HALF_PTR.
         host.typedef :pointer, :PHANDLE # Pointer to a HANDLE.
         host.typedef :pointer, :PHKEY # Pointer to an HKEY.

data/lib/chef/win32/api/security.rb

@@ -270,6 +270,15 @@ class Chef
              :MaxTokenInfoClass
         ]
 
+        # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379572%28v=vs.85%29.aspx
+        SECURITY_IMPERSONATION_LEVEL = enum :SECURITY_IMPERSONATION_LEVEL, [
+             :SecurityAnonymous,
+             :SecurityIdentification,
+             :SecurityImpersonation,
+             :SecurityDelegation
+        ]
+
+
         # SECURITY_DESCRIPTOR is an opaque structure whose contents can vary.  Pass the
         # pointer around and free it with LocalFree.
         # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
@@ -320,6 +329,19 @@ class Chef
                  :Attributes, :DWORD
         end
 
+        class GENERIC_MAPPING < FFI::Struct
+          layout :GenericRead, :DWORD,
+            :GenericWrite, :DWORD,
+            :GenericExecute, :DWORD,
+            :GenericAll, :DWORD
+        end
+
+        class PRIVILEGE_SET < FFI::Struct
+          layout :PrivilegeCount, :DWORD,
+                 :Control, :DWORD,
+                 :Privilege, [LUID_AND_ATTRIBUTES, 1]
+        end
+
         class TOKEN_PRIVILEGES < FFI::Struct
           layout :PrivilegeCount, :DWORD,
                  :Privileges, LUID_AND_ATTRIBUTES
@@ -339,6 +361,7 @@ class Chef
 
         ffi_lib "advapi32"
 
+        safe_attach_function :AccessCheck, [:pointer, :HANDLE, :DWORD, :pointer, :pointer, :pointer, :pointer, :pointer], :BOOL
         safe_attach_function :AddAce, [ :pointer, :DWORD, :DWORD, :LPVOID, :DWORD ], :BOOL
         safe_attach_function :AddAccessAllowedAce, [ :pointer, :DWORD, :DWORD, :pointer ], :BOOL
         safe_attach_function :AddAccessAllowedAceEx, [ :pointer, :DWORD, :DWORD, :DWORD, :pointer ], :BOOL
@@ -348,9 +371,11 @@ class Chef
         safe_attach_function :ConvertSidToStringSidA, [ :pointer, :pointer ], :BOOL
         safe_attach_function :ConvertStringSidToSidW, [ :pointer, :pointer ], :BOOL
         safe_attach_function :DeleteAce, [ :pointer, :DWORD ], :BOOL
+        safe_attach_function :DuplicateToken, [:HANDLE, :SECURITY_IMPERSONATION_LEVEL, :PHANDLE], :BOOL
         safe_attach_function :EqualSid, [ :pointer, :pointer ], :BOOL
         safe_attach_function :FreeSid, [ :pointer ], :pointer
         safe_attach_function :GetAce, [ :pointer, :DWORD, :pointer ], :BOOL
+        safe_attach_function :GetFileSecurityW, [:LPCWSTR, :DWORD, :pointer, :DWORD, :pointer], :BOOL
         safe_attach_function :GetLengthSid, [ :pointer ], :DWORD
         safe_attach_function :GetNamedSecurityInfoW,  [ :LPWSTR, :SE_OBJECT_TYPE, :DWORD, :pointer, :pointer, :pointer, :pointer, :pointer ], :DWORD
         safe_attach_function :GetSecurityDescriptorControl, [ :pointer, :PWORD, :LPDWORD], :BOOL
@@ -369,6 +394,7 @@ class Chef
         safe_attach_function :LookupPrivilegeDisplayNameW, [ :LPCWSTR, :LPCWSTR, :LPWSTR, :LPDWORD, :LPDWORD ], :BOOL
         safe_attach_function :LookupPrivilegeValueW, [ :LPCWSTR, :LPCWSTR, :PLUID ], :BOOL
         safe_attach_function :MakeAbsoluteSD, [ :pointer, :pointer, :LPDWORD, :pointer, :LPDWORD, :pointer, :LPDWORD, :pointer, :LPDWORD, :pointer, :LPDWORD], :BOOL
+        safe_attach_function :MapGenericMask, [ :PDWORD, :PGENERICMAPPING ], :void
         safe_attach_function :OpenProcessToken, [ :HANDLE, :DWORD, :PHANDLE ], :BOOL
         safe_attach_function :QuerySecurityAccessMask, [ :DWORD, :LPDWORD ], :void
         safe_attach_function :SetFileSecurityW, [ :LPWSTR, :DWORD, :pointer ], :BOOL

data/lib/chef/win32/file.rb

@@ -155,6 +155,27 @@ class Chef
         end
       end
 
+      def self.file_access_check(path, desired_access)
+        security_descriptor = Chef::ReservedNames::Win32::Security.get_file_security(path)
+        token_rights = Chef::ReservedNames::Win32::Security::TOKEN_IMPERSONATE | 
+                       Chef::ReservedNames::Win32::Security::TOKEN_QUERY |
+                       Chef::ReservedNames::Win32::Security::TOKEN_DUPLICATE | 
+                       Chef::ReservedNames::Win32::Security::STANDARD_RIGHTS_READ
+        token = Chef::ReservedNames::Win32::Security.open_process_token(
+          Chef::ReservedNames::Win32::Process.get_current_process,
+          token_rights)
+        duplicate_token = token.duplicate_token(:SecurityImpersonation)
+
+        mapping = Chef::ReservedNames::Win32::Security::GENERIC_MAPPING.new
+        mapping[:GenericRead] = Chef::ReservedNames::Win32::Security::FILE_GENERIC_READ
+        mapping[:GenericWrite] = Chef::ReservedNames::Win32::Security::FILE_GENERIC_WRITE
+        mapping[:GenericExecute] = Chef::ReservedNames::Win32::Security::FILE_GENERIC_EXECUTE
+        mapping[:GenericAll] = Chef::ReservedNames::Win32::Security::FILE_ALL_ACCESS
+
+        Chef::ReservedNames::Win32::Security.access_check(security_descriptor, duplicate_token, 
+                                                          desired_access, mapping)
+      end
+
       # ::File compat
       class << self
         alias :stat :info

data/lib/chef/win32/security.rb

@@ -32,6 +32,34 @@ class Chef
       extend Chef::ReservedNames::Win32::API::Security
       extend Chef::ReservedNames::Win32::API::Macros
 
+      def self.access_check(security_descriptor, token, desired_access, generic_mapping)
+        token_handle = token.handle.handle
+        security_descriptor_ptr = security_descriptor.pointer
+
+        rights_ptr = FFI::MemoryPointer.new(:ulong)
+        rights_ptr.write_ulong(desired_access)
+
+        # This function takes care of calling MapGenericMask, so you don't have to
+        MapGenericMask(rights_ptr, generic_mapping)
+
+        result_ptr = FFI::MemoryPointer.new(:ulong)
+
+        # Because optional actually means required
+        privileges = PRIVILEGE_SET.new
+        privileges[:PrivilegeCount] = 0
+        privileges_length_ptr = FFI::MemoryPointer.new(:ulong)
+        privileges_length_ptr.write_ulong(privileges.size)
+
+        granted_access_ptr = FFI::MemoryPointer.new(:ulong)
+
+        unless AccessCheck(security_descriptor_ptr, token_handle, rights_ptr.read_ulong,
+                           generic_mapping, privileges, privileges_length_ptr, granted_access_ptr,
+                           result_ptr)
+          Chef::ReservedNames::Win32::Error.raise!
+        end
+        result_ptr.read_ulong == 1
+      end
+
       def self.add_ace(acl, ace, insert_position = MAXDWORD, revision = ACL_REVISION)
         acl = acl.pointer if acl.respond_to?(:pointer)
         ace = ace.pointer if ace.respond_to?(:pointer)
@@ -148,6 +176,24 @@ class Chef
         GetLengthSid(sid)
       end
 
+      def self.get_file_security(path, info = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION)
+        size_ptr = FFI::MemoryPointer.new(:ulong)
+
+        success = GetFileSecurityW(path.to_wstring, info, nil, 0, size_ptr)
+
+        if !success && FFI::LastError.error != ERROR_INSUFFICIENT_BUFFER
+          Chef::ReservedNames::Win32::Error.raise!
+        end
+
+        security_descriptor_ptr = FFI::MemoryPointer.new(size_ptr.read_ulong)
+        unless GetFileSecurityW(path.to_wstring, info, security_descriptor_ptr, size_ptr.read_ulong, size_ptr)
+          Chef::ReservedNames::Win32::Error.raise!
+        end
+
+        SecurityDescriptor.new(security_descriptor_ptr)
+      end
+
+
       def self.get_named_security_info(path, type = :SE_FILE_OBJECT, info = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION)
         security_descriptor = FFI::MemoryPointer.new :pointer
         hr = GetNamedSecurityInfoW(path.to_wstring, type, info, nil, nil, nil, nil, security_descriptor)

data/lib/chef/win32/security/token.rb

@@ -58,6 +58,14 @@ class Chef
             Chef::ReservedNames::Win32::Security::adjust_token_privileges(self, privileges_struct)
           end
         end
+
+        def duplicate_token(security_impersonation_level)
+          duplicate_token_handle = FFI::Buffer.new(:ulong)
+          unless Chef::ReservedNames::Win32::API::Security.DuplicateToken(handle.handle, security_impersonation_level, duplicate_token_handle)
+            raise Chef::ReservedNames::Win32::Error.raise!
+          end
+          Token.new(Handle.new(duplicate_token_handle.read_ulong))
+        end
       end
     end
   end

data/lib/chef/win32/version.rb

@@ -126,14 +126,10 @@ class Chef
         # https://github.com/ruby/ruby/commit/588504b20f5cc880ad51827b93e571e32446e5db
         # https://github.com/ruby/ruby/commit/27ed294c7134c0de582007af3c915a635a6506cd
 
-        WIN32OLE.ole_initialize
-
         wmi = WmiLite::Wmi.new
         os_info = wmi.first_of('Win32_OperatingSystem')
         os_version = os_info['version']
 
-        WIN32OLE.ole_uninitialize
-
         # The operating system version is a string in the following form
         # that can be split into components based on the '.' delimiter:
         # MajorVersionNumber.MinorVersionNumber.BuildNumber

data/spec/functional/application_spec.rb

@@ -52,7 +52,7 @@ describe Chef::Application do
         shell_out("echo $http_proxy")
       end
 
-      so.stdout.chomp.should == "http://proxy.example.org:8080"
+      expect(so.stdout.chomp).to eq("http://proxy.example.org:8080")
     end
   end
 end

data/spec/functional/audit/rspec_formatter_spec.rb

@@ -0,0 +1,54 @@
+#
+# Author:: Tyler Ball (<tball@chef.io>)
+# Author:: Claire McQuin (<claire@getchef.com>)
+#
+# Copyright:: Copyright (c) 2014 Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'rspec/core/sandbox'
+require 'chef/audit/runner'
+require 'rspec/support/spec/in_sub_process'
+require 'rspec/support/spec/stderr_splitter'
+require 'chef/audit/rspec_formatter'
+
+describe Chef::Audit::RspecFormatter do
+  include RSpec::Support::InSubProcess
+
+  let(:events) { double("events").as_null_object }
+  let(:audits) { {} }
+  let(:run_context) { instance_double(Chef::RunContext, :events => events, :audits => audits) }
+  let(:runner) { Chef::Audit::Runner.new(run_context) }
+
+  let(:output) { double("output") }
+  # aggressively define this so we can mock out the new call later
+  let!(:formatter) { Chef::Audit::RspecFormatter.new(output) }
+
+  around(:each) do |ex|
+    RSpec::Core::Sandbox.sandboxed { ex.run }
+  end
+
+  it "should not close the output using our formatter" do
+    in_sub_process do
+      expect_any_instance_of(Chef::Audit::RspecFormatter).to receive(:new).and_return(formatter)
+      expect(formatter).to receive(:close).and_call_original
+      expect(output).to_not receive(:close)
+
+      runner.run
+    end
+  end
+
+end