chef 12.19.36 → 14.14.25

data/spec/integration/solo/solo_spec.rb

@@ -23,23 +23,23 @@ describe "chef-solo" do
     let(:node_file) { Dir[File.join(nodes_dir, "*.json")][0] }
 
     before do
-      file "config/solo.rb", <<EOM
-chef_repo_path "#{@repository_dir}"
+      file "config/solo.rb", <<~EOM
+        chef_repo_path "#{@repository_dir}"
 EOM
-      result = shell_out("ruby bin/chef-solo -c \"#{path_to('config/solo.rb')}\" -l debug", :cwd => chef_dir)
+      result = shell_out("ruby bin/chef-solo -c \"#{path_to('config/solo.rb')}\" -l debug", cwd: chef_dir)
       result.error!
     end
 
     describe "on unix", :unix_only do
       describe "the nodes directory" do
         it "has the correct permissions" do
-          expect(File.stat(nodes_dir).mode.to_s(8)[2..5]).to eq("700")
+          expect(File.stat(nodes_dir).mode.to_s(8)[-3..-1]).to eq("700")
         end
       end
 
       describe "the node file" do
         it "has the correct permissions" do
-          expect(File.stat(node_file).mode.to_s(8)[2..5]).to eq("0600")
+          expect(File.stat(node_file).mode.to_s(8)[-4..-1]).to eq("0600")
         end
       end
     end
@@ -74,26 +74,26 @@ EOM
     end
 
     it "should complete with success" do
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
-      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", :cwd => chef_dir)
+      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", cwd: chef_dir)
       result.error!
       expect(result.stdout).to include("ITWORKS")
     end
 
     it "should evaluate its node.json file" do
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
 
-      file "config/node.json", <<-E
-{"run_list":["x::default"]}
+      file "config/node.json", <<~E
+        {"run_list":["x::default"]}
 E
 
-      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -j '#{path_to('config/node.json')}' -l debug", :cwd => chef_dir)
+      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -j '#{path_to('config/node.json')}' -l debug", cwd: chef_dir)
       result.error!
       expect(result.stdout).to include("ITWORKS")
     end
@@ -110,11 +110,11 @@ E
     end
 
     it "should exit with an error" do
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
-      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", :cwd => chef_dir)
+      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", cwd: chef_dir)
       expect(result.exitstatus).to eq(0) # For CHEF-5120 this becomes 1
       expect(result.stdout).to include("WARN: MissingCookbookDependency")
     end
@@ -124,14 +124,14 @@ EOM
     before do
       file "cookbooks/x/metadata.rb", cb_metadata("x", "1.0.0", "\nchef_version '~> 999.0'")
       file "cookbooks/x/recipes/default.rb", 'puts "ITWORKS"'
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
     end
 
     it "should exit with an error" do
-      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", :cwd => chef_dir)
+      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", cwd: chef_dir)
       expect(result.exitstatus).to eq(1)
       expect(result.stdout).to include("Chef::Exceptions::CookbookChefVersionMismatch")
     end
@@ -141,14 +141,14 @@ EOM
     before do
       file "cookbooks/x/metadata.rb", cb_metadata("x", "1.0.0", "\nohai_version '~> 999.0'")
       file "cookbooks/x/recipes/default.rb", 'puts "ITWORKS"'
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
     end
 
     it "should exit with an error" do
-      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", :cwd => chef_dir)
+      result = shell_out("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' -l debug", cwd: chef_dir)
       expect(result.exitstatus).to eq(1)
       expect(result.stdout).to include("Chef::Exceptions::CookbookOhaiVersionMismatch")
     end
@@ -159,23 +159,23 @@ EOM
       directory "logs"
       file "logs/runs.log", ""
       file "cookbooks/x/metadata.rb", cookbook_x_100_metadata_rb
-      file "cookbooks/x/recipes/default.rb", <<EOM
-ruby_block "sleeping" do
-  block do
-    retries = 200
-    while IO.read(Chef::Config[:log_location]) !~ /Chef client .* is running, will wait for it to finish and then run./
-      sleep 0.1
-      raise "we ran out of retries" if ( retries -= 1 ) <= 0
-    end
-  end
-end
+      file "cookbooks/x/recipes/default.rb", <<~EOM
+        ruby_block "sleeping" do
+          block do
+            retries = 200
+            while IO.read(Chef::Config[:log_location]) !~ /Chef client .* is running, will wait for it to finish and then run./
+              sleep 0.1
+              raise "we ran out of retries" if ( retries -= 1 ) <= 0
+            end
+          end
+        end
 EOM
     end
 
     it "while running solo concurrently" do
-      file "config/solo.rb", <<EOM
-cookbook_path "#{path_to('cookbooks')}"
-file_cache_path "#{path_to('config/cache')}"
+      file "config/solo.rb", <<~EOM
+        cookbook_path "#{path_to('cookbooks')}"
+        file_cache_path "#{path_to('config/cache')}"
 EOM
       # We have a timeout protection here so that if due to some bug
       # run_lock gets stuck we can discover it.
@@ -187,13 +187,13 @@ EOM
 
           # Instantiate the first chef-solo run
           threads << Thread.new do
-            s1 = Process.spawn("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default'  -l debug -L #{path_to('logs/runs.log')}", :chdir => chef_dir)
+            s1 = Process.spawn("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default'  -l debug -L #{path_to('logs/runs.log')}", chdir: chef_dir)
             Process.waitpid(s1)
           end
 
           # Instantiate the second chef-solo run
           threads << Thread.new do
-            s2 = Process.spawn("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default'  -l debug -L #{path_to('logs/runs.log')}", :chdir => chef_dir)
+            s2 = Process.spawn("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default'  -l debug -L #{path_to('logs/runs.log')}", chdir: chef_dir)
             Process.waitpid(s2)
           end
 

data/spec/scripts/ssl-serve.rb

@@ -20,26 +20,26 @@ key = OpenSSL::PKey::RSA.new(key_text)
 
 server_opts = {}
 if $ssl
-  server_opts.merge!( { :SSLEnable => true,
-                        :SSLVerifyClient => OpenSSL::SSL::VERIFY_NONE,
-                        :SSLCertificate => cert,
-                        :SSLPrivateKey => key })
+  server_opts.merge!( { SSLEnable: true,
+                        SSLVerifyClient: OpenSSL::SSL::VERIFY_NONE,
+                        SSLCertificate: cert,
+                        SSLPrivateKey: key })
 end
 
 # 5 == debug, 3 == warning
 LOGGER = WEBrick::Log.new(STDOUT, 5)
 DEFAULT_OPTIONS = {
-  :server => "webrick",
-  :Port => 9000,
-  :Host => "localhost",
-  :environment => :none,
-  :Logger => LOGGER,
-  :DocumentRoot => File.expand_path("#{Dir.tmpdir}/chef-118-sampledata")
+  server: "webrick",
+  Port: 9000,
+  Host: "localhost",
+  environment: :none,
+  Logger: LOGGER,
+  DocumentRoot: File.expand_path("#{Dir.tmpdir}/chef-118-sampledata")
   #:AccessLog => [] # Remove this option to enable the access log when debugging.
-}
+}.freeze
 
 webrick_opts = DEFAULT_OPTIONS.merge(server_opts)
-pp :webrick_opts => webrick_opts
+pp webrick_opts: webrick_opts
 
 server = WEBrick::HTTPServer.new(webrick_opts)
 trap("INT") { server.shutdown }

data/spec/spec_helper.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software, Inc.
+# Copyright:: Copyright 2008-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -30,6 +30,8 @@ $:.unshift File.expand_path("../..", __FILE__)
 require "rubygems"
 require "rspec/mocks"
 
+require "webmock/rspec"
+
 $:.unshift(File.join(File.dirname(__FILE__), "..", "lib"))
 $:.unshift(File.expand_path("../lib", __FILE__))
 $:.unshift(File.dirname(__FILE__))
@@ -48,10 +50,10 @@ end
 require "chef"
 require "chef/knife"
 
-Dir["lib/chef/knife/**/*.rb"].
-  map { |f| f.gsub("lib/", "") }.
-  map { |f| f.gsub(%r{\.rb$}, "") }.
-  each { |f| require f }
+Dir["lib/chef/knife/**/*.rb"]
+  .map { |f| f.gsub("lib/", "") }
+  .map { |f| f.gsub(%r{\.rb$}, "") }
+  .each { |f| require f }
 
 require "chef/resource_resolver"
 require "chef/provider_resolver"
@@ -70,6 +72,9 @@ require "chef/chef_fs/file_system_cache"
 
 require "chef/api_client_v1"
 
+require "chef/mixin/versioned_api"
+require "chef/server_api_versions"
+
 if ENV["CHEF_FIPS"] == "1"
   Chef::Config.init_openssl
 end
@@ -85,12 +90,12 @@ require "spec/support/shared/unit/mock_shellout"
 # Autoloads support files
 # Excludes support/platforms by default
 # Do not change the gsub.
-Dir["spec/support/**/*.rb"].
-  reject { |f| f =~ %r{^spec/support/platforms} }.
-  reject { |f| f =~ %r{^spec/support/pedant} }.
-  map { |f| f.gsub(%r{.rb$}, "") }.
-  map { |f| f.gsub(%r{spec/}, "") }.
-  each { |f| require f }
+Dir["spec/support/**/*.rb"]
+  .reject { |f| f =~ %r{^spec/support/platforms} }
+  .reject { |f| f =~ %r{^spec/support/pedant} }
+  .map { |f| f.gsub(%r{.rb$}, "") }
+  .map { |f| f.gsub(%r{spec/}, "") }
+  .each { |f| require f }
 
 OHAI_SYSTEM = Ohai::System.new
 OHAI_SYSTEM.all_plugins(["platform", "hostname", "languages/powershell"])
@@ -106,11 +111,16 @@ TEST_PLATFORM = TEST_NODE["platform"]
 TEST_PLATFORM_VERSION = TEST_NODE["platform_version"]
 TEST_PLATFORM_FAMILY = TEST_NODE["platform_family"]
 
+provider_priority_map ||= nil
+resource_priority_map ||= nil
+provider_handler_map ||= nil
+resource_handler_map ||= nil
+
 RSpec.configure do |config|
   config.include(Matchers)
   config.include(MockShellout::RSpec)
-  config.filter_run :focus => true
-  config.filter_run_excluding :external => true
+  config.filter_run focus: true
+  config.filter_run_excluding external: true
 
   # Explicitly disable :should syntax
   config.expect_with :rspec do |c|
@@ -124,70 +134,87 @@ RSpec.configure do |config|
   config.filter_run_excluding :workstation if solaris? || aix?
 
   # Tests that randomly fail, but may have value.
-  config.filter_run_excluding :volatile => true
-  config.filter_run_excluding :volatile_on_solaris => true if solaris?
-  config.filter_run_excluding :volatile_from_verify => false
-
-  config.filter_run_excluding :skip_appveyor => true if ENV["APPVEYOR"]
-  config.filter_run_excluding :appveyor_only => true unless ENV["APPVEYOR"]
-  config.filter_run_excluding :skip_travis => true if ENV["TRAVIS"]
-
-  config.filter_run_excluding :windows_only => true unless windows?
-  config.filter_run_excluding :not_supported_on_mac_osx_106 => true if mac_osx_106?
-  config.filter_run_excluding :not_supported_on_mac_osx => true if mac_osx?
-  config.filter_run_excluding :mac_osx_only => true if !mac_osx?
-  config.filter_run_excluding :not_supported_on_win2k3 => true if windows_win2k3?
-  config.filter_run_excluding :not_supported_on_solaris => true if solaris?
-  config.filter_run_excluding :not_supported_on_gce => true if gce?
-  config.filter_run_excluding :not_supported_on_nano => true if windows_nano_server?
-  config.filter_run_excluding :win2k3_only => true unless windows_win2k3?
-  config.filter_run_excluding :win2012r2_only => true unless windows_2012r2?
-  config.filter_run_excluding :windows_2008r2_or_later => true unless windows_2008r2_or_later?
-  config.filter_run_excluding :windows64_only => true unless windows64?
-  config.filter_run_excluding :windows32_only => true unless windows32?
-  config.filter_run_excluding :windows_nano_only => true unless windows_nano_server?
-  config.filter_run_excluding :ruby64_only => true unless ruby_64bit?
-  config.filter_run_excluding :ruby32_only => true unless ruby_32bit?
-  config.filter_run_excluding :windows_powershell_dsc_only => true unless windows_powershell_dsc?
-  config.filter_run_excluding :windows_powershell_no_dsc_only => true unless ! windows_powershell_dsc?
-  config.filter_run_excluding :windows_domain_joined_only => true unless windows_domain_joined?
-  config.filter_run_excluding :windows_not_domain_joined_only => true if windows_domain_joined?
+  config.filter_run_excluding volatile: true
+  config.filter_run_excluding volatile_on_solaris: true if solaris?
+  config.filter_run_excluding volatile_from_verify: false
+
+  config.filter_run_excluding skip_appveyor: true if ENV["APPVEYOR"]
+  config.filter_run_excluding appveyor_only: true unless ENV["APPVEYOR"]
+  config.filter_run_excluding skip_travis: true if ENV["TRAVIS"]
+
+  config.filter_run_excluding skip_buildkite: true if ENV["BUILDKITE"]
+
+  config.filter_run_excluding windows_only: true unless windows?
+  config.filter_run_excluding not_supported_on_mac_osx: true if mac_osx?
+  config.filter_run_excluding mac_osx_only: true if !mac_osx?
+  config.filter_run_excluding not_supported_on_aix: true if aix?
+  config.filter_run_excluding not_supported_on_solaris: true if solaris?
+  config.filter_run_excluding not_supported_on_gce: true if gce?
+  config.filter_run_excluding not_supported_on_nano: true if windows_nano_server?
+  config.filter_run_excluding win2012r2_only: true unless windows_2012r2?
+  config.filter_run_excluding windows_2008r2_or_later: true unless windows_2008r2_or_later?
+  config.filter_run_excluding windows64_only: true unless windows64?
+  config.filter_run_excluding windows32_only: true unless windows32?
+  config.filter_run_excluding windows_nano_only: true unless windows_nano_server?
+  config.filter_run_excluding windows_gte_10: true unless windows_gte_10?
+  config.filter_run_excluding windows_lt_10: true if windows_gte_10?
+  config.filter_run_excluding ruby64_only: true unless ruby_64bit?
+  config.filter_run_excluding ruby32_only: true unless ruby_32bit?
+  config.filter_run_excluding windows_powershell_dsc_only: true unless windows_powershell_dsc?
+  config.filter_run_excluding windows_powershell_no_dsc_only: true unless ! windows_powershell_dsc?
+  config.filter_run_excluding windows_domain_joined_only: true unless windows_domain_joined?
+  config.filter_run_excluding windows_not_domain_joined_only: true if windows_domain_joined?
   # We think this line was causing rspec tests to not run on the Jenkins windows
   # testers. If we ever fix it we should restore it.
   # config.filter_run_excluding :windows_service_requires_assign_token => true if !STDOUT.isatty && !windows_user_right?("SeAssignPrimaryTokenPrivilege")
-  config.filter_run_excluding :windows_service_requires_assign_token => true
-  config.filter_run_excluding :solaris_only => true unless solaris?
-  config.filter_run_excluding :system_windows_service_gem_only => true unless system_windows_service_gem?
-  config.filter_run_excluding :unix_only => true unless unix?
-  config.filter_run_excluding :linux_only => true unless linux?
-  config.filter_run_excluding :aix_only => true unless aix?
-  config.filter_run_excluding :debian_family_only => true unless debian_family?
-  config.filter_run_excluding :supports_cloexec => true unless supports_cloexec?
-  config.filter_run_excluding :selinux_only => true unless selinux_enabled?
-  config.filter_run_excluding :requires_root => true unless root?
-  config.filter_run_excluding :requires_root_or_running_windows => true unless root? || windows?
-  config.filter_run_excluding :requires_unprivileged_user => true if root?
-  config.filter_run_excluding :uses_diff => true unless has_diff?
-  config.filter_run_excluding :openssl_gte_101 => true unless openssl_gte_101?
-  config.filter_run_excluding :openssl_lt_101 => true unless openssl_lt_101?
-  config.filter_run_excluding :aes_256_gcm_only => true unless aes_256_gcm?
-  config.filter_run_excluding :broken => true
-  config.filter_run_excluding :not_wpar => true unless wpar?
-  config.filter_run_excluding :not_supported_under_fips => true if fips?
+  config.filter_run_excluding windows_service_requires_assign_token: true
+  config.filter_run_excluding solaris_only: true unless solaris?
+  config.filter_run_excluding system_windows_service_gem_only: true unless system_windows_service_gem?
+  config.filter_run_excluding unix_only: true unless unix?
+  config.filter_run_excluding linux_only: true unless linux?
+  config.filter_run_excluding aix_only: true unless aix?
+  config.filter_run_excluding suse_only: true unless suse?
+  config.filter_run_excluding sles11: true unless sles11?
+  config.filter_run_excluding debian_family_only: true unless debian_family?
+  config.filter_run_excluding supports_cloexec: true unless supports_cloexec?
+  config.filter_run_excluding selinux_only: true unless selinux_enabled?
+  config.filter_run_excluding requires_root: true unless root?
+  config.filter_run_excluding requires_root_or_running_windows: true unless root? || windows?
+  config.filter_run_excluding requires_unprivileged_user: true if root?
+  config.filter_run_excluding uses_diff: true unless has_diff?
+  config.filter_run_excluding openssl_gte_101: true unless openssl_gte_101?
+  config.filter_run_excluding openssl_lt_101: true unless openssl_lt_101?
+  config.filter_run_excluding aes_256_gcm_only: true unless aes_256_gcm?
+  config.filter_run_excluding broken: true
+  config.filter_run_excluding not_wpar: true unless wpar?
+  config.filter_run_excluding not_supported_under_fips: true if fips?
+  config.filter_run_excluding rhel: true unless rhel?
+  config.filter_run_excluding rhel5: true unless rhel5?
+  config.filter_run_excluding rhel6: true unless rhel6?
+  config.filter_run_excluding rhel7: true unless rhel7?
+  config.filter_run_excluding rhel8: true unless rhel8?
+  config.filter_run_excluding rhel_gte_8: true unless rhel_gte_8?
+  config.filter_run_excluding intel_64bit: true unless intel_64bit?
+  config.filter_run_excluding not_rhel: true if rhel?
+  config.filter_run_excluding not_rhel6: true if rhel6?
+  config.filter_run_excluding not_rhel7: true if rhel7?
+  config.filter_run_excluding not_intel_64bit: true if intel_64bit?
 
   # these let us use chef: ">= 13" or ruby: "~> 2.0.0" or any other Gem::Dependency-style constraint
   config.filter_run_excluding chef: DependencyProc.with(Chef::VERSION)
   config.filter_run_excluding ruby: DependencyProc.with(RUBY_VERSION)
 
+  config.filter_run_excluding choco_installed: true unless choco_installed?
+
   running_platform_arch = `uname -m`.strip unless windows?
 
-  config.filter_run_excluding :arch => lambda { |target_arch|
+  config.filter_run_excluding arch: lambda { |target_arch|
     running_platform_arch != target_arch
   }
 
   # Functional Resource tests that are provider-specific:
   # context "on platforms that use useradd", :provider => {:user => Chef::Provider::User::Useradd}} do #...
-  config.filter_run_excluding :provider => lambda { |criteria|
+  config.filter_run_excluding provider: lambda { |criteria|
     type, target_provider = criteria.first
 
     node = TEST_NODE.dup
@@ -208,6 +235,11 @@ RSpec.configure do |config|
   config.run_all_when_everything_filtered = true
 
   config.before(:each) do
+    # it'd be nice to run this with connections blocked or only to localhost, but we do make lots
+    # of real connections, so cannot.  we reset it to allow connections every time to avoid
+    # tests setting connections to be disabled and that state leaking into other tests.
+    WebMock.allow_net_connect!
+
     Chef.reset!
 
     Chef::ChefFS::FileSystemCache.instance.reset!
@@ -219,6 +251,38 @@ RSpec.configure do |config|
 
     # Set environment variable so the setting persists in child processes
     ENV["CHEF_TREAT_DEPRECATION_WARNINGS_AS_ERRORS"] = "1"
+
+    # we don't perfectly reset the priority/handler maps here, but by dup'ing the top level hash we
+    # throw away all the garbage resources and providers that we setup.  if we mutate something like
+    # :package then that'll carry over from test-to-test, but the solution would be to deep-dup on every
+    # single test we run which is much more expensive.  by throwing away the garbage top level keys we
+    # significantly speed up test runs.
+    provider_handler_map ||= Chef.provider_handler_map.send(:map).dup
+    resource_handler_map ||= Chef.resource_handler_map.send(:map).dup
+    provider_priority_map ||= Chef.provider_priority_map.send(:map).dup
+    resource_priority_map ||= Chef.resource_priority_map.send(:map).dup
+    Chef.provider_handler_map.instance_variable_set(:@map, provider_handler_map.dup)
+    Chef.resource_handler_map.instance_variable_set(:@map, resource_handler_map.dup)
+    Chef.provider_priority_map.instance_variable_set(:@map, provider_priority_map.dup)
+    Chef.resource_priority_map.instance_variable_set(:@map, resource_priority_map.dup)
+  end
+
+  # This bit of jankiness guards against specs which accidentally drop privs when running as
+  # root -- which are nearly impossible to debug and so we bail out very hard if this
+  # condition ever happens.  If a spec stubs Process.[e]uid this can throw a false positive
+  # which the spec must work around by unmocking Process.[e]uid to and_call_original in its
+  # after block.
+  if Process.euid == 0 && Process.uid == 0
+    config.after(:each) do
+      if Process.uid != 0
+        RSpec.configure { |c| c.fail_fast = true }
+        raise "rspec was invoked as root, but the last test dropped real uid to #{Process.uid}"
+      end
+      if Process.euid != 0
+        RSpec.configure { |c| c.fail_fast = true }
+        raise "rspec was invoked as root, but the last test dropped effective uid to #{Process.euid}"
+      end
+    end
   end
 
   # raise if anyone commits any test to CI with :focus set on it