chef 12.6.0 → 12.7.2

data/lib/chef/provider/service/invokercd.rb

@@ -1,6 +1,6 @@
 #
 # Author:: AJ Christensen (<aj@hjksolutions.com>)
-# Copyright:: Copyright (c) 2008 Opscode, Inc.
+# Copyright:: Copyright 2008-2016, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,14 +16,14 @@
 # limitations under the License.
 #
 
-require 'chef/provider/service/init'
+require "chef/provider/service/init"
 
 class Chef
   class Provider
     class Service
       class Invokercd < Chef::Provider::Service::Init
 
-        provides :service, platform_family: 'debian', override: true do |node|
+        provides :service, platform_family: "debian", override: true do |node|
           Chef::Platform::ServiceHelpers.service_resource_providers.include?(:invokercd)
         end
 

data/lib/chef/provider/service/macosx.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Igor Afonov <afonov@gmail.com>
-# Copyright:: Copyright (c) 2011 Igor Afonov
+# Copyright:: Copyright 2011-2016, Igor Afonov
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,12 +16,12 @@
 # limitations under the License.
 #
 
-require 'etc'
-require 'rexml/document'
-require 'chef/resource/service'
-require 'chef/resource/macosx_service'
-require 'chef/provider/service/simple'
-require 'chef/util/path_helper'
+require "etc"
+require "rexml/document"
+require "chef/resource/service"
+require "chef/resource/macosx_service"
+require "chef/provider/service/simple"
+require "chef/util/path_helper"
 
 class Chef
   class Provider
@@ -36,14 +36,14 @@ class Chef
                          /Library/LaunchDaemons
                          /System/Library/LaunchAgents
                          /System/Library/LaunchDaemons }
-          Chef::Util::PathHelper.home('Library', 'LaunchAgents') { |p| locations << p }
+          Chef::Util::PathHelper.home("Library", "LaunchAgents") { |p| locations << p }
           locations
         end
 
         PLIST_DIRS = gather_plist_dirs
 
         def this_version_or_newer?(this_version)
-          Gem::Version.new(node['platform_version']) >= Gem::Version.new(this_version)
+          Gem::Version.new(node["platform_version"]) >= Gem::Version.new(this_version)
         end
 
         def load_current_resource
@@ -53,17 +53,17 @@ class Chef
           @plist = @new_resource.plist ? @new_resource.plist : find_service_plist
           @service_label = find_service_label
           # LauchAgents should be loaded as the console user.
-          @console_user = @plist ? @plist.include?('LaunchAgents') : false
+          @console_user = @plist ? @plist.include?("LaunchAgents") : false
           @session_type = @new_resource.session_type
 
           if @console_user
             @console_user = Etc.getlogin
             Chef::Log.debug("#{new_resource} console_user: '#{@console_user}'")
             cmd = "su "
-            param = this_version_or_newer?('10.10') ? '' : '-l '
+            param = this_version_or_newer?("10.10") ? "" : "-l "
             @base_user_cmd = cmd + param + "#{@console_user} -c"
             # Default LauchAgent session should be Aqua
-            @session_type = 'Aqua' if @session_type.nil?
+            @session_type = "Aqua" if @session_type.nil?
           end
 
           Chef::Log.debug("#{new_resource} Plist: '#{@plist}' service_label: '#{@service_label}'")
@@ -74,7 +74,7 @@ class Chef
 
         def define_resource_requirements
           requirements.assert(:reload) do |a|
-            a.failure_message Chef::Exceptions::UnsupportedAction, "#{self.to_s} does not support :reload"
+            a.failure_message Chef::Exceptions::UnsupportedAction, "#{self} does not support :reload"
           end
 
           requirements.assert(:all_actions) do |a|
@@ -83,7 +83,7 @@ class Chef
           end
 
           requirements.assert(:all_actions) do |a|
-            a.assertion {::File.exists?(@plist.to_s) }
+            a.assertion { ::File.exists?(@plist.to_s) }
             a.failure_message Chef::Exceptions::Service,
               "Could not find plist for #{@new_resource}"
           end
@@ -160,14 +160,14 @@ class Chef
           end
         end
 
-       def load_service
-          session = @session_type ? "-S #{@session_type} " : ''
-          cmd = 'launchctl load -w ' + session + @plist
+        def load_service
+          session = @session_type ? "-S #{@session_type} " : ""
+          cmd = "launchctl load -w " + session + @plist
           shell_out_as_user(cmd)
         end
 
         def unload_service
-          cmd = 'launchctl unload -w ' + @plist
+          cmd = "launchctl unload -w " + @plist
           shell_out_as_user(cmd)
         end
 
@@ -206,7 +206,7 @@ class Chef
           end
         end
 
-      private
+        private
 
         def find_service_label
           # CHEF-5223 "you can't glob for a file that hasn't been converged

data/lib/chef/provider/service/openbsd.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Scott Bonds (<scott@ggr.com>)
-# Copyright:: Copyright (c) 2014 Scott Bonds
+# Copyright:: Copyright 2014-2016, Scott Bonds
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,10 +16,10 @@
 # limitations under the License.
 #
 
-require 'chef/mixin/command'
-require 'chef/mixin/shell_out'
-require 'chef/provider/service/init'
-require 'chef/resource/service'
+require "chef/mixin/command"
+require "chef/mixin/shell_out"
+require "chef/provider/service/init"
+require "chef/resource/service"
 
 class Chef
   class Provider
@@ -32,13 +32,13 @@ class Chef
 
         attr_reader :init_command, :rc_conf, :rc_conf_local, :enabled_state_found
 
-        RC_CONF_PATH = '/etc/rc.conf'
-        RC_CONF_LOCAL_PATH = '/etc/rc.conf.local'
+        RC_CONF_PATH = "/etc/rc.conf"
+        RC_CONF_LOCAL_PATH = "/etc/rc.conf.local"
 
         def initialize(new_resource, run_context)
           super
-          @rc_conf = ::File.read(RC_CONF_PATH) rescue ''
-          @rc_conf_local = ::File.read(RC_CONF_LOCAL_PATH) rescue ''
+          @rc_conf = ::File.read(RC_CONF_PATH) rescue ""
+          @rc_conf_local = ::File.read(RC_CONF_LOCAL_PATH) rescue ""
           @init_command = ::File.exist?(rcd_script_path) ? rcd_script_path : nil
           new_resource.status_command("#{default_init_command} check")
         end
@@ -82,7 +82,7 @@ class Chef
           if !is_enabled?
             if is_builtin?
               if is_enabled_by_default?
-                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, '')
+                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, "")
               else
                 # add line with blank string, which means enable
                 update_rcl rc_conf_local + "\n" + "#{builtin_service_enable_variable_name}=\"\"\n"
@@ -90,7 +90,7 @@ class Chef
             else
               # add to pkg_scripts, most recent addition goes last
               old_services_list = rc_conf_local.match(/^pkg_scripts="(.*)"/)
-              old_services_list = old_services_list ? old_services_list[1].split(' ') : []
+              old_services_list = old_services_list ? old_services_list[1].split(" ") : []
               new_services_list = old_services_list + [new_resource.service_name]
               if rc_conf_local.match(/^pkg_scripts="(.*)"/)
                 new_rcl = rc_conf_local.sub(/^pkg_scripts="(.*)"/, "pkg_scripts=\"#{new_services_list.join(' ')}\"")
@@ -110,14 +110,14 @@ class Chef
                 update_rcl rc_conf_local + "\n" + "#{builtin_service_enable_variable_name}=\"NO\"\n"
               else
                 # remove line to disable
-                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, '')
+                update_rcl rc_conf_local.sub(/^#{Regexp.escape(builtin_service_enable_variable_name)}=.*/, "")
               end
             else
               # remove from pkg_scripts
               old_list = rc_conf_local.match(/^pkg_scripts="(.*)"/)
-              old_list = old_list ? old_list[1].split(' ') : []
+              old_list = old_list ? old_list[1].split(" ") : []
               new_list = old_list - [new_resource.service_name]
-              update_rcl rc_conf_local.sub(/^pkg_scripts="(.*)"/, pkg_scripts="#{new_list.join(' ')}")
+              update_rcl rc_conf_local.sub(/^pkg_scripts="(.*)"/, pkg_scripts = "#{new_list.join(' ')}")
             end
           end
         end

data/lib/chef/provider/service/redhat.rb

@@ -1,6 +1,6 @@
 #
 # Author:: AJ Christensen (<aj@hjksolutions.com>)
-# Copyright:: Copyright (c) 2008-2015 Chef Software, Inc.
+# Copyright:: Copyright 2008-2016, Chef Software, Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,7 +16,7 @@
 # limitations under the License.
 #
 
-require 'chef/provider/service/init'
+require "chef/provider/service/init"
 
 class Chef
   class Provider
@@ -28,7 +28,7 @@ class Chef
         # @api private
         attr_accessor :current_run_levels
 
-        provides :service, platform_family: %w(rhel fedora suse) do |node|
+        provides :service, platform_family: %w{rhel fedora suse} do |node|
           Chef::Platform::ServiceHelpers.service_resource_providers.include?(:redhat)
         end
 
@@ -75,12 +75,12 @@ class Chef
           super
 
           if ::File.exists?("/sbin/chkconfig")
-            chkconfig = shell_out!("/sbin/chkconfig --list #{current_resource.service_name}", :returns => [0,1])
+            chkconfig = shell_out!("/sbin/chkconfig --list #{current_resource.service_name}", :returns => [0, 1])
             unless run_levels.nil? or run_levels.empty?
               all_levels_match = true
               chkconfig.stdout.split(/\s+/)[1..-1].each do |level|
-                index = level.split(':').first
-                status = level.split(':').last
+                index = level.split(":").first
+                status = level.split(":").last
                 if level =~ CHKCONFIG_ON
                   @current_run_levels << index.to_i
                   all_levels_match = false unless run_levels.include?(index.to_i)

data/lib/chef/provider/service/simple.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Mathieu Sauve-Frankel <msf@kisoku.net>
-# Copyright:: Copyright (c) 2009 Mathieu Sauve-Frankel
+# Copyright:: Copyright 2009-2016, Mathieu Sauve-Frankel
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,9 +16,9 @@
 # limitations under the License.
 #
 
-require 'chef/provider/service'
-require 'chef/resource/service'
-require 'chef/mixin/command'
+require "chef/provider/service"
+require "chef/resource/service"
+require "chef/mixin/command"
 
 class Chef
   class Provider
@@ -58,21 +58,21 @@ class Chef
           shared_resource_requirements
           requirements.assert(:start) do |a|
             a.assertion { @new_resource.start_command }
-            a.failure_message Chef::Exceptions::Service, "#{self.to_s} requires that start_command be set"
+            a.failure_message Chef::Exceptions::Service, "#{self} requires that start_command be set"
           end
           requirements.assert(:stop) do |a|
             a.assertion { @new_resource.stop_command }
-            a.failure_message Chef::Exceptions::Service, "#{self.to_s} requires that stop_command be set"
+            a.failure_message Chef::Exceptions::Service, "#{self} requires that stop_command be set"
           end
 
           requirements.assert(:restart) do |a|
-            a.assertion { @new_resource.restart_command  || ( @new_resource.start_command && @new_resource.stop_command ) }
-            a.failure_message Chef::Exceptions::Service, "#{self.to_s} requires a restart_command or both start_command and stop_command be set in order to perform a restart"
+            a.assertion { @new_resource.restart_command || ( @new_resource.start_command && @new_resource.stop_command ) }
+            a.failure_message Chef::Exceptions::Service, "#{self} requires a restart_command or both start_command and stop_command be set in order to perform a restart"
           end
 
           requirements.assert(:reload) do |a|
             a.assertion { @new_resource.reload_command }
-            a.failure_message Chef::Exceptions::UnsupportedAction, "#{self.to_s} requires a reload_command be set in order to perform a reload"
+            a.failure_message Chef::Exceptions::UnsupportedAction, "#{self} requires a reload_command be set in order to perform a reload"
           end
 
           requirements.assert(:all_actions) do |a|
@@ -109,6 +109,7 @@ class Chef
         end
 
       protected
+
         def determine_current_status!
           if @new_resource.status_command
             Chef::Log.debug("#{@new_resource} you have specified a status command, running..")

data/lib/chef/provider/service/solaris.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Toomas Pelberg (<toomasp@gmx.net>)
-# Copyright:: Copyright (c) 2010 Opscode, Inc.
+# Copyright:: Copyright 2010-2016, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,9 +16,9 @@
 # limitations under the License.
 #
 
-require 'chef/provider/service'
-require 'chef/resource/service'
-require 'chef/mixin/command'
+require "chef/provider/service"
+require "chef/resource/service"
+require "chef/mixin/command"
 
 class Chef
   class Provider
@@ -28,7 +28,7 @@ class Chef
 
         provides :service, os: "solaris2"
 
-        def initialize(new_resource, run_context=nil)
+        def initialize(new_resource, run_context = nil)
           super
           @init_command   = "/usr/sbin/svcadm"
           @status_command = "/bin/svcs"
@@ -96,11 +96,11 @@ class Chef
 
           # check service state
           @maintenance = false
-          case status['state']
-          when 'online'
+          case status["state"]
+          when "online"
             @current_resource.enabled(true)
             @current_resource.running(true)
-          when 'maintenance'
+          when "maintenance"
             @maintenance = true
           end
 

data/lib/chef/provider/service/systemd.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Stephen Haynes (<sh@nomitor.com>)
-# Copyright:: Copyright (c) 2011 Opscode, Inc.
+# Copyright:: Copyright 2011-2016, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,9 +16,9 @@
 # limitations under the License.
 #
 
-require 'chef/resource/service'
-require 'chef/provider/service/simple'
-require 'chef/mixin/which'
+require "chef/resource/service"
+require "chef/provider/service/simple"
+require "chef/mixin/which"
 
 class Chef::Provider::Service::Systemd < Chef::Provider::Service::Simple
 

data/lib/chef/provider/service/upstart.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Bryan McLellan <btm@loftninjas.org>
-# Copyright:: Copyright (c) 2010 Bryan McLellan
+# Copyright:: Copyright 2010-2016, Bryan McLellan
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,17 +16,17 @@
 # limitations under the License.
 #
 
-require 'chef/resource/service'
-require 'chef/provider/service/simple'
-require 'chef/mixin/command'
-require 'chef/util/file_edit'
+require "chef/resource/service"
+require "chef/provider/service/simple"
+require "chef/mixin/command"
+require "chef/util/file_edit"
 
 class Chef
   class Provider
     class Service
       class Upstart < Chef::Provider::Service::Simple
 
-        provides :service, platform_family: 'debian', override: true do |node|
+        provides :service, platform_family: "debian", override: true do |node|
           Chef::Platform::ServiceHelpers.service_resource_providers.include?(:upstart)
         end
 
@@ -89,7 +89,7 @@ class Chef
           end
 
           requirements.assert(:all_actions) do |a|
-            a.assertion  { @config_file_found }
+            a.assertion { @config_file_found }
             # no failure here, just document the assumptions made.
             a.whyrun "Could not find #{@upstart_job_dir}/#{@new_resource.service_name}#{@upstart_conf_suffix}. Assuming service is disabled."
           end
@@ -130,7 +130,7 @@ class Chef
           # Get enabled/disabled state by reading job configuration file
           if ::File.exists?("#{@upstart_job_dir}/#{@new_resource.service_name}#{@upstart_conf_suffix}")
             Chef::Log.debug("#{@new_resource} found #{@upstart_job_dir}/#{@new_resource.service_name}#{@upstart_conf_suffix}")
-            ::File.open("#{@upstart_job_dir}/#{@new_resource.service_name}#{@upstart_conf_suffix}",'r') do |file|
+            ::File.open("#{@upstart_job_dir}/#{@new_resource.service_name}#{@upstart_conf_suffix}", "r") do |file|
               while line = file.gets
                 case line
                 when /^start on/

data/lib/chef/provider/service/windows.rb

@@ -1,8 +1,8 @@
 #
-# Author:: Nuo Yan <nuo@opscode.com>
+# Author:: Nuo Yan <nuo@chef.io>
 # Author:: Bryan McLellan <btm@loftninjas.org>
-# Author:: Seth Chisamore <schisamo@opscode.com>
-# Copyright:: Copyright (c) 2010-2011 Opscode, Inc
+# Author:: Seth Chisamore <schisamo@chef.io>
+# Copyright:: Copyright 2010-2016, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,10 +18,10 @@
 # limitations under the License.
 #
 
-require 'chef/provider/service/simple'
+require "chef/provider/service/simple"
 if RUBY_PLATFORM =~ /mswin|mingw32|windows/
-  require 'chef/win32/error'
-  require 'win32/service'
+  require "chef/win32/error"
+  require "win32/service"
 end
 
 class Chef::Provider::Service::Windows < Chef::Provider::Service
@@ -32,20 +32,22 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
   include Chef::ReservedNames::Win32::API::Error rescue LoadError
 
   #Win32::Service.get_start_type
-  AUTO_START = 'auto start'
-  MANUAL = 'demand start'
-  DISABLED = 'disabled'
+  AUTO_START = "auto start"
+  MANUAL = "demand start"
+  DISABLED = "disabled"
 
   #Win32::Service.get_current_state
-  RUNNING = 'running'
-  STOPPED = 'stopped'
-  CONTINUE_PENDING = 'continue pending'
-  PAUSE_PENDING = 'pause pending'
-  PAUSED = 'paused'
-  START_PENDING = 'start pending'
-  STOP_PENDING  = 'stop pending'
+  RUNNING = "running"
+  STOPPED = "stopped"
+  CONTINUE_PENDING = "continue pending"
+  PAUSE_PENDING = "pause pending"
+  PAUSED = "paused"
+  START_PENDING = "start pending"
+  STOP_PENDING  = "stop pending"
 
-  TIMEOUT  = 60
+  TIMEOUT = 60
+
+  SERVICE_RIGHT = "SeServiceLogonRight"
 
   def whyrun_supported?
     false
@@ -73,15 +75,15 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
         service_name: @new_resource.service_name,
         service_start_name: @new_resource.run_as_user,
         password: @new_resource.run_as_password,
-      }.reject { |k,v| v.nil? || v.length == 0 }
+      }.reject { |k, v| v.nil? || v.length == 0 }
 
       Win32::Service.configure(new_config)
       Chef::Log.info "#{@new_resource} configured with #{new_config.inspect}"
 
-      # it would be nice to check if the user already has the logon privilege, but that turns out to be
-      # nontrivial.
       if new_config.has_key?(:service_start_name)
-        grant_service_logon(new_config[:service_start_name])
+        unless Chef::ReservedNames::Win32::Security.get_account_right(canonicalize_username(new_config[:service_start_name])).include?(SERVICE_RIGHT)
+          grant_service_logon(new_config[:service_start_name])
+        end
       end
 
       state = current_state
@@ -236,74 +238,26 @@ class Chef::Provider::Service::Windows < Chef::Provider::Service
   end
 
   private
-  def make_policy_text(username)
-    text = <<-EOS
-[Unicode]
-Unicode=yes
-[Privilege Rights]
-SeServiceLogonRight = \\\\#{canonicalize_username(username)},*S-1-5-80-0
-[Version]
-signature="$CHICAGO$"
-Revision=1
-EOS
-  end
-
-  def grant_logfile_name(username)
-    Chef::Util::PathHelper.canonical_path("#{Dir.tmpdir}/logon_grant-#{clean_username_for_path(username)}-#{$$}.log", prefix=false)
-  end
-
-  def grant_policyfile_name(username)
-    Chef::Util::PathHelper.canonical_path("#{Dir.tmpdir}/service_logon_policy-#{clean_username_for_path(username)}-#{$$}.inf", prefix=false)
-  end
-
-  def grant_dbfile_name(username)
-    "#{ENV['TEMP']}\\secedit.sdb"
-  end
 
   def grant_service_logon(username)
-    logfile = grant_logfile_name(username)
-    policy_file = ::File.new(grant_policyfile_name(username), 'w')
-    policy_text = make_policy_text(username)
-    dbfile = grant_dbfile_name(username)        # this is just an audit file.
-
     begin
-      Chef::Log.debug "Policy file text:\n#{policy_text}"
-      policy_file.puts(policy_text)
-      policy_file.close   # need to flush the buffer.
-
-      # it would be nice to do this with APIs instead, but the LSA_* APIs are
-      # particularly onerous and life is short.
-      cmd = %Q{secedit.exe /configure /db "#{dbfile}" /cfg "#{policy_file.path}" /areas USER_RIGHTS SECURITYPOLICY SERVICES /log "#{logfile}"}
-      Chef::Log.debug "Granting logon-as-service privilege with: #{cmd}"
-      runner = shell_out(cmd)
-
-      if runner.exitstatus != 0
-        Chef::Log.fatal "Logon-as-service grant failed with output: #{runner.stdout}"
-        raise Chef::Exceptions::Service, <<-EOS
-Logon-as-service grant failed with policy file #{policy_file.path}.
-You can look at #{logfile} for details, or do `secedit /analyze #{dbfile}`.
-The failed command was `#{cmd}`.
-EOS
-      end
-
-      Chef::Log.info "Grant logon-as-service to user '#{username}' successful."
-
-      ::File.delete(dbfile) rescue nil
-      ::File.delete(policy_file)
-      ::File.delete(logfile) rescue nil     # logfile is not always present at end.
+      Chef::ReservedNames::Win32::Security.add_account_right(canonicalize_username(username), SERVICE_RIGHT)
+    rescue Chef::Exceptions::Win32APIError => err
+      Chef::Log.fatal "Logon-as-service grant failed with output: #{err}"
+      raise Chef::Exceptions::Service, "Logon-as-service grant failed for #{username}: #{err}"
     end
+
+    Chef::Log.info "Grant logon-as-service to user '#{username}' successful."
     true
   end
 
   # remove characters that make for broken or wonky filenames.
   def clean_username_for_path(username)
-    username.gsub(/[\/\\. ]+/, '_')
+    username.gsub(/[\/\\. ]+/, "_")
   end
 
-  # the security policy file only seems to accept \\username, so fix .\username or .\\username.
-  # TODO: this probably has to be fixed to handle various valid Windows names correctly.
   def canonicalize_username(username)
-    username.sub(/^\.?\\+/, '')
+    username.sub(/^\.?\\+/, "")
   end
 
   def current_state
@@ -352,7 +306,7 @@ EOS
     Chef::Log.debug "#{@new_resource.name} setting start_type to #{type}"
     Win32::Service.configure(
       :service_name => @new_resource.service_name,
-      :start_type => allowed_types[type]
+      :start_type => allowed_types[type],
     )
     @new_resource.updated_by_last_action(true)
   end