chef 13.7.16-universal-mingw32 → 13.8.0-universal-mingw32

data/spec/support/shared/functional/knife.rb

@@ -1,37 +1,37 @@
-#
-# Author:: Adam Jacob (<adam@chef.io>)
-# Author:: AJ Christensen (<aj@junglist.gen.nz>)
-# Author:: Ho-Sheng Hsiao (<hosh@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-module SpecHelpers
-  module Knife
-    def redefine_argv(value)
-      Object.send(:remove_const, :ARGV)
-      Object.send(:const_set, :ARGV, value)
-    end
-
-    def with_argv(*argv)
-      original_argv = ARGV
-      redefine_argv(argv.flatten)
-      begin
-        yield
-      ensure
-        redefine_argv(original_argv)
-      end
-    end
-  end
-end
+#
+# Author:: Adam Jacob (<adam@chef.io>)
+# Author:: AJ Christensen (<aj@junglist.gen.nz>)
+# Author:: Ho-Sheng Hsiao (<hosh@chef.io>)
+# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module SpecHelpers
+  module Knife
+    def redefine_argv(value)
+      Object.send(:remove_const, :ARGV)
+      Object.send(:const_set, :ARGV, value)
+    end
+
+    def with_argv(*argv)
+      original_argv = ARGV
+      redefine_argv(argv.flatten)
+      begin
+        yield
+      ensure
+        redefine_argv(original_argv)
+      end
+    end
+  end
+end

data/spec/support/shared/functional/securable_resource.rb

@@ -1,547 +1,547 @@
-#
-# Author:: Seth Chisamore (<schisamo@chef.io>)
-# Author:: Mark Mzyk (<mmzyk@chef.io>)
-# Author:: John Keiser (<jkeiser@chef.io>)
-# Copyright:: Copyright 2011-2016, Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require "etc"
-require "functional/resource/base"
-
-shared_context "setup correct permissions" do
-  if windows?
-    include_context "use Windows permissions"
-  end
-
-  # I could not get this to work with :requires_unprivileged_user for whatever
-  # reason. The setup when running as root is the same as non-root, except we
-  # also do a chown, so this sets up correct context for either case.
-  before :each, :unix_only do
-    File.chmod(0776, path)
-    now = Time.now.to_i
-    File.utime(now - 9000, now - 9000, path)
-  end
-
-  # Root only context.
-  before :each, :unix_only, :requires_root do
-    if ohai[:platform] == "aix"
-      File.chown(Etc.getpwnam("guest").uid, 1337, path)
-    else
-      File.chown(Etc.getpwnam("nobody").uid, 1337, path)
-    end
-  end
-
-  before :each, :windows_only do
-    so = SecurableObject.new(path)
-    so.owner = SID.Administrator
-    so.group = SID.Administrators
-    dacl = ACL.create(denied_acl(SID.Guest, expected_modify_perms) +
-                      allowed_acl(SID.Guest, expected_read_perms))
-    so.dacl = dacl
-  end
-end
-
-shared_context "setup broken permissions" do
-  if windows?
-    include_context "use Windows permissions"
-  end
-
-  before :each, :unix_only do
-    File.chmod(0644, path)
-  end
-
-  before :each, :unix_only, :requires_root do
-    File.chown(0, 0, path)
-  end
-
-  before :each, :windows_only do
-    so = SecurableObject.new(path)
-    so.owner = SID.Guest
-    so.group = SID.Everyone
-    dacl = ACL.create(allowed_acl(SID.Guest, expected_modify_perms))
-    so.set_dacl(dacl, true)
-  end
-end
-
-shared_context "use Windows permissions", :windows_only do
-  if windows?
-    SID ||= Chef::ReservedNames::Win32::Security::SID
-    ACE ||= Chef::ReservedNames::Win32::Security::ACE
-    ACL ||= Chef::ReservedNames::Win32::Security::ACL
-    SecurableObject ||= Chef::ReservedNames::Win32::Security::SecurableObject # rubocop:disable Style/ConstantName
-  end
-
-  def get_security_descriptor(path)
-    Chef::ReservedNames::Win32::Security.get_named_security_info(path)
-  end
-
-  def explicit_aces
-    descriptor.dacl.select { |ace| ace.explicit? }
-  end
-
-  def extract_ace_properties(aces)
-    hashes = []
-    aces.each do |ace|
-      hashes << { :mask => ace.mask, :type => ace.type, :flags => ace.flags }
-    end
-    hashes
-  end
-
-  # Standard expected rights
-  let(:expected_read_perms) do
-    {
-      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ,
-      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ,
-    }
-  end
-
-  let(:expected_read_execute_perms) do
-    {
-      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ | Chef::ReservedNames::Win32::API::Security::GENERIC_EXECUTE,
-      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_EXECUTE,
-    }
-  end
-
-  let(:expected_write_perms) do
-    {
-      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_WRITE,
-      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_WRITE,
-    }
-  end
-
-  let(:expected_modify_perms) do
-    {
-      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ | Chef::ReservedNames::Win32::API::Security::GENERIC_WRITE | Chef::ReservedNames::Win32::API::Security::GENERIC_EXECUTE | Chef::ReservedNames::Win32::API::Security::DELETE,
-      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_WRITE | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_EXECUTE | Chef::ReservedNames::Win32::API::Security::DELETE,
-    }
-  end
-
-  let(:expected_full_control_perms) do
-    {
-      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_ALL,
-      :specific => Chef::ReservedNames::Win32::API::Security::FILE_ALL_ACCESS,
-    }
-  end
-
-  RSpec::Matchers.define :have_expected_properties do |mask, type, flags|
-    match do |ace|
-      ace.mask == mask &&
-        ace.type == type &&
-        ace.flags == flags
-    end
-  end
-
-  def descriptor
-    get_security_descriptor(path)
-  end
-end
-
-shared_examples_for "a securable resource with existing target" do
-
-  include_context "diff disabled"
-
-  context "on Unix", :unix_only do
-    if ohai[:platform] == "aix"
-      let(:expected_user_name) { "guest" }
-    else
-      let(:expected_user_name) { "nobody" }
-    end
-    let(:expected_uid) { Etc.getpwnam(expected_user_name).uid }
-    let(:desired_gid) { 1337 }
-    let(:expected_gid) { 1337 }
-
-    describe "when setting the owner", :requires_root do
-      before do
-        resource.owner expected_user_name
-        resource.run_action(:create)
-      end
-
-      it "should set an owner" do
-        expect(File.lstat(path).uid).to eq(expected_uid)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-
-    end
-
-    describe "when setting the group", :requires_root do
-      before do
-        resource.group desired_gid
-        resource.run_action(:create)
-      end
-
-      it "should set a group" do
-        expect(File.lstat(path).gid).to eq(expected_gid)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-
-    end
-
-    describe "when setting the permissions from octal given as a String" do
-      before do
-        @mode_string = "776"
-        resource.mode @mode_string
-        resource.run_action(:create)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-    end
-
-    describe "when setting permissions from a literal octal Integer" do
-      before do
-        @mode_integer = 0776
-        resource.mode @mode_integer
-        resource.run_action(:create)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-    end
-
-    describe "when setting the suid bit", :requires_root do
-      before do
-        @suid_mode = 04776
-        resource.mode @suid_mode
-        resource.run_action(:create)
-      end
-
-      it "should set the suid bit" do
-        expect(File.lstat(path).mode & 007777).to eq(@suid_mode & 007777)
-      end
-
-      it "should retain the suid bit when updating the user" do
-        resource.user 1338
-        resource.run_action(:create)
-        expect(File.lstat(path).mode & 007777).to eq(@suid_mode & 007777)
-      end
-    end
-  end
-
-  context "on Windows", :windows_only do
-    include_context "use Windows permissions"
-
-    describe "when setting owner" do
-      before do
-        resource.owner(SID.admin_account_name)
-        resource.run_action(:create)
-      end
-
-      it "should set the owner" do
-        expect(descriptor.owner).to eq(SID.Administrator)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-    end
-
-    describe "when setting group" do
-      before do
-        resource.group("Administrators")
-        resource.run_action(:create)
-      end
-
-      it "should set the group" do
-        expect(descriptor.group).to eq(SID.Administrators)
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-    end
-
-    describe "when setting rights and deny_rights" do
-      before do
-        resource.deny_rights(:modify, "Guest")
-        resource.rights(:read, "Guest")
-        resource.run_action(:create)
-      end
-
-      it "should set the rights and deny_rights" do
-        expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms))
-      end
-
-      it "is marked as updated only if changes are made" do
-        expect(resource.updated_by_last_action?).to eq(expect_updated?)
-      end
-    end
-  end
-end
-
-shared_examples_for "a securable resource without existing target" do
-
-  include_context "diff disabled"
-
-  context "on Windows", :windows_only do
-    include_context "use Windows permissions"
-
-    it "leaves owner as system default on create if owner is not specified" do
-      expect(File.exist?(path)).to eq(false)
-      resource.run_action(:create)
-      expect(descriptor.owner).to eq(SID.default_security_object_owner)
-    end
-
-    it "sets owner when owner is specified" do
-      resource.owner "Guest"
-      resource.run_action(:create)
-      expect(descriptor.owner).to eq(SID.Guest)
-    end
-
-    it "fails to set owner when owner has invalid characters" do
-      expect { resource.owner 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
-    end
-
-    it "sets owner when owner is specified with a \\" do
-      resource.owner "#{ENV['USERDOMAIN']}\\Guest"
-      resource.run_action(:create)
-      expect(descriptor.owner).to eq(SID.Guest)
-    end
-
-    it "leaves owner alone if owner is not specified and resource already exists" do
-      arbitrary_non_default_owner = SID.Guest
-      expect(arbitrary_non_default_owner).not_to eq(SID.default_security_object_owner)
-
-      resource.owner "Guest" # Change to arbitrary_non_default_owner once issue #1508 is fixed
-      resource.run_action(:create)
-      expect(descriptor.owner).to eq(arbitrary_non_default_owner)
-
-      new_resource = create_resource
-      expect(new_resource.owner).to eq(nil)
-      new_resource.run_action(:create)
-      expect(descriptor.owner).to eq(arbitrary_non_default_owner)
-    end
-
-    it "leaves group as system default on create if group is not specified" do
-      expect(resource.group).to eq(nil)
-      expect(File.exist?(path)).to eq(false)
-      resource.run_action(:create)
-      expect(descriptor.group).to eq(SID.default_security_object_group)
-    end
-
-    it "sets group when group is specified" do
-      resource.group "Everyone"
-      resource.run_action(:create)
-      expect(descriptor.group).to eq(SID.Everyone)
-    end
-
-    it "fails to set group when group has invalid characters" do
-      expect { resource.group 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
-    end
-
-    it "leaves group alone if group is not specified and resource already exists" do
-      arbitrary_non_default_group = SID.Everyone
-      expect(arbitrary_non_default_group).not_to eq(SID.default_security_object_group)
-
-      resource.group "Everyone" # Change to arbitrary_non_default_group once issue #1508 is fixed
-      resource.run_action(:create)
-      expect(descriptor.group).to eq(arbitrary_non_default_group)
-
-      new_resource = create_resource
-      expect(new_resource.group).to eq(nil)
-      new_resource.run_action(:create)
-      expect(descriptor.group).to eq(arbitrary_non_default_group)
-    end
-
-    describe "with rights and deny_rights attributes" do
-
-      it "correctly sets :read rights" do
-        resource.rights(:read, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_read_perms))
-      end
-
-      it "correctly sets :read_execute rights" do
-        resource.rights(:read_execute, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_read_execute_perms))
-      end
-
-      it "correctly sets :write rights" do
-        resource.rights(:write, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_write_perms))
-      end
-
-      it "correctly sets :modify rights" do
-        resource.rights(:modify, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_modify_perms))
-      end
-
-      it "correctly sets :full_control rights" do
-        resource.rights(:full_control, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_full_control_perms))
-      end
-
-      it "correctly sets deny_rights" do
-        # deny is an ACE with full rights, but is a deny type ace, not an allow type
-        resource.deny_rights(:full_control, "Guest")
-        resource.run_action(:create)
-        expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_full_control_perms))
-      end
-
-      it "Sets multiple rights" do
-        resource.rights(:read, "Everyone")
-        resource.rights(:modify, "Guest")
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq(
-          allowed_acl(SID.Everyone, expected_read_perms) +
-          allowed_acl(SID.Guest, expected_modify_perms)
-        )
-      end
-
-      it "Sets deny_rights ahead of rights" do
-        resource.rights(:read, "Everyone")
-        resource.deny_rights(:modify, "Guest")
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq(
-          denied_acl(SID.Guest, expected_modify_perms) +
-          allowed_acl(SID.Everyone, expected_read_perms)
-        )
-      end
-
-      it "Sets deny_rights ahead of rights when specified in reverse order" do
-        resource.deny_rights(:modify, "Guest")
-        resource.rights(:read, "Everyone")
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq(
-          denied_acl(SID.Guest, expected_modify_perms) +
-          allowed_acl(SID.Everyone, expected_read_perms)
-        )
-      end
-
-    end
-
-    context "with a mode attribute" do
-      if windows?
-        Security ||= Chef::ReservedNames::Win32::API::Security # rubocop:disable Style/ConstantName
-      end
-
-      it "respects mode in string form as an octal number" do
-        #on windows, mode cannot modify owner and/or group permissons
-        #unless the owner and/or group as appropriate is specified
-        resource.mode "400"
-        resource.owner "Guest"
-        resource.group "Everyone"
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq([ ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ) ])
-      end
-
-      it "respects mode in numeric form as a ruby-interpreted octal" do
-        resource.mode 0700
-        resource.owner "Guest"
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq([ ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_WRITE | Security::FILE_GENERIC_EXECUTE | Security::DELETE) ])
-      end
-
-      it "respects the owner, group and everyone bits of mode" do
-        resource.mode 0754
-        resource.owner "Guest"
-        resource.group "Administrators"
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq([
-          ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_WRITE | Security::FILE_GENERIC_EXECUTE | Security::DELETE),
-          ACE.access_allowed(SID.Administrators, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_EXECUTE),
-          ACE.access_allowed(SID.Everyone, Security::FILE_GENERIC_READ),
-        ])
-      end
-
-      it "respects the individual read, write and execute bits of mode" do
-        resource.mode 0421
-        resource.owner "Guest"
-        resource.group "Administrators"
-        resource.run_action(:create)
-
-        expect(explicit_aces).to eq([
-          ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ),
-          ACE.access_allowed(SID.Administrators, Security::FILE_GENERIC_WRITE | Security::DELETE),
-          ACE.access_allowed(SID.Everyone, Security::FILE_GENERIC_EXECUTE),
-        ])
-      end
-
-      it "warns when mode tries to set owner bits but owner is not specified" do
-        @warn = []
-        allow(Chef::Log).to receive(:warn) { |msg| @warn << msg }
-
-        resource.mode 0400
-        resource.run_action(:create)
-
-        expect(@warn.include?("Mode 400 includes bits for the owner, but owner is not specified")).to be_truthy
-      end
-
-      it "warns when mode tries to set group bits but group is not specified" do
-        @warn = []
-        allow(Chef::Log).to receive(:warn) { |msg| @warn << msg }
-
-        resource.mode 0040
-        resource.run_action(:create)
-
-        expect(@warn.include?("Mode 040 includes bits for the group, but group is not specified")).to be_truthy
-      end
-    end
-
-    it "does not inherit aces if inherits is set to false" do
-      # We need at least one ACE if we're creating a securable without
-      # inheritance
-      resource.rights(:full_control, "Administrators")
-      resource.inherits(false)
-      resource.run_action(:create)
-
-      descriptor.dacl.each do |ace|
-        expect(ace.inherited?).to eq(false)
-      end
-    end
-
-    it "has the inheritable acls of parent directory if no acl is specified" do
-      expect(File.exist?(path)).to eq(false)
-
-      # Collect the inheritable acls form the parent by creating a file without
-      # any specific ACLs
-      parent_acls = parent_inheritable_acls
-
-      # On certain flavors of Windows the default list of ACLs sometimes includes
-      # non-inherited ACLs. Filter them out here.
-      parent_inherited_acls = parent_acls.dacl.collect do |ace|
-        ace.inherited?
-      end
-
-      resource.run_action(:create)
-
-      # Similarly filter out the non-inherited ACLs
-      resource_inherited_acls = descriptor.dacl.collect do |ace|
-        ace.inherited?
-      end
-
-      expect(resource_inherited_acls).to eq(parent_inherited_acls)
-    end
-
-  end
-end
+#
+# Author:: Seth Chisamore (<schisamo@chef.io>)
+# Author:: Mark Mzyk (<mmzyk@chef.io>)
+# Author:: John Keiser (<jkeiser@chef.io>)
+# Copyright:: Copyright 2011-2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "etc"
+require "functional/resource/base"
+
+shared_context "setup correct permissions" do
+  if windows?
+    include_context "use Windows permissions"
+  end
+
+  # I could not get this to work with :requires_unprivileged_user for whatever
+  # reason. The setup when running as root is the same as non-root, except we
+  # also do a chown, so this sets up correct context for either case.
+  before :each, :unix_only do
+    File.chmod(0776, path)
+    now = Time.now.to_i
+    File.utime(now - 9000, now - 9000, path)
+  end
+
+  # Root only context.
+  before :each, :unix_only, :requires_root do
+    if ohai[:platform] == "aix"
+      File.chown(Etc.getpwnam("guest").uid, 1337, path)
+    else
+      File.chown(Etc.getpwnam("nobody").uid, 1337, path)
+    end
+  end
+
+  before :each, :windows_only do
+    so = SecurableObject.new(path)
+    so.owner = SID.Administrator
+    so.group = SID.Administrators
+    dacl = ACL.create(denied_acl(SID.Guest, expected_modify_perms) +
+                      allowed_acl(SID.Guest, expected_read_perms))
+    so.dacl = dacl
+  end
+end
+
+shared_context "setup broken permissions" do
+  if windows?
+    include_context "use Windows permissions"
+  end
+
+  before :each, :unix_only do
+    File.chmod(0644, path)
+  end
+
+  before :each, :unix_only, :requires_root do
+    File.chown(0, 0, path)
+  end
+
+  before :each, :windows_only do
+    so = SecurableObject.new(path)
+    so.owner = SID.Guest
+    so.group = SID.Everyone
+    dacl = ACL.create(allowed_acl(SID.Guest, expected_modify_perms))
+    so.set_dacl(dacl, true)
+  end
+end
+
+shared_context "use Windows permissions", :windows_only do
+  if windows?
+    SID ||= Chef::ReservedNames::Win32::Security::SID
+    ACE ||= Chef::ReservedNames::Win32::Security::ACE
+    ACL ||= Chef::ReservedNames::Win32::Security::ACL
+    SecurableObject ||= Chef::ReservedNames::Win32::Security::SecurableObject # rubocop:disable Style/ConstantName
+  end
+
+  def get_security_descriptor(path)
+    Chef::ReservedNames::Win32::Security.get_named_security_info(path)
+  end
+
+  def explicit_aces
+    descriptor.dacl.select { |ace| ace.explicit? }
+  end
+
+  def extract_ace_properties(aces)
+    hashes = []
+    aces.each do |ace|
+      hashes << { :mask => ace.mask, :type => ace.type, :flags => ace.flags }
+    end
+    hashes
+  end
+
+  # Standard expected rights
+  let(:expected_read_perms) do
+    {
+      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ,
+      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ,
+    }
+  end
+
+  let(:expected_read_execute_perms) do
+    {
+      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ | Chef::ReservedNames::Win32::API::Security::GENERIC_EXECUTE,
+      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_EXECUTE,
+    }
+  end
+
+  let(:expected_write_perms) do
+    {
+      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_WRITE,
+      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_WRITE,
+    }
+  end
+
+  let(:expected_modify_perms) do
+    {
+      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_READ | Chef::ReservedNames::Win32::API::Security::GENERIC_WRITE | Chef::ReservedNames::Win32::API::Security::GENERIC_EXECUTE | Chef::ReservedNames::Win32::API::Security::DELETE,
+      :specific => Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_READ | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_WRITE | Chef::ReservedNames::Win32::API::Security::FILE_GENERIC_EXECUTE | Chef::ReservedNames::Win32::API::Security::DELETE,
+    }
+  end
+
+  let(:expected_full_control_perms) do
+    {
+      :generic => Chef::ReservedNames::Win32::API::Security::GENERIC_ALL,
+      :specific => Chef::ReservedNames::Win32::API::Security::FILE_ALL_ACCESS,
+    }
+  end
+
+  RSpec::Matchers.define :have_expected_properties do |mask, type, flags|
+    match do |ace|
+      ace.mask == mask &&
+        ace.type == type &&
+        ace.flags == flags
+    end
+  end
+
+  def descriptor
+    get_security_descriptor(path)
+  end
+end
+
+shared_examples_for "a securable resource with existing target" do
+
+  include_context "diff disabled"
+
+  context "on Unix", :unix_only do
+    if ohai[:platform] == "aix"
+      let(:expected_user_name) { "guest" }
+    else
+      let(:expected_user_name) { "nobody" }
+    end
+    let(:expected_uid) { Etc.getpwnam(expected_user_name).uid }
+    let(:desired_gid) { 1337 }
+    let(:expected_gid) { 1337 }
+
+    describe "when setting the owner", :requires_root do
+      before do
+        resource.owner expected_user_name
+        resource.run_action(:create)
+      end
+
+      it "should set an owner" do
+        expect(File.lstat(path).uid).to eq(expected_uid)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+
+    end
+
+    describe "when setting the group", :requires_root do
+      before do
+        resource.group desired_gid
+        resource.run_action(:create)
+      end
+
+      it "should set a group" do
+        expect(File.lstat(path).gid).to eq(expected_gid)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+
+    end
+
+    describe "when setting the permissions from octal given as a String" do
+      before do
+        @mode_string = "776"
+        resource.mode @mode_string
+        resource.run_action(:create)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+    end
+
+    describe "when setting permissions from a literal octal Integer" do
+      before do
+        @mode_integer = 0776
+        resource.mode @mode_integer
+        resource.run_action(:create)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+    end
+
+    describe "when setting the suid bit", :requires_root do
+      before do
+        @suid_mode = 04776
+        resource.mode @suid_mode
+        resource.run_action(:create)
+      end
+
+      it "should set the suid bit" do
+        expect(File.lstat(path).mode & 007777).to eq(@suid_mode & 007777)
+      end
+
+      it "should retain the suid bit when updating the user" do
+        resource.user 1338
+        resource.run_action(:create)
+        expect(File.lstat(path).mode & 007777).to eq(@suid_mode & 007777)
+      end
+    end
+  end
+
+  context "on Windows", :windows_only do
+    include_context "use Windows permissions"
+
+    describe "when setting owner" do
+      before do
+        resource.owner(SID.admin_account_name)
+        resource.run_action(:create)
+      end
+
+      it "should set the owner" do
+        expect(descriptor.owner).to eq(SID.Administrator)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+    end
+
+    describe "when setting group" do
+      before do
+        resource.group("Administrators")
+        resource.run_action(:create)
+      end
+
+      it "should set the group" do
+        expect(descriptor.group).to eq(SID.Administrators)
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+    end
+
+    describe "when setting rights and deny_rights" do
+      before do
+        resource.deny_rights(:modify, "Guest")
+        resource.rights(:read, "Guest")
+        resource.run_action(:create)
+      end
+
+      it "should set the rights and deny_rights" do
+        expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_modify_perms) + allowed_acl(SID.Guest, expected_read_perms))
+      end
+
+      it "is marked as updated only if changes are made" do
+        expect(resource.updated_by_last_action?).to eq(expect_updated?)
+      end
+    end
+  end
+end
+
+shared_examples_for "a securable resource without existing target" do
+
+  include_context "diff disabled"
+
+  context "on Windows", :windows_only do
+    include_context "use Windows permissions"
+
+    it "leaves owner as system default on create if owner is not specified" do
+      expect(File.exist?(path)).to eq(false)
+      resource.run_action(:create)
+      expect(descriptor.owner).to eq(SID.default_security_object_owner)
+    end
+
+    it "sets owner when owner is specified" do
+      resource.owner "Guest"
+      resource.run_action(:create)
+      expect(descriptor.owner).to eq(SID.Guest)
+    end
+
+    it "fails to set owner when owner has invalid characters" do
+      expect { resource.owner 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
+    end
+
+    it "sets owner when owner is specified with a \\" do
+      resource.owner "#{ENV['USERDOMAIN']}\\Guest"
+      resource.run_action(:create)
+      expect(descriptor.owner).to eq(SID.Guest)
+    end
+
+    it "leaves owner alone if owner is not specified and resource already exists" do
+      arbitrary_non_default_owner = SID.Guest
+      expect(arbitrary_non_default_owner).not_to eq(SID.default_security_object_owner)
+
+      resource.owner "Guest" # Change to arbitrary_non_default_owner once issue #1508 is fixed
+      resource.run_action(:create)
+      expect(descriptor.owner).to eq(arbitrary_non_default_owner)
+
+      new_resource = create_resource
+      expect(new_resource.owner).to eq(nil)
+      new_resource.run_action(:create)
+      expect(descriptor.owner).to eq(arbitrary_non_default_owner)
+    end
+
+    it "leaves group as system default on create if group is not specified" do
+      expect(resource.group).to eq(nil)
+      expect(File.exist?(path)).to eq(false)
+      resource.run_action(:create)
+      expect(descriptor.group).to eq(SID.default_security_object_group)
+    end
+
+    it "sets group when group is specified" do
+      resource.group "Everyone"
+      resource.run_action(:create)
+      expect(descriptor.group).to eq(SID.Everyone)
+    end
+
+    it "fails to set group when group has invalid characters" do
+      expect { resource.group 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
+    end
+
+    it "leaves group alone if group is not specified and resource already exists" do
+      arbitrary_non_default_group = SID.Everyone
+      expect(arbitrary_non_default_group).not_to eq(SID.default_security_object_group)
+
+      resource.group "Everyone" # Change to arbitrary_non_default_group once issue #1508 is fixed
+      resource.run_action(:create)
+      expect(descriptor.group).to eq(arbitrary_non_default_group)
+
+      new_resource = create_resource
+      expect(new_resource.group).to eq(nil)
+      new_resource.run_action(:create)
+      expect(descriptor.group).to eq(arbitrary_non_default_group)
+    end
+
+    describe "with rights and deny_rights attributes" do
+
+      it "correctly sets :read rights" do
+        resource.rights(:read, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_read_perms))
+      end
+
+      it "correctly sets :read_execute rights" do
+        resource.rights(:read_execute, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_read_execute_perms))
+      end
+
+      it "correctly sets :write rights" do
+        resource.rights(:write, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_write_perms))
+      end
+
+      it "correctly sets :modify rights" do
+        resource.rights(:modify, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_modify_perms))
+      end
+
+      it "correctly sets :full_control rights" do
+        resource.rights(:full_control, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(allowed_acl(SID.Guest, expected_full_control_perms))
+      end
+
+      it "correctly sets deny_rights" do
+        # deny is an ACE with full rights, but is a deny type ace, not an allow type
+        resource.deny_rights(:full_control, "Guest")
+        resource.run_action(:create)
+        expect(explicit_aces).to eq(denied_acl(SID.Guest, expected_full_control_perms))
+      end
+
+      it "Sets multiple rights" do
+        resource.rights(:read, "Everyone")
+        resource.rights(:modify, "Guest")
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq(
+          allowed_acl(SID.Everyone, expected_read_perms) +
+          allowed_acl(SID.Guest, expected_modify_perms)
+        )
+      end
+
+      it "Sets deny_rights ahead of rights" do
+        resource.rights(:read, "Everyone")
+        resource.deny_rights(:modify, "Guest")
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq(
+          denied_acl(SID.Guest, expected_modify_perms) +
+          allowed_acl(SID.Everyone, expected_read_perms)
+        )
+      end
+
+      it "Sets deny_rights ahead of rights when specified in reverse order" do
+        resource.deny_rights(:modify, "Guest")
+        resource.rights(:read, "Everyone")
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq(
+          denied_acl(SID.Guest, expected_modify_perms) +
+          allowed_acl(SID.Everyone, expected_read_perms)
+        )
+      end
+
+    end
+
+    context "with a mode attribute" do
+      if windows?
+        Security ||= Chef::ReservedNames::Win32::API::Security # rubocop:disable Style/ConstantName
+      end
+
+      it "respects mode in string form as an octal number" do
+        #on windows, mode cannot modify owner and/or group permissons
+        #unless the owner and/or group as appropriate is specified
+        resource.mode "400"
+        resource.owner "Guest"
+        resource.group "Everyone"
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq([ ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ) ])
+      end
+
+      it "respects mode in numeric form as a ruby-interpreted octal" do
+        resource.mode 0700
+        resource.owner "Guest"
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq([ ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_WRITE | Security::FILE_GENERIC_EXECUTE | Security::DELETE) ])
+      end
+
+      it "respects the owner, group and everyone bits of mode" do
+        resource.mode 0754
+        resource.owner "Guest"
+        resource.group "Administrators"
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq([
+          ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_WRITE | Security::FILE_GENERIC_EXECUTE | Security::DELETE),
+          ACE.access_allowed(SID.Administrators, Security::FILE_GENERIC_READ | Security::FILE_GENERIC_EXECUTE),
+          ACE.access_allowed(SID.Everyone, Security::FILE_GENERIC_READ),
+        ])
+      end
+
+      it "respects the individual read, write and execute bits of mode" do
+        resource.mode 0421
+        resource.owner "Guest"
+        resource.group "Administrators"
+        resource.run_action(:create)
+
+        expect(explicit_aces).to eq([
+          ACE.access_allowed(SID.Guest, Security::FILE_GENERIC_READ),
+          ACE.access_allowed(SID.Administrators, Security::FILE_GENERIC_WRITE | Security::DELETE),
+          ACE.access_allowed(SID.Everyone, Security::FILE_GENERIC_EXECUTE),
+        ])
+      end
+
+      it "warns when mode tries to set owner bits but owner is not specified" do
+        @warn = []
+        allow(Chef::Log).to receive(:warn) { |msg| @warn << msg }
+
+        resource.mode 0400
+        resource.run_action(:create)
+
+        expect(@warn.include?("Mode 400 includes bits for the owner, but owner is not specified")).to be_truthy
+      end
+
+      it "warns when mode tries to set group bits but group is not specified" do
+        @warn = []
+        allow(Chef::Log).to receive(:warn) { |msg| @warn << msg }
+
+        resource.mode 0040
+        resource.run_action(:create)
+
+        expect(@warn.include?("Mode 040 includes bits for the group, but group is not specified")).to be_truthy
+      end
+    end
+
+    it "does not inherit aces if inherits is set to false" do
+      # We need at least one ACE if we're creating a securable without
+      # inheritance
+      resource.rights(:full_control, "Administrators")
+      resource.inherits(false)
+      resource.run_action(:create)
+
+      descriptor.dacl.each do |ace|
+        expect(ace.inherited?).to eq(false)
+      end
+    end
+
+    it "has the inheritable acls of parent directory if no acl is specified" do
+      expect(File.exist?(path)).to eq(false)
+
+      # Collect the inheritable acls form the parent by creating a file without
+      # any specific ACLs
+      parent_acls = parent_inheritable_acls
+
+      # On certain flavors of Windows the default list of ACLs sometimes includes
+      # non-inherited ACLs. Filter them out here.
+      parent_inherited_acls = parent_acls.dacl.collect do |ace|
+        ace.inherited?
+      end
+
+      resource.run_action(:create)
+
+      # Similarly filter out the non-inherited ACLs
+      resource_inherited_acls = descriptor.dacl.collect do |ace|
+        ace.inherited?
+      end
+
+      expect(resource_inherited_acls).to eq(parent_inherited_acls)
+    end
+
+  end
+end