chef 15.17.4 → 16.0.257

data/spec/functional/resource/user/mac_user_spec.rb

@@ -19,7 +19,7 @@ require "spec_helper"
 require "chef/mixin/shell_out"
 
 metadata = {
-  macos_gte_1014: true,
+  macos_1014: true,
   requires_root: true,
 }
 
@@ -29,7 +29,7 @@ describe "Chef::Resource::User with Chef::Provider::User::MacUser provider", met
   def clean_user
     shell_out!("/usr/bin/dscl . -delete '/Users/#{username}'")
   rescue Mixlib::ShellOut::ShellCommandFailed
-    # Raised when the user is already cleaned
+      # Raised when the user is already cleaned
   end
 
   def ensure_file_cache_path_exists

data/spec/functional/resource/windows_certificate_spec.rb

@@ -390,7 +390,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
       end
 
       after do
-        if File.exist?(out_path)
+        if File.exists?(out_path)
           File.delete(out_path)
         end
       end
@@ -405,7 +405,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
           expect(no_of_certificates).to eq(1)
         end
         it "Stores Certificate content at given path" do
-          expect(File.exist?(out_path)).to be_truthy
+          expect(File.exists?(out_path)).to be_truthy
         end
         it "Does not converge while fetching" do
           expect(win_certificate).not_to be_updated_by_last_action
@@ -425,7 +425,7 @@ describe Chef::Resource::WindowsCertificate, :windows_only do
           expect(stdout.string.strip).to be_empty
         end
         it "Does not store certificate content at given path" do
-          expect(File.exist?(out_path)).to be_falsy
+          expect(File.exists?(out_path)).to be_falsy
         end
         it "Does not converge while fetching" do
           expect(win_certificate).not_to be_updated_by_last_action

data/spec/functional/resource/windows_security_policy_spec.rb

@@ -0,0 +1,90 @@
+#
+# Author:: Ashwini Nehate (<anehate@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "functional/resource/base"
+require "chef/mixin/powershell_out"
+
+describe Chef::Resource::WindowsSecurityPolicy, :windows_only do
+  include Chef::Mixin::PowershellExec
+
+  let(:secoption) { "MaximumPasswordAge" }
+  let(:secvalue) { "30" }
+  let(:windows_test_run_context) do
+    node = Chef::Node.new
+    node.consume_external_attrs(OHAI_SYSTEM.data, {}) # node[:languages][:powershell][:version]
+    node.automatic["os"] = "windows"
+    node.automatic["platform"] = "windows"
+    node.automatic["platform_version"] = "6.1"
+    node.automatic["kernel"][:machine] = :x86_64 # Only 64-bit architecture is supported
+    empty_events = Chef::EventDispatch::Dispatcher.new
+    Chef::RunContext.new(node, {}, empty_events)
+  end
+
+  subject do
+    new_resource = Chef::Resource::WindowsSecurityPolicy.new(secoption, windows_test_run_context)
+    new_resource.secoption = secoption
+    new_resource.secvalue = secvalue
+    new_resource
+  end
+
+  describe "Set MaximumPasswordAge Policy" do
+    after {
+      subject.secvalue("60")
+      subject.run_action(:set)
+    }
+
+    it "should set MaximumPasswordAge to 30" do
+      subject.secvalue("30")
+      subject.run_action(:set)
+      expect(subject).to be_updated_by_last_action
+    end
+
+    it "should be idempotent" do
+      subject.secvalue("30")
+      subject.run_action(:set)
+      guardscript_and_script_time = subject.elapsed_time
+      subject.run_action(:set)
+      only_guardscript_time = subject.elapsed_time
+      expect(only_guardscript_time).to be < guardscript_and_script_time
+    end
+  end
+
+  describe "secoption and id: " do
+    it "accepts 'MinimumPasswordAge', 'MinimumPasswordAge', 'MaximumPasswordAge', 'MinimumPasswordLength', 'PasswordComplexity', 'PasswordHistorySize', 'LockoutBadCount', 'RequireLogonToChangePassword', 'ForceLogoffWhenHourExpire', 'NewAdministratorName', 'NewGuestName', 'ClearTextPassword', 'LSAAnonymousNameLookup', 'EnableAdminAccount', 'EnableGuestAccount' " do
+      expect { subject.secoption("MinimumPasswordAge") }.not_to raise_error
+      expect { subject.secoption("MaximumPasswordAge") }.not_to raise_error
+      expect { subject.secoption("MinimumPasswordLength") }.not_to raise_error
+      expect { subject.secoption("PasswordComplexity") }.not_to raise_error
+      expect { subject.secoption("PasswordHistorySize") }.not_to raise_error
+      expect { subject.secoption("LockoutBadCount") }.not_to raise_error
+      expect { subject.secoption("RequireLogonToChangePassword") }.not_to raise_error
+      expect { subject.secoption("ForceLogoffWhenHourExpire") }.not_to raise_error
+      expect { subject.secoption("NewAdministratorName") }.not_to raise_error
+      expect { subject.secoption("NewGuestName") }.not_to raise_error
+      expect { subject.secoption("ClearTextPassword") }.not_to raise_error
+      expect { subject.secoption("LSAAnonymousNameLookup") }.not_to raise_error
+      expect { subject.secoption("EnableAdminAccount") }.not_to raise_error
+      expect { subject.secoption("EnableGuestAccount") }.not_to raise_error
+    end
+
+    it "rejects any other option" do
+      expect { subject.secoption "XYZ" }.to raise_error(ArgumentError)
+    end
+  end
+end

data/spec/functional/resource/windows_task_spec.rb

@@ -513,13 +513,13 @@ describe Chef::Resource::WindowsTask, :windows_only do
         it "not raises any Argument error if frequency_modifier set as 'first, second, third' and day is provided" do
           subject.frequency_modifier "first, second, third"
           subject.day "Mon, Fri"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
         end
 
         it "not raises any Argument error if frequency_modifier 2 " do
           subject.frequency_modifier 2
           subject.day "Mon, Sun"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
         end
 
         it "raises argument error if frequency_modifier > 12" do
@@ -535,7 +535,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
         it "creates scheduled task to run task monthly on Monday and Friday of first, second and thrid week of month" do
           subject.frequency_modifier "first, second, third"
           subject.day "Mon, Fri"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)
@@ -558,7 +558,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
         it "creates scheduled task to run task monthly on every 6 months when frequency_modifier is 6 and to run on 1st and 2nd day of month" do
           subject.frequency_modifier 6
           subject.day "1, 2"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)
@@ -590,7 +590,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
 
         it "creates scheduled task to run monthly to run last day of the month" do
           subject.day "last"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)
@@ -611,7 +611,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
 
         it "day property set as 'lastday' creates scheduled task to run monthly to run last day of the month" do
           subject.day "lastday"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)
@@ -635,7 +635,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
         it "creates scheduled task to run monthly on last week of the month" do
           subject.frequency_modifier "last"
           subject.day "Mon, Fri"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)
@@ -659,7 +659,7 @@ describe Chef::Resource::WindowsTask, :windows_only do
       context "when wild card (*) set as months" do
         it "creates the scheduled task to run on 1st day of the all months" do
           subject.months "*"
-          expect { subject.after_created }.not_to raise_error
+          expect { subject.after_created }.not_to raise_error(ArgumentError)
           call_for_create_action
           current_resource = call_for_load_current_resource
           expect(current_resource.exists).to eq(true)

data/spec/functional/resource/windows_user_privilege_spec.rb

@@ -0,0 +1,193 @@
+#
+# Author:: Vasundhara Jagdale (<vasundhara.jagdale@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+#     http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../../spec_helper"
+require_relative "../../functional/resource/base"
+
+describe Chef::Resource::WindowsUserPrivilege, :windows_only do
+  let(:principal) { nil }
+  let(:privilege) { nil }
+  let(:users) { nil }
+  let(:sensitive) { true }
+
+  let(:windows_test_run_context) do
+    node = Chef::Node.new
+    node.consume_external_attrs(OHAI_SYSTEM.data, {}) # node[:languages][:powershell][:version]
+    node.automatic["os"] = "windows"
+    node.automatic["platform"] = "windows"
+    node.automatic["platform_version"] = "6.1"
+    node.automatic["kernel"][:machine] = :x86_64 # Only 64-bit architecture is supported
+    empty_events = Chef::EventDispatch::Dispatcher.new
+    Chef::RunContext.new(node, {}, empty_events)
+  end
+
+  subject do
+    new_resource = Chef::Resource::WindowsUserPrivilege.new(principal, windows_test_run_context)
+    new_resource.privilege = privilege
+    new_resource.principal = principal
+    new_resource.users = users
+    new_resource
+  end
+
+  describe "#add privilege" do
+    after { subject.run_action(:remove) }
+
+    context "when privilege is passed as string" do
+      let(:principal) { "Administrator" }
+      let(:privilege) { "SeCreateSymbolicLinkPrivilege" }
+
+      it "adds user to privilege" do
+        # Removing so that add update happens
+        subject.run_action(:remove)
+        subject.run_action(:add)
+        expect(subject).to be_updated_by_last_action
+      end
+
+      it "is idempotent" do
+        subject.run_action(:add)
+        subject.run_action(:add)
+        expect(subject).not_to be_updated_by_last_action
+      end
+    end
+
+    context "when privilege is passed as array" do
+      let(:principal) { "Administrator" }
+      let(:privilege) { %w{SeCreateSymbolicLinkPrivilege SeCreatePagefilePrivilege} }
+
+      it "adds user to privilege" do
+        subject.run_action(:add)
+        expect(subject).to be_updated_by_last_action
+      end
+
+      it "is idempotent" do
+        subject.run_action(:add)
+        subject.run_action(:add)
+        expect(subject).not_to be_updated_by_last_action
+      end
+    end
+  end
+
+  describe "#set privilege" do
+    after { remove_user_privilege("Administrator", subject.privilege) }
+
+    let(:principal) { "user_privilege" }
+    let(:users) { %w{Administrators Administrator} }
+    let(:privilege) { %w{SeCreateSymbolicLinkPrivilege} }
+
+    it "sets user to privilege" do
+      subject.action(:set)
+      subject.run_action(:set)
+      expect(subject).to be_updated_by_last_action
+    end
+
+    it "is idempotent" do
+      subject.action(:set)
+      subject.run_action(:set)
+      subject.run_action(:set)
+      expect(subject).not_to be_updated_by_last_action
+    end
+
+    it "raise error if users not provided" do
+      subject.users = nil
+      subject.action(:set)
+      expect { subject.run_action(:set) }.to raise_error(Chef::Exceptions::ValidationFailed)
+    end
+  end
+
+  describe "#remove privilege" do
+    let(:principal) { "Administrator" }
+    context "when privilege is passed as array" do
+      let(:privilege) { "SeCreateSymbolicLinkPrivilege" }
+      it "remove user from privilege" do
+        subject.run_action(:add)
+        subject.run_action(:remove)
+        expect(subject).to be_updated_by_last_action
+      end
+
+      it "is idempotent" do
+        subject.run_action(:add)
+        subject.run_action(:remove)
+        subject.run_action(:remove)
+        expect(subject).not_to be_updated_by_last_action
+      end
+    end
+
+    context "when privilege is passed as array" do
+      let(:privilege) { %w{SeCreateSymbolicLinkPrivilege SeCreatePagefilePrivilege} }
+      it "remove user from privilege" do
+        subject.run_action(:add)
+        subject.run_action(:remove)
+        expect(subject).to be_updated_by_last_action
+      end
+
+      it "is idempotent" do
+        subject.run_action(:add)
+        subject.run_action(:remove)
+        subject.run_action(:remove)
+        expect(subject).not_to be_updated_by_last_action
+      end
+    end
+  end
+
+  describe "running with non admin user" do
+    include Chef::Mixin::UserContext
+
+    let(:user) { "security_user" }
+    let(:password) { "Security@123" }
+    let(:principal) { "user_privilege" }
+    let(:users) { ["Administrators", "#{domain}\\security_user"] }
+    let(:privilege) { %w{SeCreateSymbolicLinkPrivilege} }
+
+    let(:domain) do
+      ENV["COMPUTERNAME"]
+    end
+
+    before do
+      allow_any_instance_of(Chef::Mixin::UserContext).to receive(:node).and_return({ "platform_family" => "windows" })
+      add_user = Mixlib::ShellOut.new("net user #{user} #{password} /ADD")
+      add_user.run_command
+      add_user.error!
+    end
+
+    after do
+      remove_user_privilege("#{domain}\\#{user}", subject.privilege)
+      delete_user = Mixlib::ShellOut.new("net user #{user} /delete")
+      delete_user.run_command
+      delete_user.error!
+    end
+
+    it "sets user to privilege" do
+      subject.action(:set)
+      subject.run_action(:set)
+      expect(subject).to be_updated_by_last_action
+    end
+
+    it "is idempotent" do
+      subject.action(:set)
+      subject.run_action(:set)
+      subject.run_action(:set)
+      expect(subject).not_to be_updated_by_last_action
+    end
+  end
+
+  def remove_user_privilege(user, privilege)
+    subject.action(:remove)
+    subject.principal = user
+    subject.privilege = privilege
+    subject.run_action(:remove)
+  end
+end

data/spec/functional/run_lock_spec.rb

@@ -15,7 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require File.expand_path("../spec_helper", __dir__)
+require_relative "../spec_helper"
 require "chef/client"
 
 describe Chef::RunLock do
@@ -435,7 +435,6 @@ describe Chef::RunLock do
 
     class TestRunLock < Chef::RunLock
       attr_accessor :client_process
-
       def create_lock
         super
         client_process.fire_event("created lock")

data/spec/functional/shell_spec.rb

@@ -82,7 +82,7 @@ describe Shell do
 
       require "pty"
       config = File.expand_path("shef-config.rb", CHEF_SPEC_DATA)
-      reader, writer, pid = PTY.spawn("bundle exec chef-shell -c #{config} #{options}")
+      reader, writer, pid = PTY.spawn("bundle exec chef-shell --no-multiline --no-singleline --no-colorize -c #{config} #{options}")
       read_until(reader, "chef (#{Chef::VERSION})>")
       yield reader, writer if block_given?
       writer.puts('"done"')
@@ -98,13 +98,13 @@ describe Shell do
       [output, e.status]
     end
 
-    it "boots correctly with -lauto", :executables do
+    it "boots correctly with -lauto" do
       output, exitstatus = run_chef_shell_with("-lauto")
       expect(output).to include("done")
       expect(exitstatus).to eq(0)
     end
 
-    it "sets the log_level from the command line", :executables do
+    it "sets the log_level from the command line" do
       output, exitstatus = run_chef_shell_with("-lfatal") do |out, keyboard|
         show_log_level_code = %q[puts "===#{Chef::Log.level}==="]
         keyboard.puts(show_log_level_code)
@@ -115,13 +115,13 @@ describe Shell do
     end
 
     context "on solo mode" do
-      it "starts correctly", :executables do
+      it "starts correctly" do
         output, exitstatus = run_chef_shell_with("--solo")
         expect(output).to include("done")
         expect(exitstatus).to eq(0)
       end
 
-      it "should be able to use the API", :executables do
+      it "should be able to use the API" do
         output, exitstatus = run_chef_shell_with("-s") do |out, keyboard|
           simple_api_get = "api.get('data')"
           keyboard.puts(simple_api_get)
@@ -132,7 +132,7 @@ describe Shell do
       end
     end
 
-    it "sets the override_runlist from the command line", :executables do
+    it "sets the override_runlist from the command line" do
       output, exitstatus = run_chef_shell_with("-o 'override::foo,override::bar'") do |out, keyboard|
         show_recipes_code = %q[puts "#{node["recipes"].inspect}"]
         keyboard.puts(show_recipes_code)