chef 16.13.16-universal-mingw32 → 17.3.48-universal-mingw32

data/lib/chef/resource/windows_share.rb

@@ -70,17 +70,17 @@ class Chef
       # Specifies which accounts are granted full permission to access the share. Use a comma-separated list to specify multiple accounts. An account may not be specified more than once in the FullAccess, ChangeAccess, or ReadAccess parameter lists, but may be specified once in the FullAccess, ChangeAccess, or ReadAccess parameter list and once in the NoAccess parameter list.
       property :full_users, Array,
         description: "The users that should have 'Full control' permissions on the share in domain\\username format.",
-        default: lazy { [] }, coerce: proc { |u| u.sort }
+        default: [], coerce: proc { |u| u.sort }
 
       # Specifies which users are granted modify permission to access the share
       property :change_users, Array,
         description: "The users that should have 'modify' permission on the share in domain\\username format.",
-        default: lazy { [] }, coerce: proc { |u| u.sort }
+        default: [], coerce: proc { |u| u.sort }
 
       # Specifies which users are granted read permission to access the share. Multiple users can be specified by supplying a comma-separated list.
       property :read_users, Array,
         description: "The users that should have 'read' permission on the share in domain\\username format.",
-        default: lazy { [] }, coerce: proc { |u| u.sort }
+        default: [], coerce: proc { |u| u.sort }
 
       # Specifies the lifetime of the new SMB share. A temporary share does not persist beyond the next restart of the computer. By default, new SMB shares are persistent, and non-temporary.
       property :temporary, [TrueClass, FalseClass],
@@ -118,11 +118,11 @@ class Chef
       # Specifies which files and folders in the SMB share are visible to users. AccessBased: SMB does not the display the files and folders for a share to a user unless that user has rights to access the files and folders. By default, access-based enumeration is disabled for new SMB shares. Unrestricted: SMB displays files and folders to a user even when the user does not have permission to access the items.
       # property :folder_enumeration_mode, String, equal_to: %(AccessBased Unrestricted)
 
-      load_current_value do |desired|
+      load_current_value do |new_resource|
         # this command selects individual objects because EncryptData & CachingMode have underlying
         # types that get converted to their Integer values by ConvertTo-Json & we need to make sure
         # those get written out as strings
-        share_state_cmd = "Get-SmbShare -Name '#{desired.share_name}' | Select-Object Name,Path, Description, Temporary, CATimeout, ContinuouslyAvailable, ConcurrentUserLimit, EncryptData"
+        share_state_cmd = "Get-SmbShare -Name '#{new_resource.share_name}' | Select-Object Name,Path, Description, Temporary, CATimeout, ContinuouslyAvailable, ConcurrentUserLimit, EncryptData"
 
         Chef::Log.debug("Running '#{share_state_cmd}' to determine share state'")
         ps_results = powershell_exec(share_state_cmd)
@@ -146,14 +146,14 @@ class Chef
         encrypt_data results["EncryptData"]
         # folder_enumeration_mode results['FolderEnumerationMode']
 
-        perm_state_cmd = %{Get-SmbShareAccess -Name "#{desired.share_name}" | Select-Object AccountName,AccessControlType,AccessRight}
+        perm_state_cmd = %{Get-SmbShareAccess -Name "#{new_resource.share_name}" | Select-Object AccountName,AccessControlType,AccessRight}
 
         Chef::Log.debug("Running '#{perm_state_cmd}' to determine share permissions state'")
         ps_perm_results = powershell_exec(perm_state_cmd)
 
         # we raise here instead of warning like above because we'd only get here if the above Get-SmbShare
         # command was successful and that continuing would leave us with 1/2 known state
-        raise "Could not determine #{desired.share_name} share permissions by running '#{perm_state_cmd}'" if ps_perm_results.error?
+        raise "Could not determine #{new_resource.share_name} share permissions by running '#{perm_state_cmd}'" if ps_perm_results.error?
 
         Chef::Log.debug("The Get-SmbShareAccess results were #{ps_perm_results.result}")
 
@@ -192,9 +192,7 @@ class Chef
         name
       end
 
-      action :create do
-        description "Create and modify Windows shares."
-
+      action :create, description: "Create or modify a Windows share." do
         # we do this here instead of requiring the property because :delete doesn't need path set
         raise "No path property set" unless new_resource.path
 
@@ -218,9 +216,7 @@ class Chef
         end
       end
 
-      action :delete do
-        description "Delete an existing Windows share."
-
+      action :delete, description: "Delete an existing Windows share." do
         if current_resource.nil?
           Chef::Log.debug("#{new_resource.share_name} does not exist - nothing to do")
         else
@@ -275,14 +271,11 @@ class Chef
         # users/groups will have their permissions updated with the same command that
         # sets it, but removes must be performed with Revoke-SmbShareAccess
         def users_to_revoke
-          @users_to_revoke ||= begin
-            # if the resource doesn't exist then nothing needs to be revoked
-            if current_resource.nil?
-              []
-            else # if it exists then calculate the current to new resource diffs
-              (current_resource.full_users + current_resource.change_users + current_resource.read_users) - (new_resource.full_users + new_resource.change_users + new_resource.read_users)
-            end
-          end
+          @users_to_revoke ||= if current_resource.nil?
+                                 []
+                               else # if it exists then calculate the current to new resource diffs
+                                 (current_resource.full_users + current_resource.change_users + current_resource.read_users) - (new_resource.full_users + new_resource.change_users + new_resource.read_users)
+                               end
         end
 
         # update existing permissions on a share

data/lib/chef/resource/windows_shortcut.rb

@@ -57,11 +57,11 @@ class Chef
       property :iconlocation, String,
         description: "Icon to use for the shortcut. Accepts the format of `path, index`, where index is the icon file to use. See Microsoft's [documentation](https://msdn.microsoft.com/en-us/library/3s9bx7at.aspx) for details"
 
-      load_current_value do |desired|
+      load_current_value do |new_resource|
         require "win32ole" if RUBY_PLATFORM.match?(/mswin|mingw32|windows/)
 
-        link = WIN32OLE.new("WScript.Shell").CreateShortcut(desired.shortcut_name)
-        name desired.shortcut_name
+        link = WIN32OLE.new("WScript.Shell").CreateShortcut(new_resource.shortcut_name)
+        name new_resource.shortcut_name
         target(link.TargetPath)
         arguments(link.Arguments)
         description(link.Description)
@@ -69,9 +69,7 @@ class Chef
         iconlocation(link.IconLocation)
       end
 
-      action :create do
-        description "Create or modify a Windows shortcut."
-
+      action :create, description: "Create or modify a Windows shortcut." do
         converge_if_changed do
           converge_by "creating shortcut #{new_resource.shortcut_name}" do
             link = WIN32OLE.new("WScript.Shell").CreateShortcut(new_resource.shortcut_name)

data/lib/chef/resource/windows_task.rb

@@ -21,6 +21,7 @@ require_relative "../resource"
 require_relative "../win32/security" if ChefUtils.windows_ruby?
 autoload :ISO8601, "iso8601" if ChefUtils.windows_ruby?
 require_relative "../util/path_helper"
+require_relative "../util/backup"
 require "win32/taskscheduler" if ChefUtils.windows_ruby?
 
 class Chef
@@ -48,7 +49,7 @@ class Chef
 
       **Create a scheduled task to run every 2 days**:
 
-      ``` ruby
+      ```ruby
       windows_task 'chef-client' do
         command 'chef-client'
         run_level :highest
@@ -236,6 +237,10 @@ class Chef
         introduced: "14.15", default: false,
         description: "To start the task at any time after its scheduled time has passed."
 
+      property :backup, [Integer, FalseClass],
+        introduced: "17.0", default: 5,
+        description: "Number of backups to keep of the task when modified/deleted. Set to false to disable backups."
+
       attr_accessor :exists, :task, :command_arguments
 
       VALID_WEEK_DAYS = %w{ mon tue wed thu fri sat sun * }.freeze
@@ -544,7 +549,7 @@ class Chef
           if @current_resource.exists
             task.get_task(new_resource.task_name)
             @current_resource.task = task
-            pathed_task_name = new_resource.task_name.start_with?('\\') ? new_resource.task_name : "\\#{new_resource.task_name}"
+            pathed_task_name = new_resource.task_name.start_with?("\\") ? new_resource.task_name : "\\#{new_resource.task_name}"
             @current_resource.task_name(pathed_task_name)
           end
           @current_resource
@@ -564,6 +569,7 @@ class Chef
 
         def update_task(task)
           converge_by("#{new_resource} task updated") do
+            do_backup
             task.set_account_information(new_resource.user, new_resource.password, new_resource.interactive_enabled)
             task.application_name = new_resource.command if new_resource.command
             task.parameters = new_resource.command_arguments if new_resource.command_arguments
@@ -948,6 +954,11 @@ class Chef
         def get_day(date)
           Date.strptime(date, "%m/%d/%Y").strftime("%a").upcase
         end
+
+        def do_backup
+          file = "C:/Windows/System32/Tasks/#{new_resource.task_name}"
+          Chef::Util::Backup.new(new_resource, file).backup!
+        end
       end
 
       action :create do
@@ -998,7 +1009,7 @@ class Chef
             end
           end
         else
-          logger.warn "#{new_resource} task does not exist - nothing to do"
+          logger.debug "#{new_resource} task does not exist - nothing to do"
         end
       end
 
@@ -1006,11 +1017,12 @@ class Chef
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           converge_by("delete scheduled task #{new_resource}") do
+            do_backup
             ts = ::Win32::TaskScheduler.new
             ts.delete(current_resource.task_name)
           end
         else
-          logger.warn "#{new_resource} task does not exist - nothing to do"
+          logger.debug "#{new_resource} task does not exist - nothing to do"
         end
       end
 
@@ -1018,14 +1030,14 @@ class Chef
         if current_resource.exists
           logger.trace "#{new_resource} task exists"
           if current_resource.task.status != "running"
-            logger.trace "#{new_resource} is not running - nothing to do"
+            logger.debug "#{new_resource} is not running - nothing to do"
           else
             converge_by("#{new_resource} task ended") do
               current_resource.task.stop
             end
           end
         else
-          logger.warn "#{new_resource} task does not exist - nothing to do"
+          logger.debug "#{new_resource} task does not exist - nothing to do"
         end
       end
 
@@ -1038,7 +1050,7 @@ class Chef
               run_schtasks "CHANGE", "ENABLE" => ""
             end
           else
-            logger.trace "#{new_resource} already enabled - nothing to do"
+            logger.debug "#{new_resource} already enabled - nothing to do"
           end
         else
           logger.fatal "#{new_resource} task does not exist - nothing to do"

data/lib/chef/resource/windows_uac.rb

@@ -29,7 +29,7 @@ class Chef
       examples <<~DOC
       **Disable UAC prompts for the admin**:
 
-      ``` ruby
+      ```ruby
       windows_uac 'Disable UAC prompts for the admin' do
         enable_uac true
         prompt_on_secure_desktop false
@@ -39,7 +39,7 @@ class Chef
 
       **Disable UAC entirely**:
 
-      ``` ruby
+      ```ruby
       windows_uac 'Disable UAC entirely' do
         enable_uac false
       end
@@ -72,9 +72,7 @@ class Chef
         equal_to: %i{auto_deny secure_prompt_for_creds prompt_for_creds},
         default: :prompt_for_creds
 
-      action :configure do
-        description 'Configures UAC by setting registry keys at \'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\''
-
+      action :configure, description: "Configures UAC by setting registry keys at `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System`." do
         registry_key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' do
           values [{ name: "EnableLUA", type: :dword, data: bool_to_reg(new_resource.enable_uac) },
                   { name: "ValidateAdminCodeSignatures", type: :dword, data: bool_to_reg(new_resource.require_signed_binaries) },

data/lib/chef/resource/windows_update_settings.rb

@@ -0,0 +1,259 @@
+#
+# Author:: Sölvi Páll Ásgeirsson (<solvip@gmail.com>)
+# Author:: Richard Lavey (richard.lavey@calastone.com)
+# Author:: Tim Smith (tsmith@chef.io)
+#
+# Copyright:: 2014-2017, Sölvi Páll Ásgeirsson.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+class Chef
+  class Resource
+    class WindowsUpdateSettings < Chef::Resource
+      unified_mode true
+
+      provides :windows_update_settings
+
+      description "Use the **windows_update_settings** resource to manage the various Windows Update patching options."
+      introduced "17.3"
+      examples <<~DOC
+      **Set Windows Update settings**:
+
+      ```ruby
+      windows_update_settings 'Settings to Configure Windows Nodes to automatically receive updates' do
+        disable_os_upgrades true
+        elevate_non_admins true
+        block_windows_update_website true
+        automatically_install_minor_updates true
+        scheduled_install_day 'Friday'
+        scheduled_install_hour 18
+        update_other_ms_products true
+        action :enable
+      end
+      ```
+      DOC
+
+      # required for the alias to pass validation
+      allowed_actions :set, :enable
+
+      DAYS = %W{Everyday Monday Tuesday Wednesday Thursday Friday Saturday Sunday}.freeze
+      UPDATE_OPTIONS = {
+                        notify: 2,
+                        download_and_notify: 3,
+                        download_and_schedule: 4,
+                        local_admin_decides: 5,
+                      }.freeze
+
+      # HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
+
+      property :disable_os_upgrades, [true, false], default: false, description: "Disable OS upgrades."
+      # options: 0 - let windows update update the os - false
+      #          1 - don't let windows update update the os - true
+
+      property :elevate_non_admins, [true, false], default: true, description: "Allow normal user accounts to temporarily be elevated to install patches."
+      # options: 0 - do not elevate a user to force an install - false
+      #          1 - do elevate the logged on user to install an update - true
+
+      property :add_to_target_wsus_group, [true, false], deprecated: "As of Chef Infra Client 17.3 the `add_to_target_wsus_group` property is no longer necessary."
+      # we set this registry value now automatically if the group name is set
+
+      property :target_wsus_group_name, String, description: "Add the node to a WSUS Target Group."
+      # options: --- a string representing the name of a target group you defined on your wsus server
+
+      property :wsus_server_url, String, description: "The URL of your WSUS server if you use one."
+      # options: --- a url for your internal update server in the form of https://my.updateserver.tld:4545 or whatever
+
+      property :wsus_status_server_url, String, deprecated: "As of Chef Infra Client 17.3 the `wsus_status_server_url` no longer needs to be set."
+      # this needs to be the same as wsus_server_url so we just set that value in both places now
+
+      # HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
+
+      property :block_windows_update_website, [true, false], default: false, description: "Block accessing the Windows Update website."
+      # options: 0 - allow access to the windows update website - false
+      #          1 - do not allow access to the windows update website - true
+
+      # HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
+
+      property :automatic_update_option, [Integer, Symbol], equal_to: UPDATE_OPTIONS.keys, coerce: proc { |x| UPDATE_OPTIONS.key(x) || x },
+                default: :download_and_schedule,
+                description: "Control what to do when updates are found. This allows you to notify, automatically download and notify to install, automatically download and schedule the install, or let the local admin decide what action to take."
+      # options: 2 - notify before download
+      #          3 - auto download and notify
+      #          4 - auto download and schedule - must also set day and time (below)
+      #          5 - allow the local admin to decide
+
+      property :automatically_install_minor_updates, [true, false], default: false, description: "Automatically install minor updates."
+      # options: 0 - do not automatically install minor updates - false
+      #          1 - of course, silently install them! - true
+
+      property :enable_detection_frequency, [true, false], default: false, description: "Used to override the OS default of how often to check for updates"
+      # do i want my nodes checking for updates at a time interval i chose?
+      # options: 0 - do not enable the option for a custom interval - false
+      #          1 - yeah, buddy, i want to set my own interval for checking for updates - true
+
+      property :custom_detection_frequency, Integer, default: 22, description: "If you decided to override the OS default detection frequency, specify your choice here. Valid choices are 0 - 22",
+      callbacks: {
+        "should be a valid detection frequency (0-22)" => lambda { |p|
+          p >= 0 && p <= 22
+        },
+      }
+      # a time period of between 0 and 22 hours to check for new updates
+      # this is a hex value - convert it from dec to hex
+
+      property :no_reboot_with_users_logged_on, [true, false], default: true, description: "Prevents the OS from rebooting while someone is on the console."
+      # options: 0 - user is notified of pending reboot in xx minutes - false/off
+      #          1 - user is notified of pending reboot but can defer - true/on
+
+      property :disable_automatic_updates, [true, false], default: false, description: "Disable Windows Update."
+      # options: 0 - enable automatic updates to the local system - false
+      #          1 - disable automatic updates - true
+
+      property :scheduled_install_day, String, equal_to: DAYS, default: DAYS.first, description: "A day of the week to tell Windows when to install updates."
+      # options: Everyday - install every day
+      #          Sunday - Saturday day of the week to install, 1 == sunday
+
+      property :scheduled_install_hour, Integer, description: "If you chose a scheduled day to install, then choose an hour on that day for you installation",
+                callbacks: {
+                  "should be a valid hour in a 24 hour clock" => lambda { |p|
+                    p > 0 && p < 25
+                  },
+                }
+      # options: --- 2-digit number representing an hour of the day, uses a 24-hour clock, 12 == noon, 24 == midnight
+
+      property :update_other_ms_products, [true, false], default: true, description: "Allows for other Microsoft products to get updates too"
+      # options: 0 - do not allow wu to update other apps - remove key from hive - false/off
+      #          1 - please update all my stuff! - true/on
+
+      # \AU\AllowMUUpdateService dword: 1
+
+      property :custom_wsus_server, [true, false], deprecated: "As of Chef Infra Client 17.3 the `custom_wsus_server` no longer needs to be setup when specifying a WSUS endpoint."
+      # not necessary as we set this registry value automatically if a URL is set
+
+      action :set, description: "Set Windows Update settings." do
+        actual_day = convert_day(new_resource.scheduled_install_day)
+
+        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate' do
+          recursive true
+          values [{
+            name: "DisableOSUpgrade",
+            type: :dword,
+            data: new_resource.disable_os_upgrades ? 1 : 0,
+          },
+          {
+            name: "ElevateNonAdmins",
+            type: :dword,
+            data: new_resource.elevate_non_admins ? 1 : 0,
+          },
+          {
+            name: "TargetGroupEnabled",
+            type: :dword,
+            data: new_resource.target_wsus_group_name ? 1 : 0,
+          },
+          {
+            name: "TargetGroup",
+            type: :string,
+            data: new_resource.target_wsus_group_name,
+          },
+          {
+            name: "WUServer",
+            type: :string,
+            data: new_resource.wsus_server_url,
+          },
+          {
+            name: "WUStatusServer",
+            type: :string,
+            data: new_resource.wsus_server_url, # status server and server need to be the same. Why? Ask Microsoft
+          }]
+          action :create
+        end
+
+        registry_key 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer' do
+          recursive true
+          values [{
+            name: "NoWindowsUpdate",
+            type: :dword,
+            data: new_resource.block_windows_update_website ? 1 : 0,
+          }]
+          action :create
+        end
+
+        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU' do
+          recursive true
+          values [{
+            name: "AUOptions",
+            type: :dword,
+            data: UPDATE_OPTIONS[new_resource.automatic_update_option],
+          },
+          {
+            name: "AutoInstallMinorUpdates",
+            type: :dword,
+            data: new_resource.automatically_install_minor_updates ? 1 : 0,
+          },
+          {
+            name: "DetectionFrequencyEnabled",
+            type: :dword,
+            data: new_resource.enable_detection_frequency ? 1 : 0,
+          },
+          {
+            name: "DetectionFrequency",
+            type: :dword,
+            data: new_resource.custom_detection_frequency,
+          },
+          {
+            name: "NoAutoRebootWithLoggedOnUsers",
+            type: :dword,
+            data: new_resource.no_reboot_with_users_logged_on ? 1 : 0,
+          },
+          {
+            name: "NoAutoUpdate",
+            type: :dword,
+            data: new_resource.disable_automatic_updates ? 1 : 0,
+          },
+          {
+            name: "ScheduledInstallDay",
+            type: :dword,
+            data: actual_day,
+          },
+          {
+            name: "ScheduledInstallTime",
+            type: :dword,
+            data: new_resource.scheduled_install_hour,
+          },
+          {
+            name: "AllowMUUpdateService",
+            type: :dword,
+            data: new_resource.update_other_ms_products ? 1 : 0,
+          },
+          {
+            name: "UseWUServer",
+            type: :dword,
+            data: new_resource.wsus_server_url ? 1 : 0, # if we have a URL set then want to turn on WSUS functionality
+          }]
+          action :create
+        end
+      end
+
+      action_class do
+        def convert_day(day)
+          DAYS.index(day)
+        end
+
+        # support the old name as well
+        alias_method :action_enable, :action_set
+      end
+    end
+  end
+end