chef 16.18.30 → 17.10.163

data/lib/chef/resource/inspec_waiver_file_entry.rb

@@ -0,0 +1,156 @@
+#
+# Author:: Davin Taddeo (<davin@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+autoload :YAML, "yaml"
+require "date"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+
+class Chef
+  class Resource
+    class InspecWaiverFileEntry < Chef::Resource
+      provides :inspec_waiver_file_entry
+      unified_mode true
+
+      description "Use the **inspec_waiver_file_entry** resource to add or remove entries from an InSpec waiver file. This can be used in conjunction with the Compliance Phase."
+      introduced "17.1"
+      examples <<~DOC
+      **Add an InSpec waiver entry to a given waiver file**:
+
+      ```ruby
+        inspec_waiver_file_entry 'Add waiver entry for control' do
+          file_path 'C:\\chef\\inspec_waiver_file.yml'
+          control 'my_inspec_control_01'
+          run_test false
+          justification "The subject of this control is not managed by #{ChefUtils::Dist::Infra::PRODUCT} on the systems in policy group \#{node['policy_group']}"
+          expiration '2022-01-01'
+          action :add
+        end
+      ```
+
+      **Add an InSpec waiver entry to a given waiver file using the 'name' property to identify the control**:
+
+      ```ruby
+        inspec_waiver_file_entry 'my_inspec_control_01' do
+          justification "The subject of this control is not managed by #{ChefUtils::Dist::Infra::PRODUCT} on the systems in policy group \#{node['policy_group']}"
+          action :add
+        end
+      ```
+
+      **Remove an InSpec waiver entry to a given waiver file**:
+
+      ```ruby
+        inspec_waiver_file_entry "my_inspec_control_01" do
+          action :remove
+        end
+      ```
+      DOC
+
+      property :control, String,
+        name_property: true,
+        description: "The name of the control being added or removed to the waiver file"
+
+      property :file_path, String,
+        required: true,
+        description: "The path to the waiver file being modified",
+        default: "#{ChefConfig::Config.etc_chef_dir}/inspec_waivers.yml",
+        default_description: "`/etc/chef/inspec_waivers.yml` on Linux/Unix and `C:\\chef\\inspec_waivers.yml` on Windows"
+
+      property :expiration, String,
+        description: "The expiration date of the given waiver - provided in YYYY-MM-DD format",
+        callbacks: {
+          "Expiration date should be a valid calendar date and match the following format: YYYY-MM-DD" => proc { |e|
+            re = Regexp.new("\\d{4}-\\d{2}-\\d{2}$").freeze
+            if re.match?(e)
+              Date.valid_date?(*e.split("-").map(&:to_i))
+            else
+              e.nil?
+            end
+          },
+        }
+
+      property :run_test, [true, false],
+        description: "If present and `true`, the control will run and be reported, but failures in it won’t make the overall run fail. If absent or `false`, the control will not be run."
+
+      property :justification, String,
+        description: "Can be any text you want and might include a reason for the waiver as well as who signed off on the waiver."
+
+      property :backup, [false, Integer],
+        description: "The number of backups to be kept in `/var/chef/backup` (for UNIX- and Linux-based platforms) or `C:/chef/backup` (for the Microsoft Windows platform). Set to `false` to prevent backups from being kept.",
+        default: false
+
+      action :add do
+        if new_resource.justification.nil? || new_resource.justification == ""
+          raise Chef::Exceptions::ValidationFailed, "Entries in the InSpec waiver file must have a justification given, this parameter must have a value."
+        end
+
+        filename = new_resource.file_path
+        waiver_hash = load_waiver_file_to_hash(filename)
+        control_hash = {}
+        control_hash["expiration_date"] = new_resource.expiration.to_s unless new_resource.expiration.nil?
+        control_hash["run"] = new_resource.run_test unless new_resource.run_test.nil?
+        control_hash["justification"] = new_resource.justification.to_s
+
+        unless waiver_hash[new_resource.control] == control_hash
+          waiver_hash[new_resource.control] = control_hash
+          waiver_hash = waiver_hash.sort.to_h
+
+          file "Update Waiver File #{new_resource.file_path} to update waiver for control #{new_resource.control}" do
+            path new_resource.file_path
+            content ::YAML.dump(waiver_hash)
+            backup new_resource.backup
+            action :create
+          end
+        end
+      end
+
+      action :remove do
+        filename = new_resource.file_path
+        waiver_hash = load_waiver_file_to_hash(filename)
+        if waiver_hash.key?(new_resource.control)
+          waiver_hash.delete(new_resource.control)
+          waiver_hash = waiver_hash.sort.to_h
+          file "Update Waiver File #{new_resource.file_path} to remove waiver for control #{new_resource.control}" do
+            path new_resource.file_path
+            content ::YAML.dump(waiver_hash)
+            backup new_resource.backup
+            action :create
+          end
+        end
+      end
+
+      action_class do
+        def load_waiver_file_to_hash(file_name)
+          if %r{(/|C:\\).*(.yaml|.yml)}i.match?(file_name)
+            if ::File.exist?(file_name)
+              hash = ::YAML.load_file(file_name)
+              if hash == false || hash.nil? || hash == ""
+                {}
+              else
+                ::YAML.load_file(file_name)
+              end
+            else
+              {}
+            end
+          else
+            raise "Waiver files needs to be a YAML file which should have a .yaml or .yml extension -\"#{file_name}\" does not have an appropriate extension"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/kernel_module.rb

@@ -15,7 +15,7 @@ class Chef
 
       provides :kernel_module
 
-      description "Use the **kernel_module** resource to manage kernel modules on Linux systems. This resource can load, unload, blacklist, disable, install, and uninstall modules."
+      description "Use the **kernel_module** resource to manage kernel modules on Linux systems. This resource can load, unload, blacklist, disable, enable, install, and uninstall modules."
       introduced "14.3"
       examples <<~DOC
         Install and load a kernel module, and ensure it loads on reboot.
@@ -68,13 +68,21 @@ class Chef
         end
         ```
 
-        Disable a kernel module.
+        Disable a kernel module so that it is not installable.
 
         ```ruby
         kernel_module 'loop' do
           action :disable
         end
         ```
+
+        Enable a kernel module so that it is can be installed.  Does not load or install.
+
+        ```ruby
+        kernel_module 'loop' do
+          action :enable
+        end
+        ```
       DOC
 
       property :modname, String,
@@ -93,9 +101,7 @@ class Chef
         description: "The modprobe.d directory.",
         default: "/etc/modprobe.d"
 
-      action :install do
-        description "Load kernel module, and ensure it loads on reboot."
-
+      action :install, description: "Load kernel module, and ensure it loads on reboot." do
         with_run_context :root do
           find_resource(:execute, "update initramfs") do
             command initramfs_command
@@ -103,6 +109,9 @@ class Chef
           end
         end
 
+        # Remove the "disable file" before trying to install
+        action_enable
+
         # create options file before loading the module
         unless new_resource.options.nil?
           file "#{new_resource.unload_dir}/options_#{new_resource.modname}.conf" do
@@ -123,8 +132,7 @@ class Chef
         end
       end
 
-      action :uninstall do
-        description "Unload a kernel module and remove module config, so it doesn't load on reboot."
+      action :uninstall, description: "Unload a kernel module and remove module config, so it doesn't load on reboot." do
         with_run_context :root do
           find_resource(:execute, "update initramfs") do
             command initramfs_command
@@ -149,9 +157,7 @@ class Chef
         action_unload
       end
 
-      action :blacklist do
-        description "Blacklist a kernel module."
-
+      action :blacklist, description: "Blacklist a kernel module." do
         with_run_context :root do
           find_resource(:execute, "update initramfs") do
             command initramfs_command
@@ -167,9 +173,7 @@ class Chef
         action_unload
       end
 
-      action :disable do
-        description "Disable a kernel module."
-
+      action :disable, description: "Disable a kernel module. **New in Chef Infra Client 15.2.**" do
         with_run_context :root do
           find_resource(:execute, "update initramfs") do
             command initramfs_command
@@ -185,9 +189,21 @@ class Chef
         action_unload
       end
 
-      action :load do
-        description "Load a kernel module."
+      action :enable, description: "Enable a kernel module.  Reverse :disable actions" do
+        with_run_context :root do
+          find_resource(:execute, "update initramfs") do
+            command initramfs_command
+            action :nothing
+          end
+        end
 
+        file "#{new_resource.unload_dir}/disable_#{new_resource.modname}.conf" do
+          action :delete
+          notifies :run, "execute[update initramfs]", :delayed
+        end
+      end
+
+      action :load, description: "Load a kernel module." do
         unless module_loaded?
           converge_by("load kernel module #{new_resource.modname}") do
             shell_out!("modprobe #{new_resource.modname}")
@@ -195,9 +211,7 @@ class Chef
         end
       end
 
-      action :unload do
-        description "Unload kernel module."
-
+      action :unload, description: "Unload kernel module." do
         if module_loaded?
           converge_by("unload kernel module #{new_resource.modname}") do
             shell_out!("modprobe -r #{new_resource.modname}")

data/lib/chef/resource/launchd.rb

@@ -36,7 +36,7 @@ class Chef
 
       property :backup, [Integer, FalseClass],
         desired_state: false,
-        description: "The number of backups to be kept in /var/chef/backup. Set to false to prevent backups from being kept."
+        description: "The number of backups to be kept in `/var/chef/backup`. Set to `false` to prevent backups from being kept."
 
       property :cookbook, String,
         desired_state: false,
@@ -84,7 +84,7 @@ class Chef
                   end
 
           # Check to make sure that our array only has hashes
-          unless array.all? { |obj| obj.is_a?(Hash) }
+          unless array.all?(Hash)
             error_msg = "start_calendar_interval must be a single hash or an array of hashes!"
             raise Chef::Exceptions::ValidationFailed, error_msg
           end
@@ -98,7 +98,7 @@ class Chef
               raise Chef::Exceptions::ValidationFailed, error_msg
             end
 
-            unless entry.values.all? { |val| val.is_a?(Integer) }
+            unless entry.values.all?(Integer)
               failed_values = entry.values.reject { |val| val.is_a?(Integer) }.join(", ")
               error_msg = "Invalid value(s) (#{failed_values}) for start_calendar_interval item.  Values must be integers!"
               raise Chef::Exceptions::ValidationFailed, error_msg
@@ -197,10 +197,10 @@ class Chef
         description: "The intended purpose of the job: `Adaptive`, `Background`, `Interactive`, or `Standard`."
 
       property :program, String,
-        description: "The first argument of execvp, typically the file name associated with the file to be executed. This value must be specified if program_arguments is not specified, and vice-versa."
+        description: "The first argument of `execvp`, typically the file name associated with the file to be executed. This value must be specified if `program_arguments` is not specified, and vice-versa."
 
       property :program_arguments, Array,
-        description: "The second argument of execvp. If program is not specified, this property must be specified and will be handled as if it were the first argument."
+        description: "The second argument of `execvp`. If program is not specified, this property must be specified and will be handled as if it were the first argument."
 
       property :queue_directories, Array,
         description: "An array of non-empty directories which, if any are modified, will cause a job to be started."
@@ -238,9 +238,6 @@ class Chef
       property :time_out, Integer,
         description: "The amount of time (in seconds) a job may be idle before it times out. If no value is specified, the default timeout value for launchd will be used."
 
-      property :umask, Integer,
-        description: "A decimal value to pass to `umask` before running a job."
-
       property :username, String,
         description: "When launchd is run as the root user, the user to run the job as."
 

data/lib/chef/resource/locale.rb

@@ -49,7 +49,7 @@ class Chef
 
       property :lc_env, Hash,
         description: "A Hash of LC_* env variables in the form of `({ 'LC_ENV_VARIABLE' => 'VALUE' })`.",
-        default: lazy { {} },
+        default: {},
         coerce: proc { |h|
           if h.respond_to?(:keys)
             invalid_keys = h.keys - LC_VARIABLES
@@ -97,8 +97,7 @@ class Chef
         powershell_exec("Get-WinSystemLocale").result["Name"]
       end
 
-      action :update do
-        description "Update the system's locale."
+      action :update, description: "Update the system's locale." do
         converge_if_changed do
           set_system_locale
         end
@@ -114,8 +113,11 @@ class Chef
           end
 
           requirements.assert(:all_actions) do |a|
-            # RHEL/CentOS type platforms don't have locale-gen
-            a.assertion { which("locale-gen") }
+            a.assertion do
+              # RHEL/CentOS type platforms don't have locale-gen
+              # Windows has locale-gen as part of the install, but not in the path
+              which("locale-gen") || windows?
+            end
             a.failure_message(Chef::Exceptions::ProviderNotFound, "The locale resource requires the locale-gen tool")
           end
         end

data/lib/chef/resource/lwrp_base.rb

@@ -26,6 +26,7 @@ require_relative "../exceptions"
 require_relative "../mixin/convert_to_class_name"
 require_relative "../mixin/from_file"
 require_relative "../mixin/params_validate" # for DelayedEvaluator
+require_relative "../version"
 
 class Chef
   class Resource
@@ -36,7 +37,7 @@ class Chef
     class LWRPBase < Resource
 
       # Class methods
-      class <<self
+      class << self
 
         include Chef::Mixin::ConvertToClassName
         include Chef::Mixin::FromFile
@@ -53,6 +54,10 @@ class Chef
           resource_class.run_context = run_context
           resource_class.class_from_file(filename)
 
+          if !resource_class.unified_mode && !deprecated_class(resource_class) && cookbook_name.to_s != "chef_client_updater"
+            Chef.deprecated :unified_mode, "The #{resource_class.resource_name} resource in the #{cookbook_name} cookbook should declare `unified_mode true`", filename
+          end
+
           # Make a useful string for the class (rather than <Class:312894723894>)
           resource_class.instance_eval do
             define_singleton_method(:to_s) do
@@ -117,6 +122,20 @@ class Chef
 
           superclass.respond_to?(m) ? superclass.send(m) : default
         end
+
+        # Return true if the resource has been deprecated on this version.
+        #
+        # XXX: for now we only look at chef_version_for_provides, reversing the
+        # resource node_map to determine if the resource provides anything which is
+        # wired up is difficult.
+        #
+        def deprecated_class(resource_class)
+          if resource_class.chef_version_for_provides && Chef::VERSION !~ resource_class.chef_version_for_provides
+            return true
+          end
+
+          false
+        end
       end
     end
   end

data/lib/chef/resource/macos_userdefaults.rb

@@ -17,6 +17,7 @@
 
 require_relative "../resource"
 require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+require "corefoundation" if RUBY_PLATFORM.match?(/darwin/)
 autoload :Plist, "plist"
 
 class Chef
@@ -50,15 +51,17 @@ class Chef
         end
         ```
 
-        **Specifying the type of a key to skip automatic type detection**
+        **Setting a value for specific user and hosts**
 
         ```ruby
-        macos_userdefaults 'Finder expanded save dialogs' do
-          key 'NSNavPanelExpandedStateForSaveMode'
-          value 'TRUE'
-          type 'bool'
+        macos_userdefaults 'Enable macOS firewall' do
+          key 'globalstate'
+          value 1
+          user 'jane'
+          host :current
         end
         ```
+
       DOC
 
       property :domain, String,
@@ -78,177 +81,84 @@ class Chef
         required: true
 
       property :host, [String, Symbol],
-        description: "Set either :current or a hostname to set the user default at the host level.",
+        description: "Set either :current, :all or a hostname to set the user default at the host level.",
+        default: :all,
         desired_state: false,
         introduced: "16.3"
 
       property :value, [Integer, Float, String, TrueClass, FalseClass, Hash, Array],
         description: "The value of the key. Note: With the `type` property set to `bool`, `String` forms of Boolean true/false values that Apple accepts in the defaults command will be coerced: 0/1, 'TRUE'/'FALSE,' 'true'/false', 'YES'/'NO', or 'yes'/'no'.",
-        required: [:write],
-        coerce: proc { |v| v.is_a?(Hash) ? v.transform_keys(&:to_s) : v } # make sure keys are all strings for comparison
+        required: [:write]
 
       property :type, String,
         description: "The value type of the preference key.",
         equal_to: %w{bool string int float array dict},
-        desired_state: false
+        desired_state: false,
+        deprecated: true
 
-      property :user, String,
-        description: "The system user that the default will be applied to.",
+      property :user, [String, Symbol],
+        description: "The system user that the default will be applied to. Set :current for current user, :all for all users or pass a valid username",
+        default: :current,
         desired_state: false
 
       property :sudo, [TrueClass, FalseClass],
-        description: "Set to true if the setting you wish to modify requires privileged access. This requires passwordless sudo for the '/usr/bin/defaults' command to be setup for the user running #{ChefUtils::Dist::Infra::PRODUCT}.",
+        description: "Set to true if the setting you wish to modify requires privileged access. This requires passwordless sudo for the `/usr/bin/defaults` command to be setup for the user running #{ChefUtils::Dist::Infra::PRODUCT}.",
         default: false,
-        desired_state: false
-
-      load_current_value do |desired|
-        Chef::Log.debug "#load_current_value: shelling out \"#{defaults_export_cmd(desired).join(" ")}\" to determine state"
-        state = shell_out(defaults_export_cmd(desired), user: desired.user)
-
-        if state.error? || state.stdout.empty?
-          Chef::Log.debug "#load_current_value: #{defaults_export_cmd(desired).join(" ")} returned stdout: #{state.stdout} and stderr: #{state.stderr}"
-          current_value_does_not_exist!
-        end
-
-        plist_data = ::Plist.parse_xml(state.stdout)
-
-        # handle the situation where the key doesn't exist in the domain
-        if plist_data.key?(desired.key)
-          key desired.key
-        else
-          current_value_does_not_exist!
-        end
-
-        value plist_data[desired.key]
-      end
+        desired_state: false,
+        deprecated: true
 
-      #
-      # The defaults command to export a domain
-      #
-      # @return [Array] defaults command
-      #
-      def defaults_export_cmd(resource)
-        state_cmd = ["/usr/bin/defaults"]
+      load_current_value do |new_resource|
+        Chef::Log.debug "#load_current_value: attempting to read \"#{new_resource.domain}\" value from preferences to determine state"
 
-        if resource.host == "current"
-          state_cmd.concat(["-currentHost"])
-        elsif resource.host # they specified a non-nil value, which is a hostname
-          state_cmd.concat(["-host", resource.host])
-        end
+        pref = get_preference(new_resource)
+        current_value_does_not_exist! if pref.nil?
 
-        state_cmd.concat(["export", resource.domain, "-"])
-        state_cmd
+        key new_resource.key
+        value pref
       end
 
-      action :write do
-        description "Write the value to the specified domain/key."
-
+      action :write, description: "Write the value to the specified domain/key." do
         converge_if_changed do
-          cmd = defaults_modify_cmd
-          Chef::Log.debug("Updating defaults value by shelling out: #{cmd.join(" ")}")
-
-          shell_out!(cmd, user: new_resource.user)
+          Chef::Log.debug("Updating defaults value for #{new_resource.key} in #{new_resource.domain}")
+          CF::Preferences.set!(new_resource.key, new_resource.value, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
         end
       end
 
-      action :delete do
-        description "Delete a key from a domain."
-
+      action :delete, description: "Delete a key from a domain." do
         # if it's not there there's nothing to remove
-        return unless current_resource
+        return if current_resource.nil?
 
         converge_by("delete domain:#{new_resource.domain} key:#{new_resource.key}") do
-
-          cmd = defaults_modify_cmd
-          Chef::Log.debug("Removing defaults key by shelling out: #{cmd.join(" ")}")
-
-          shell_out!(cmd, user: new_resource.user)
+          Chef::Log.debug("Removing defaults key: #{new_resource.key}")
+          CF::Preferences.set!(new_resource.key, nil, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
         end
       end
 
-      action_class do
-        #
-        # The command used to write or delete delete values from domains
-        #
-        # @return [Array] Array representation of defaults command to run
-        #
-        def defaults_modify_cmd
-          cmd = ["/usr/bin/defaults"]
-
-          if new_resource.host == :current
-            cmd.concat(["-currentHost"])
-          elsif new_resource.host # they specified a non-nil value, which is a hostname
-            cmd.concat(["-host", new_resource.host])
-          end
-
-          cmd.concat([action.to_s, new_resource.domain, new_resource.key])
-          cmd.concat(processed_value) if action == :write
-          cmd.prepend("sudo") if new_resource.sudo
-          cmd
-        end
-
-        #
-        # convert the provided value into the format defaults expects
-        #
-        # @return [array] array of values starting with the type if applicable
-        #
-        def processed_value
-          type = new_resource.type || value_type(new_resource.value)
-
-          # when dict this creates an array of values ["Key1", "Value1", "Key2", "Value2" ...]
-          cmd_values = ["-#{type}"]
-
-          case type
-          when "dict"
-            cmd_values.concat(new_resource.value.flatten)
-          when "array"
-            cmd_values.concat(new_resource.value)
-          when "bool"
-            cmd_values.concat(bool_to_defaults_bool(new_resource.value))
-          else
-            cmd_values.concat([new_resource.value])
-          end
-
-          cmd_values
-        end
-
-        #
-        # defaults booleans on the CLI must be 'TRUE' or 'FALSE' so convert various inputs to that
-        #
-        # @param [String, Integer, Boolean] input <description>
-        #
-        # @return [String] TRUE or FALSE
-        #
-        def bool_to_defaults_bool(input)
-          return ["TRUE"] if [true, "TRUE", "1", "true", "YES", "yes"].include?(input)
-          return ["FALSE"] if [false, "FALSE", "0", "false", "NO", "no"].include?(input)
+      def get_preference(new_resource)
+        CF::Preferences.get(new_resource.key, new_resource.domain, to_cf_user(new_resource.user), to_cf_host(new_resource.host))
+      end
 
-          # make sure it's very clear bad input was given
-          raise ArgumentError, "#{input} cannot be converted to a boolean value for use with Apple's defaults command. Acceptable values are: 'TRUE', 'YES', 'true, 'yes', '0', true, 'FALSE', 'false', 'NO', 'no', '1', or false."
+      # Return valid hostname based on the input from host property
+      def to_cf_host(value)
+        case value
+        when :all
+          CF::Preferences::ALL_HOSTS
+        when :current
+          CF::Preferences::CURRENT_HOST
+        else
+          value
         end
+      end
 
-        #
-        # convert ruby type to defaults type
-        #
-        # @param [Integer, Float, String, TrueClass, FalseClass, Hash, Array] value The value being set
-        #
-        # @return [string, nil] the type value used by defaults or nil if not applicable
-        #
-        def value_type(value)
-          case value
-          when true, false
-            "bool"
-          when Integer
-            "int"
-          when Float
-            "float"
-          when Hash
-            "dict"
-          when Array
-            "array"
-          when String
-            "string"
-          end
+      # Return valid username based on the input from user property
+      def to_cf_user(value)
+        case value
+        when :all
+          CF::Preferences::ALL_USERS
+        when :current
+          CF::Preferences::CURRENT_USER
+        else
+          value
         end
       end
     end