chef 17.10.0 → 18.0.169

data/lib/chef/resource/openbsd_package.rb

@@ -25,7 +25,6 @@ require_relative "../provider/package/openbsd"
 class Chef
   class Resource
     class OpenbsdPackage < Chef::Resource::Package
-      unified_mode true
       provides :openbsd_package
       provides :package, os: "openbsd"
 

data/lib/chef/resource/openssl_dhparam.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_dhparam) { true }
 
       description "Use the **openssl_dhparam** resource to generate `dhparam.pem` files. If a valid `dhparam.pem` file is found at the specified location, no new file will be created. If a file is found at the specified location but it is not a valid `dhparam.pem` file, it will be overwritten."

data/lib/chef/resource/openssl_ec_private_key.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_ec_private_key
 
       description "Use the **openssl_ec_private_key** resource to generate an elliptic curve (EC) private key file. If a valid EC key file can be opened at the specified location, no new file will be created. If the EC key file cannot be opened, either because it does not exist or because the password to the EC key file does not match the password in the recipe, then it will be overwritten."

data/lib/chef/resource/openssl_ec_public_key.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_ec_public_key
 
       description "Use the **openssl_ec_public_key** resource to generate elliptic curve (EC) public key files from a given EC private key."

data/lib/chef/resource/openssl_rsa_private_key.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_rsa_private_key) { true }
       provides(:openssl_rsa_key) { true } # legacy cookbook resource name
 

data/lib/chef/resource/openssl_rsa_public_key.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_rsa_public_key) { true }
 
       examples <<~DOC

data/lib/chef/resource/openssl_x509_certificate.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_certificate
       provides(:openssl_x509) { true } # legacy cookbook name.
 

data/lib/chef/resource/openssl_x509_crl.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_crl
 
       description "Use the **openssl_x509_crl** resource to generate PEM-formatted x509 certificate revocation list (CRL) files."

data/lib/chef/resource/openssl_x509_request.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_request
 
       description "Use the **openssl_x509_request** resource to generate PEM-formatted x509 certificates requests. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate."

data/lib/chef/resource/osx_profile.rb

@@ -25,7 +25,6 @@ autoload :Plist, "plist"
 class Chef
   class Resource
     class OsxProfile < Chef::Resource
-      unified_mode true
 
       provides :osx_profile
       provides :osx_config_profile

data/lib/chef/resource/package.rb

@@ -22,7 +22,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class Package < Chef::Resource
-      unified_mode true
       provides :package
 
       description "Use the **package** resource to manage packages. When the package is"\

data/lib/chef/resource/pacman_package.rb

@@ -21,7 +21,6 @@ require_relative "package"
 class Chef
   class Resource
     class PacmanPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :pacman_package
 

data/lib/chef/resource/paludis_package.rb

@@ -22,7 +22,6 @@ require_relative "../provider/package/paludis"
 class Chef
   class Resource
     class PaludisPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :paludis_package
 

data/lib/chef/resource/perl.rb

@@ -21,7 +21,6 @@ require_relative "script"
 class Chef
   class Resource
     class Perl < Chef::Resource::Script
-      unified_mode true
 
       provides :perl
 

data/lib/chef/resource/plist.rb

@@ -22,7 +22,6 @@ class Chef
   class Resource
 
     class PlistResource < Chef::Resource # we name this PlistResource to avoid confusion with Plist from the plist gem
-      unified_mode true
 
       provides :plist
 
@@ -85,7 +84,7 @@ class Chef
         converge_if_changed :path do
           converge_by "create new plist: '#{new_resource.path}'" do
             file new_resource.path do
-              content {}.to_plist
+              content({}.to_plist)
               owner new_resource.owner
               group new_resource.group
               mode new_resource.mode if property_is_set?(:mode)
@@ -189,7 +188,12 @@ class Chef
         sep = " "
         arg = case subcommand.to_s
               when "add"
-                type_to_commandline_string(value)
+                if value.is_a?(Hash)
+                  sep = ":"
+                  value.map { |k, v| "#{k} #{type_to_commandline_string(v)}" }
+                else
+                  type_to_commandline_string(value)
+                end
               when "set"
                 if value.is_a?(Hash)
                   sep = ":"

data/lib/chef/resource/portage_package.rb

@@ -21,7 +21,6 @@ require_relative "package"
 class Chef
   class Resource
     class PortagePackage < Chef::Resource::Package
-      unified_mode true
 
       provides :portage_package
 

data/lib/chef/resource/powershell_package.rb

@@ -20,7 +20,6 @@ require_relative "package"
 class Chef
   class Resource
     class PowershellPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :powershell_package
 

data/lib/chef/resource/powershell_package_source.rb

@@ -21,7 +21,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class PowershellPackageSource < Chef::Resource
-      unified_mode true
 
       provides :powershell_package_source
 

data/lib/chef/resource/powershell_script.rb

@@ -20,7 +20,6 @@ require_relative "windows_script"
 class Chef
   class Resource
     class PowershellScript < Chef::Resource::WindowsScript
-      unified_mode true
 
       set_guard_inherited_attributes(:interpreter)
 

data/lib/chef/resource/python.rb

@@ -20,7 +20,6 @@ require_relative "script"
 class Chef
   class Resource
     class Python < Chef::Resource::Script
-      unified_mode true
 
       provides :python
 

data/lib/chef/resource/reboot.rb

@@ -22,7 +22,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class Reboot < Chef::Resource
-      unified_mode true
 
       provides :reboot
 

data/lib/chef/resource/registry_key.rb

@@ -23,7 +23,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class RegistryKey < Chef::Resource
-      unified_mode true
 
       provides(:registry_key) { true }
 

data/lib/chef/resource/remote_directory.rb

@@ -25,7 +25,6 @@ class Chef
   class Resource
     class RemoteDirectory < Chef::Resource::Directory
       include Chef::Mixin::Securable
-      unified_mode true
 
       provides :remote_directory
 

data/lib/chef/resource/remote_file.rb

@@ -28,7 +28,6 @@ class Chef
   class Resource
     class RemoteFile < Chef::Resource::File
       include Chef::Mixin::Securable
-      unified_mode true
 
       provides :remote_file
 

data/lib/chef/resource/rhsm_errata.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmErrata < Chef::Resource
-      unified_mode true
       provides(:rhsm_errata) { true }
 
       description "Use the **rhsm_errata** resource to install packages associated with a given Red Hat Subscription Manager Errata ID. This is helpful if packages to mitigate a single vulnerability must be installed on your hosts."

data/lib/chef/resource/rhsm_errata_level.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmErrataLevel < Chef::Resource
-      unified_mode true
       provides(:rhsm_errata_level) { true }
 
       description "Use the **rhsm_errata_level** resource to install all packages of a specified errata level from the Red Hat Subscription Manager. For example, you can ensure that all packages associated with errata marked at a 'Critical' security level are installed."

data/lib/chef/resource/rhsm_register.rb

@@ -22,7 +22,6 @@ require "shellwords" unless defined?(Shellwords)
 class Chef
   class Resource
     class RhsmRegister < Chef::Resource
-      unified_mode true
       provides(:rhsm_register) { true }
 
       description "Use the **rhsm_register** resource to register a node with the Red Hat Subscription Manager or a local Red Hat Satellite server."
@@ -118,12 +117,17 @@ class Chef
           end
         end
 
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Register to RHSM" do
           sensitive new_resource.sensitive
           command register_command
           default_env true
           action :run
           not_if { registered_with_rhsm? } unless new_resource.force
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
         end
 
         if new_resource.install_katello_agent && !new_resource.satellite_host.nil?
@@ -132,11 +136,16 @@ class Chef
       end
 
       action :unregister, description: "Unregister the node from RHSM." do
+        package flush_package_cache_name do
+          action :nothing
+        end
+
         execute "Unregister from RHSM" do
           command "subscription-manager unregister"
           default_env true
           action :run
           only_if { registered_with_rhsm? }
+          notifies :flush_cache, "package[#{flush_package_cache_name}]", :immediately
           notifies :run, "execute[Clean RHSM Config]", :immediately
         end
 
@@ -148,6 +157,13 @@ class Chef
       end
 
       action_class do
+        #
+        # @return [String]
+        #
+        def flush_package_cache_name
+          "rhsm_register-#{new_resource.name}-flush_cache"
+        end
+
         #
         # @return [Symbol] dnf_package or yum_package depending on OS release
         #

data/lib/chef/resource/rhsm_repo.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmRepo < Chef::Resource
-      unified_mode true
 
       provides(:rhsm_repo) { true }
 

data/lib/chef/resource/rhsm_subscription.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmSubscription < Chef::Resource
-      unified_mode true
 
       provides(:rhsm_subscription) { true }
 

data/lib/chef/resource/route.rb

@@ -22,7 +22,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class Route < Chef::Resource
-      unified_mode true
 
       provides :route
 

data/lib/chef/resource/rpm_package.rb

@@ -21,7 +21,6 @@ require_relative "package"
 class Chef
   class Resource
     class RpmPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :rpm_package
 

data/lib/chef/resource/ruby.rb

@@ -21,7 +21,6 @@ require_relative "script"
 class Chef
   class Resource
     class Ruby < Chef::Resource::Script
-      unified_mode true
 
       provides :ruby
 

data/lib/chef/resource/ruby_block.rb

@@ -24,7 +24,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class RubyBlock < Chef::Resource
-      unified_mode true
 
       provides :ruby_block, target_mode: true
 

data/lib/chef/resource/scm/_scm.rb

@@ -16,8 +16,6 @@
 # limitations under the License.
 #
 
-unified_mode true
-
 default_action :sync
 allowed_actions :checkout, :export, :sync, :diff, :log
 

data/lib/chef/resource/scm/git.rb

@@ -23,8 +23,6 @@ class Chef
     class Git < Chef::Resource
       use "scm"
 
-      unified_mode true
-
       provides :git
 
       description "Use the **git** resource to manage source control resources that exist in a git repository. git version 1.6.5 (or higher) is required to use all of the functionality in the git resource."

data/lib/chef/resource/scm/subversion.rb

@@ -24,8 +24,6 @@ class Chef
     class Subversion < Chef::Resource
       use "scm"
 
-      unified_mode true
-
       provides :subversion
 
       description "Use the **subversion** resource to manage source control resources that exist in a Subversion repository. Warning: The subversion resource has known bugs and may not work as expected. For more information see Chef GitHub issues, particularly [#4050](https://github.com/chef/chef/issues/4050) and [#4257](https://github.com/chef/chef/issues/4257)."

data/lib/chef/resource/script.rb

@@ -22,7 +22,6 @@ require_relative "execute"
 class Chef
   class Resource
     class Script < Chef::Resource::Execute
-      unified_mode true
 
       provides :script
 

data/lib/chef/resource/selinux/common_helpers.rb

@@ -0,0 +1,47 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class Chef
+  module SELinux
+    module CommonHelpers
+      def selinux_disabled?
+        selinux_state.eql?(:disabled)
+      end
+
+      def selinux_enforcing?
+        selinux_state.eql?(:enforcing)
+      end
+
+      def selinux_permissive?
+        selinux_state.eql?(:permissive)
+      end
+
+      def state_change_reboot_required?
+        (selinux_disabled? && %i{enforcing permissive}.include?(action)) || ((selinux_enforcing? || selinux_permissive?) && action == :disabled)
+      end
+
+      def selinux_state
+        state = shell_out!("getenforce").stdout.strip.downcase.to_sym
+        raise "Got unknown SELinux state #{state}" unless %i{disabled enforcing permissive}.include?(state)
+
+        state
+      end
+
+      def selinux_activate_required?
+        return false unless platform_family?("debian")
+
+        !File.read("/etc/default/grub").match?("security=selinux")
+      end
+    end
+  end
+end

data/lib/chef/resource/selinux/selinux_debian.erb

@@ -0,0 +1,18 @@
+# Generated by Chef for <%= node['fqdn'] %>
+# Do NOT modify this file by hand.
+#
+
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+# enforcing - SELinux security policy is enforced.
+# permissive - SELinux prints warnings instead of enforcing.
+# disabled - No SELinux policy is loaded.
+SELINUX=<%= @selinux %>
+# SELINUXTYPE= can take one of these three values:
+# default - equivalent to the old strict and targeted policies
+# mls     - Multi-Level Security (for military and educational use)
+# src     - Custom policy built from source
+SELINUXTYPE=<%= @selinuxtype %>
+
+# SETLOCALDEFS= Check local definition changes
+SETLOCALDEFS=0

data/lib/chef/resource/selinux/selinux_default.erb

@@ -0,0 +1,15 @@
+# Generated by Chef for <%= node['fqdn'] %>
+# Do NOT modify this file by hand.
+#
+
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+#     enforcing - SELinux security policy is enforced.
+#     permissive - SELinux prints warnings instead of enforcing.
+#     disabled - No SELinux policy is loaded.
+SELINUX=<%= @selinux %>
+# SELINUXTYPE= can take one of these three values:
+#     targeted - Targeted processes are protected,
+#     minimum - Modification of targeted policy. Only selected processes are protected.
+#     mls - Multi Level Security protection.
+SELINUXTYPE=<%= @selinuxtype %>

data/lib/chef/resource/selinux_boolean.rb

@@ -0,0 +1,101 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+require_relative "selinux/common_helpers"
+
+class Chef
+  class Resource
+    class SelinuxBoolean < Chef::Resource
+      unified_mode true
+
+      provides :selinux_boolean
+
+      description "Use **selinux_boolean** resource to set SELinux boolean values."
+      introduced "18.0"
+      examples <<~DOC
+      **Set ssh_keysign to true**:
+
+      ```ruby
+      selinux_boolean 'ssh_keysign' do
+        value true
+      end
+      ```
+
+      **Set ssh_sysadm_login to 'on'**:
+
+      ```ruby
+      selinux_boolean 'ssh_sysadm_login' do
+        value 'on'
+      end
+      ```
+      DOC
+
+      property :boolean, String,
+        name_property: true,
+        description: "SELinux boolean to set."
+
+      property :value, [Integer, String, true, false],
+        required: true,
+        equal_to: %w{on off},
+        coerce: proc { |p| selinux_bool(p) },
+        description: "SELinux boolean value."
+
+      property :persistent, [true, false],
+        default: true,
+        desired_state: false,
+        description: "Set to true for value setting to survive reboot."
+
+      load_current_value do |new_resource|
+        value shell_out!("getsebool", new_resource.boolean).stdout.split("-->").map(&:strip).last
+      end
+
+      action_class do
+        include Chef::SELinux::CommonHelpers
+      end
+
+      action :set , description: "Set the state of the boolean." do
+        if selinux_disabled?
+          Chef::Log.warn("Unable to set SELinux boolean #{new_resource.name} as SELinux is disabled")
+          return
+        end
+
+        converge_if_changed do
+          cmd = "setsebool"
+          cmd += " -P" if new_resource.persistent
+          cmd += " #{new_resource.boolean} #{new_resource.value}"
+
+          shell_out!(cmd)
+        end
+      end
+
+      private
+
+      #
+      # Validate and return input boolean value in required format
+      # @param bool [String, Integer, Boolean] Input boolean value in allowed formats
+      #
+      # @return [String] [description] Boolean value in required format
+      def selinux_bool(bool)
+        if ["on", "true", "1", true, 1].include?(bool)
+          "on"
+        elsif ["off", "false", "0", false, 0].include?(bool)
+          "off"
+        else
+          raise ArgumentError, "selinux_bool: Invalid selinux boolean value #{bool}"
+        end
+      end
+    end
+  end
+end