chef 17.10.95 → 18.1.0

data/lib/chef/resource/macos_userdefaults.rb

@@ -23,7 +23,6 @@ autoload :Plist, "plist"
 class Chef
   class Resource
     class MacosUserDefaults < Chef::Resource
-      unified_mode true
 
       # align with apple's marketing department
       provides(:macos_userdefaults) { true }
@@ -51,17 +50,15 @@ class Chef
         end
         ```
 
-        **Setting a value for specific user and hosts**
+        **Specifying the type of a key to skip automatic type detection**
 
         ```ruby
-        macos_userdefaults 'Enable macOS firewall' do
-          key 'globalstate'
-          value 1
-          user 'jane'
-          host :current
+        macos_userdefaults 'Finder expanded save dialogs' do
+          key 'NSNavPanelExpandedStateForSaveMode'
+          value 'TRUE'
+          type 'bool'
         end
         ```
-
       DOC
 
       property :domain, String,
@@ -72,7 +69,7 @@ class Chef
 
       property :global, [TrueClass, FalseClass],
         description: "Determines whether or not the domain is global.",
-        deprecated: true,
+        deprecated: "As of Chef Infra Client 17.8 the `global` property is no longer necessary.",
         default: false,
         desired_state: false
 
@@ -82,7 +79,6 @@ class Chef
 
       property :host, [String, Symbol],
         description: "Set either :current, :all or a hostname to set the user default at the host level.",
-        default: :all,
         desired_state: false,
         introduced: "16.3"
 
@@ -94,18 +90,17 @@ class Chef
         description: "The value type of the preference key.",
         equal_to: %w{bool string int float array dict},
         desired_state: false,
-        deprecated: true
+        deprecated: "As of Chef Infra Client 17.8 the `type` property is no longer necessary."
 
       property :user, [String, Symbol],
         description: "The system user that the default will be applied to. Set :current for current user, :all for all users or pass a valid username",
-        default: :current,
         desired_state: false
 
       property :sudo, [TrueClass, FalseClass],
         description: "Set to true if the setting you wish to modify requires privileged access. This requires passwordless sudo for the `/usr/bin/defaults` command to be setup for the user running #{ChefUtils::Dist::Infra::PRODUCT}.",
         default: false,
         desired_state: false,
-        deprecated: true
+        deprecated: "As of Chef Infra Client 17.8 the `sudo` property is no longer necessary."
 
       load_current_value do |new_resource|
         Chef::Log.debug "#load_current_value: attempting to read \"#{new_resource.domain}\" value from preferences to determine state"

data/lib/chef/resource/macosx_service.rb

@@ -21,7 +21,6 @@ require_relative "service"
 class Chef
   class Resource
     class MacosxService < Chef::Resource::Service
-      unified_mode true
 
       provides :macosx_service
       provides :service, os: "darwin"

data/lib/chef/resource/macports_package.rb

@@ -21,11 +21,12 @@ require_relative "package"
 class Chef
   class Resource
     class MacportsPackage < Chef::Resource::Package
-      unified_mode true
       provides :macports_package
 
       description "Use the **macports_package** resource to manage packages for the macOS platform using the MacPorts package management system."
 
+      allowed_actions :install, :upgrade, :remove, :purge
+
       property :package_name, String,
         description: "An optional property to set the package name if it differs from the resource block's name.",
         identity: true

data/lib/chef/resource/mdadm.rb

@@ -22,7 +22,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class Mdadm < Chef::Resource
-      unified_mode true
 
       provides :mdadm
 

data/lib/chef/resource/mount.rb

@@ -23,7 +23,6 @@ class Chef
   class Resource
     class Mount < Chef::Resource
       description "Use the **mount** resource to manage a mounted file system."
-      unified_mode true
 
       provides :mount
 

data/lib/chef/resource/msu_package.rb

@@ -23,7 +23,6 @@ class Chef
   class Resource
     class MsuPackage < Chef::Resource::Package
       include Chef::Mixin::Uris
-      unified_mode true
 
       provides :msu_package
 

data/lib/chef/resource/notify_group.rb

@@ -21,8 +21,6 @@ class Chef
     class NotifyGroup < Chef::Resource
       provides :notify_group
 
-      unified_mode true
-
       description "The notify_group resource does nothing, and always fires notifications which are set on it.  Use it to DRY blocks of notifications that are common to multiple resources, and provide a single target for other resources to notify.  Unlike most resources, its default action is :nothing."
       introduced "15.8"
       examples <<~DOC

data/lib/chef/resource/ohai.rb

@@ -25,7 +25,6 @@ require "ohai" unless defined?(Ohai::System)
 class Chef
   class Resource
     class Ohai < Chef::Resource
-      unified_mode true
 
       provides :ohai
 

data/lib/chef/resource/ohai_hint.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class OhaiHint < Chef::Resource
-      unified_mode true
 
       provides(:ohai_hint) { true }
 

data/lib/chef/resource/openbsd_package.rb

@@ -25,7 +25,6 @@ require_relative "../provider/package/openbsd"
 class Chef
   class Resource
     class OpenbsdPackage < Chef::Resource::Package
-      unified_mode true
       provides :openbsd_package
       provides :package, os: "openbsd"
 
@@ -49,6 +48,8 @@ class Chef
         ```
       DOC
 
+      allowed_actions :install, :remove
+
       property :package_name, String,
         description: "An optional property to set the package name if it differs from the resource block's name.",
         identity: true

data/lib/chef/resource/openssl_dhparam.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_dhparam) { true }
 
       description "Use the **openssl_dhparam** resource to generate `dhparam.pem` files. If a valid `dhparam.pem` file is found at the specified location, no new file will be created. If a file is found at the specified location but it is not a valid `dhparam.pem` file, it will be overwritten."

data/lib/chef/resource/openssl_ec_private_key.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_ec_private_key
 
       description "Use the **openssl_ec_private_key** resource to generate an elliptic curve (EC) private key file. If a valid EC key file can be opened at the specified location, no new file will be created. If the EC key file cannot be opened, either because it does not exist or because the password to the EC key file does not match the password in the recipe, then it will be overwritten."

data/lib/chef/resource/openssl_ec_public_key.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_ec_public_key
 
       description "Use the **openssl_ec_public_key** resource to generate elliptic curve (EC) public key files from a given EC private key."

data/lib/chef/resource/openssl_rsa_private_key.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_rsa_private_key) { true }
       provides(:openssl_rsa_key) { true } # legacy cookbook resource name
 

data/lib/chef/resource/openssl_rsa_public_key.rb

@@ -23,8 +23,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides(:openssl_rsa_public_key) { true }
 
       examples <<~DOC

data/lib/chef/resource/openssl_x509_certificate.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_certificate
       provides(:openssl_x509) { true } # legacy cookbook name.
 

data/lib/chef/resource/openssl_x509_crl.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_crl
 
       description "Use the **openssl_x509_crl** resource to generate PEM-formatted x509 certificate revocation list (CRL) files."

data/lib/chef/resource/openssl_x509_request.rb

@@ -24,8 +24,6 @@ class Chef
       require_relative "../mixin/openssl_helper"
       include Chef::Mixin::OpenSSLHelper
 
-      unified_mode true
-
       provides :openssl_x509_request
 
       description "Use the **openssl_x509_request** resource to generate PEM-formatted x509 certificates requests. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate."

data/lib/chef/resource/osx_profile.rb

@@ -25,7 +25,6 @@ autoload :Plist, "plist"
 class Chef
   class Resource
     class OsxProfile < Chef::Resource
-      unified_mode true
 
       provides :osx_profile
       provides :osx_config_profile

data/lib/chef/resource/package.rb

@@ -22,7 +22,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class Package < Chef::Resource
-      unified_mode true
       provides :package
 
       description "Use the **package** resource to manage packages. When the package is"\

data/lib/chef/resource/pacman_package.rb

@@ -21,10 +21,11 @@ require_relative "package"
 class Chef
   class Resource
     class PacmanPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :pacman_package
 
+      allowed_actions :install, :upgrade, :remove, :purge
+
       description "Use the **pacman_package** resource to manage packages (using pacman) on the Arch Linux platform."
     end
   end

data/lib/chef/resource/paludis_package.rb

@@ -22,7 +22,6 @@ require_relative "../provider/package/paludis"
 class Chef
   class Resource
     class PaludisPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :paludis_package
 

data/lib/chef/resource/perl.rb

@@ -21,7 +21,6 @@ require_relative "script"
 class Chef
   class Resource
     class Perl < Chef::Resource::Script
-      unified_mode true
 
       provides :perl
 

data/lib/chef/resource/plist.rb

@@ -22,7 +22,6 @@ class Chef
   class Resource
 
     class PlistResource < Chef::Resource # we name this PlistResource to avoid confusion with Plist from the plist gem
-      unified_mode true
 
       provides :plist
 
@@ -85,7 +84,7 @@ class Chef
         converge_if_changed :path do
           converge_by "create new plist: '#{new_resource.path}'" do
             file new_resource.path do
-              content {}.to_plist
+              content({}.to_plist)
               owner new_resource.owner
               group new_resource.group
               mode new_resource.mode if property_is_set?(:mode)
@@ -189,7 +188,12 @@ class Chef
         sep = " "
         arg = case subcommand.to_s
               when "add"
-                type_to_commandline_string(value)
+                if value.is_a?(Hash)
+                  sep = ":"
+                  value.map { |k, v| "#{k} #{type_to_commandline_string(v)}" }
+                else
+                  type_to_commandline_string(value)
+                end
               when "set"
                 if value.is_a?(Hash)
                   sep = ":"

data/lib/chef/resource/portage_package.rb

@@ -21,12 +21,13 @@ require_relative "package"
 class Chef
   class Resource
     class PortagePackage < Chef::Resource::Package
-      unified_mode true
 
       provides :portage_package
 
       description "Use the **portage_package** resource to manage packages for the Gentoo platform."
 
+      allowed_actions :install, :upgrade, :remove, :purge
+
       property :package_name, String,
         description: "An optional property to set the package name if it differs from the resource block's name.",
         identity: true

data/lib/chef/resource/powershell_package.rb

@@ -20,7 +20,6 @@ require_relative "package"
 class Chef
   class Resource
     class PowershellPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :powershell_package
 

data/lib/chef/resource/powershell_package_source.rb

@@ -21,7 +21,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class PowershellPackageSource < Chef::Resource
-      unified_mode true
 
       provides :powershell_package_source
 

data/lib/chef/resource/powershell_script.rb

@@ -20,7 +20,6 @@ require_relative "windows_script"
 class Chef
   class Resource
     class PowershellScript < Chef::Resource::WindowsScript
-      unified_mode true
 
       set_guard_inherited_attributes(:interpreter)
 

data/lib/chef/resource/python.rb

@@ -20,7 +20,6 @@ require_relative "script"
 class Chef
   class Resource
     class Python < Chef::Resource::Script
-      unified_mode true
 
       provides :python
 

data/lib/chef/resource/reboot.rb

@@ -22,7 +22,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class Reboot < Chef::Resource
-      unified_mode true
 
       provides :reboot
 

data/lib/chef/resource/registry_key.rb

@@ -23,7 +23,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class RegistryKey < Chef::Resource
-      unified_mode true
 
       provides(:registry_key) { true }
 

data/lib/chef/resource/remote_directory.rb

@@ -25,7 +25,6 @@ class Chef
   class Resource
     class RemoteDirectory < Chef::Resource::Directory
       include Chef::Mixin::Securable
-      unified_mode true
 
       provides :remote_directory
 

data/lib/chef/resource/remote_file.rb

@@ -28,7 +28,6 @@ class Chef
   class Resource
     class RemoteFile < Chef::Resource::File
       include Chef::Mixin::Securable
-      unified_mode true
 
       provides :remote_file
 

data/lib/chef/resource/rhsm_errata.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmErrata < Chef::Resource
-      unified_mode true
       provides(:rhsm_errata) { true }
 
       description "Use the **rhsm_errata** resource to install packages associated with a given Red Hat Subscription Manager Errata ID. This is helpful if packages to mitigate a single vulnerability must be installed on your hosts."

data/lib/chef/resource/rhsm_errata_level.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmErrataLevel < Chef::Resource
-      unified_mode true
       provides(:rhsm_errata_level) { true }
 
       description "Use the **rhsm_errata_level** resource to install all packages of a specified errata level from the Red Hat Subscription Manager. For example, you can ensure that all packages associated with errata marked at a 'Critical' security level are installed."

data/lib/chef/resource/rhsm_register.rb

@@ -22,7 +22,6 @@ require "shellwords" unless defined?(Shellwords)
 class Chef
   class Resource
     class RhsmRegister < Chef::Resource
-      unified_mode true
       provides(:rhsm_register) { true }
 
       description "Use the **rhsm_register** resource to register a node with the Red Hat Subscription Manager or a local Red Hat Satellite server."
@@ -93,7 +92,7 @@ class Chef
 
       property :release,
         [Float, String],
-        description: "Sets the operating system minor release to use for subscriptions for the system. Products and updates are limited to the specified minor release version. This is used only used with the `auto_attach` option.  For example, `release '6.4'` will append `--release=6.4` to the register command.",
+        description: "Sets the operating system minor release to use for subscriptions for the system. Products and updates are limited to the specified minor release version. This is used with the `auto_attach` option, it may also be used with activation keys.  For example, `release '6.4'` will append `--release=6.4` to the register command.",
         introduced: "17.8"
 
       action :register, description: "Register the node with RHSM." do
@@ -137,8 +136,6 @@ class Chef
       end
 
       action :unregister, description: "Unregister the node from RHSM." do
-        description "Unregister the node from RHSM."
-
         package flush_package_cache_name do
           action :nothing
         end
@@ -208,6 +205,7 @@ class Chef
               command << "--name=#{Shellwords.shellescape(new_resource.system_name)}" if new_resource.system_name
               command << "--serverurl=#{Shellwords.shellescape(new_resource.server_url)}" if new_resource.server_url
               command << "--baseurl=#{Shellwords.shellescape(new_resource.base_url)}" if new_resource.base_url
+              command << "--release=#{Shellwords.shellescape(new_resource.release)}" if new_resource.release
               command << "--force" if new_resource.force
 
               return command.join(" ")

data/lib/chef/resource/rhsm_repo.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmRepo < Chef::Resource
-      unified_mode true
 
       provides(:rhsm_repo) { true }
 

data/lib/chef/resource/rhsm_subscription.rb

@@ -20,7 +20,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class RhsmSubscription < Chef::Resource
-      unified_mode true
 
       provides(:rhsm_subscription) { true }
 

data/lib/chef/resource/route.rb

@@ -22,7 +22,6 @@ require_relative "../resource"
 class Chef
   class Resource
     class Route < Chef::Resource
-      unified_mode true
 
       provides :route
 

data/lib/chef/resource/rpm_package.rb

@@ -21,10 +21,11 @@ require_relative "package"
 class Chef
   class Resource
     class RpmPackage < Chef::Resource::Package
-      unified_mode true
 
       provides :rpm_package
 
+      allowed_actions :install, :upgrade, :remove
+
       description "Use the **rpm_package** resource to manage packages using the RPM Package Manager."
 
       property :allow_downgrade, [ TrueClass, FalseClass ],

data/lib/chef/resource/ruby.rb

@@ -21,7 +21,6 @@ require_relative "script"
 class Chef
   class Resource
     class Ruby < Chef::Resource::Script
-      unified_mode true
 
       provides :ruby
 

data/lib/chef/resource/ruby_block.rb

@@ -24,7 +24,6 @@ require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 class Chef
   class Resource
     class RubyBlock < Chef::Resource
-      unified_mode true
 
       provides :ruby_block, target_mode: true
 

data/lib/chef/resource/scm/_scm.rb

@@ -16,8 +16,6 @@
 # limitations under the License.
 #
 
-unified_mode true
-
 default_action :sync
 allowed_actions :checkout, :export, :sync, :diff, :log
 

data/lib/chef/resource/scm/git.rb

@@ -23,8 +23,6 @@ class Chef
     class Git < Chef::Resource
       use "scm"
 
-      unified_mode true
-
       provides :git
 
       description "Use the **git** resource to manage source control resources that exist in a git repository. git version 1.6.5 (or higher) is required to use all of the functionality in the git resource."

data/lib/chef/resource/scm/subversion.rb

@@ -24,8 +24,6 @@ class Chef
     class Subversion < Chef::Resource
       use "scm"
 
-      unified_mode true
-
       provides :subversion
 
       description "Use the **subversion** resource to manage source control resources that exist in a Subversion repository. Warning: The subversion resource has known bugs and may not work as expected. For more information see Chef GitHub issues, particularly [#4050](https://github.com/chef/chef/issues/4050) and [#4257](https://github.com/chef/chef/issues/4257)."

data/lib/chef/resource/script.rb

@@ -22,7 +22,6 @@ require_relative "execute"
 class Chef
   class Resource
     class Script < Chef::Resource::Execute
-      unified_mode true
 
       provides :script
 

data/lib/chef/resource/selinux/common_helpers.rb

@@ -0,0 +1,47 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class Chef
+  module SELinux
+    module CommonHelpers
+      def selinux_disabled?
+        selinux_state.eql?(:disabled)
+      end
+
+      def selinux_enforcing?
+        selinux_state.eql?(:enforcing)
+      end
+
+      def selinux_permissive?
+        selinux_state.eql?(:permissive)
+      end
+
+      def state_change_reboot_required?
+        (selinux_disabled? && %i{enforcing permissive}.include?(action)) || ((selinux_enforcing? || selinux_permissive?) && action == :disabled)
+      end
+
+      def selinux_state
+        state = shell_out!("getenforce").stdout.strip.downcase.to_sym
+        raise "Got unknown SELinux state #{state}" unless %i{disabled enforcing permissive}.include?(state)
+
+        state
+      end
+
+      def selinux_activate_required?
+        return false unless platform_family?("debian")
+
+        !File.read("/etc/default/grub").match?("security=selinux")
+      end
+    end
+  end
+end

data/lib/chef/resource/selinux/selinux_debian.erb

@@ -0,0 +1,18 @@
+# Generated by Chef for <%= node['fqdn'] %>
+# Do NOT modify this file by hand.
+#
+
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+# enforcing - SELinux security policy is enforced.
+# permissive - SELinux prints warnings instead of enforcing.
+# disabled - No SELinux policy is loaded.
+SELINUX=<%= @selinux %>
+# SELINUXTYPE= can take one of these three values:
+# default - equivalent to the old strict and targeted policies
+# mls     - Multi-Level Security (for military and educational use)
+# src     - Custom policy built from source
+SELINUXTYPE=<%= @selinuxtype %>
+
+# SETLOCALDEFS= Check local definition changes
+SETLOCALDEFS=0