chef 18.1.29 → 18.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/chef-universal-mingw-ucrt.gemspec +2 -2
- data/chef.gemspec +1 -2
- data/lib/chef/application/base.rb +2 -0
- data/lib/chef/client.rb +2 -2
- data/lib/chef/cookbook/synchronizer.rb +20 -2
- data/lib/chef/cookbook_version.rb +1 -1
- data/lib/chef/http/authenticator.rb +2 -2
- data/lib/chef/http/ssl_policies.rb +2 -2
- data/lib/chef/mixin/homebrew_user.rb +12 -5
- data/lib/chef/mixin/proxified_socket.rb +1 -1
- data/lib/chef/monkey_patches/net-http.rb +127 -0
- data/lib/chef/node/attribute_collections.rb +8 -0
- data/lib/chef/node/immutable_collections.rb +5 -2
- data/lib/chef/node/mixin/state_tracking.rb +1 -1
- data/lib/chef/platform/query_helpers.rb +4 -2
- data/lib/chef/provider/launchd.rb +1 -1
- data/lib/chef/provider/mount/linux.rb +1 -1
- data/lib/chef/provider/mount/mount.rb +5 -5
- data/lib/chef/provider/package/chocolatey.rb +18 -1
- data/lib/chef/provider/package/zypper.rb +1 -0
- data/lib/chef/provider/remote_file/http.rb +1 -1
- data/lib/chef/provider/yum_repository.rb +1 -1
- data/lib/chef/resource/apt_repository.rb +25 -6
- data/lib/chef/resource/homebrew_cask.rb +6 -7
- data/lib/chef/resource/homebrew_package.rb +1 -1
- data/lib/chef/resource/homebrew_tap.rb +5 -5
- data/lib/chef/resource/launchd.rb +5 -1
- data/lib/chef/resource/macos_userdefaults.rb +9 -5
- data/lib/chef/resource/selinux_login.rb +129 -0
- data/lib/chef/resource/selinux_user.rb +137 -0
- data/lib/chef/resource/windows_certificate.rb +1 -1
- data/lib/chef/resource/windows_security_policy.rb +2 -2
- data/lib/chef/resource.rb +11 -1
- data/lib/chef/resources.rb +2 -0
- data/lib/chef/version.rb +1 -1
- data/lib/chef/win32/security.rb +7 -1
- data/spec/data/apt/chef-integration-test-1.0/debian/rules +0 -0
- data/spec/data/apt/chef-integration-test-1.1/debian/rules +0 -0
- data/spec/data/apt/chef-integration-test2-1.0/debian/rules +0 -0
- data/spec/data/trusted_certs/intermediate.pem +38 -27
- data/spec/data/trusted_certs/opscode.pem +33 -54
- data/spec/functional/assets/chefinittest +0 -0
- data/spec/functional/assets/testchefsubsys +0 -0
- data/spec/functional/provider/remote_file/cache_control_data_spec.rb +0 -0
- data/spec/functional/resource/aix_service_spec.rb +0 -0
- data/spec/functional/resource/aixinit_service_spec.rb +0 -0
- data/spec/functional/resource/chocolatey_package_spec.rb +32 -20
- data/spec/functional/resource/execute_spec.rb +1 -1
- data/spec/functional/resource/macos_userdefaults_spec.rb +4 -4
- data/spec/functional/resource/windows_certificate_spec.rb +25 -0
- data/spec/unit/client_spec.rb +2 -2
- data/spec/unit/mixin/homebrew_user_spec.rb +30 -7
- data/spec/unit/node/vivid_mash_spec.rb +42 -0
- data/spec/unit/provider/apt_repository_spec.rb +17 -7
- data/spec/unit/provider/launchd_spec.rb +2 -2
- data/spec/unit/provider/mount/aix_spec.rb +2 -2
- data/spec/unit/provider/mount/linux_spec.rb +6 -5
- data/spec/unit/provider/mount/mount_spec.rb +8 -8
- data/spec/unit/provider/package/chocolatey_spec.rb +19 -3
- data/spec/unit/provider/package/rpm_spec.rb +2 -2
- data/spec/unit/provider/package/zypper_spec.rb +10 -0
- data/spec/unit/provider/remote_file/http_spec.rb +4 -4
- data/spec/unit/resource/apt_repository_spec.rb +5 -0
- data/spec/unit/resource/macos_user_defaults_spec.rb +4 -4
- data/spec/unit/resource/selinux_login_spec.rb +73 -0
- data/spec/unit/resource/selinux_user_spec.rb +92 -0
- data/spec/unit/resource_spec.rb +86 -0
- metadata +19 -15
- data/lib/chef/powershell.rb +0 -81
- /data/spec/functional/assets/chocolatey_feed/{test-A.1.0.nupkg → test-A.1.0.0.nupkg} +0 -0
- /data/spec/functional/assets/chocolatey_feed/{test-A.1.5.nupkg → test-A.1.5.0.nupkg} +0 -0
- /data/spec/functional/assets/chocolatey_feed/{test-A.2.0.nupkg → test-A.2.0.0.nupkg} +0 -0
- /data/spec/functional/assets/chocolatey_feed/{test-B.1.0.nupkg → test-B.1.0.0.nupkg} +0 -0
@@ -41,8 +41,7 @@ class Chef
|
|
41
41
|
description: "The URL of the tap."
|
42
42
|
|
43
43
|
property :homebrew_path, String,
|
44
|
-
description: "The path to the Homebrew binary."
|
45
|
-
default: "/usr/local/bin/brew"
|
44
|
+
description: "The path to the Homebrew binary."
|
46
45
|
|
47
46
|
property :owner, String,
|
48
47
|
description: "The owner of the Homebrew installation.",
|
@@ -52,7 +51,7 @@ class Chef
|
|
52
51
|
action :tap, description: "Add a Homebrew tap." do
|
53
52
|
unless tapped?(new_resource.tap_name)
|
54
53
|
converge_by("tap #{new_resource.tap_name}") do
|
55
|
-
shell_out!("#{new_resource.homebrew_path} tap #{new_resource.tap_name} #{new_resource.url || ""}",
|
54
|
+
shell_out!("#{homebrew_bin_path(new_resource.homebrew_path)} tap #{new_resource.tap_name} #{new_resource.url || ""}",
|
56
55
|
user: new_resource.owner,
|
57
56
|
env: { "HOME" => ::Dir.home(new_resource.owner), "USER" => new_resource.owner },
|
58
57
|
cwd: ::Dir.home(new_resource.owner))
|
@@ -63,7 +62,7 @@ class Chef
|
|
63
62
|
action :untap, description: "Remove a Homebrew tap." do
|
64
63
|
if tapped?(new_resource.tap_name)
|
65
64
|
converge_by("untap #{new_resource.tap_name}") do
|
66
|
-
shell_out!("#{new_resource.homebrew_path} untap #{new_resource.tap_name}",
|
65
|
+
shell_out!("#{homebrew_bin_path(new_resource.homebrew_path)} untap #{new_resource.tap_name}",
|
67
66
|
user: new_resource.owner,
|
68
67
|
env: { "HOME" => ::Dir.home(new_resource.owner), "USER" => new_resource.owner },
|
69
68
|
cwd: ::Dir.home(new_resource.owner))
|
@@ -75,8 +74,9 @@ class Chef
|
|
75
74
|
#
|
76
75
|
# @return [Boolean]
|
77
76
|
def tapped?(name)
|
77
|
+
base_path = ["#{::File.dirname(which("brew"))}/../homebrew", "#{::File.dirname(which("brew"))}/../Homebrew", "/opt/homebrew", "/usr/local/Homebrew", "/home/linuxbrew/.linuxbrew"].uniq.select { |x| Dir.exist?(x) }.first
|
78
78
|
tap_dir = name.gsub("/", "/homebrew-")
|
79
|
-
::File.directory?("/
|
79
|
+
::File.directory?("#{base_path}/Library/Taps/#{tap_dir}")
|
80
80
|
end
|
81
81
|
end
|
82
82
|
end
|
@@ -202,7 +202,11 @@ class Chef
|
|
202
202
|
description: "The first argument of `execvp`, typically the file name associated with the file to be executed. This value must be specified if `program_arguments` is not specified, and vice-versa."
|
203
203
|
|
204
204
|
property :program_arguments, Array,
|
205
|
-
description: "The second argument of `execvp`. If program is not specified, this property must be specified and will be handled as if it were the first argument."
|
205
|
+
description: "The second argument of `execvp`. If program is not specified, this property must be specified and will be handled as if it were the first argument.",
|
206
|
+
coerce: proc { |args|
|
207
|
+
# Cast all values to a string. Launchd only supports string values
|
208
|
+
args.map(&:to_s)
|
209
|
+
}
|
206
210
|
|
207
211
|
property :queue_directories, Array,
|
208
212
|
description: "An array of non-empty directories which, if any are modified, will cause a job to be started."
|
@@ -50,15 +50,17 @@ class Chef
|
|
50
50
|
end
|
51
51
|
```
|
52
52
|
|
53
|
-
**
|
53
|
+
**Setting a value for specific user and hosts**
|
54
54
|
|
55
55
|
```ruby
|
56
|
-
macos_userdefaults '
|
57
|
-
key '
|
58
|
-
value
|
59
|
-
|
56
|
+
macos_userdefaults 'Enable macOS firewall' do
|
57
|
+
key 'globalstate'
|
58
|
+
value 1
|
59
|
+
user 'jane'
|
60
|
+
host :current
|
60
61
|
end
|
61
62
|
```
|
63
|
+
|
62
64
|
DOC
|
63
65
|
|
64
66
|
property :domain, String,
|
@@ -79,6 +81,7 @@ class Chef
|
|
79
81
|
|
80
82
|
property :host, [String, Symbol],
|
81
83
|
description: "Set either :current, :all or a hostname to set the user default at the host level.",
|
84
|
+
default: :all,
|
82
85
|
desired_state: false,
|
83
86
|
introduced: "16.3"
|
84
87
|
|
@@ -94,6 +97,7 @@ class Chef
|
|
94
97
|
|
95
98
|
property :user, [String, Symbol],
|
96
99
|
description: "The system user that the default will be applied to. Set :current for current user, :all for all users or pass a valid username",
|
100
|
+
default: :current,
|
97
101
|
desired_state: false
|
98
102
|
|
99
103
|
property :sudo, [TrueClass, FalseClass],
|
@@ -0,0 +1,129 @@
|
|
1
|
+
#
|
2
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
3
|
+
# you may not use this file except in compliance with the License.
|
4
|
+
# You may obtain a copy of the License at
|
5
|
+
#
|
6
|
+
# http://www.apache.org/licenses/LICENSE-2.0
|
7
|
+
#
|
8
|
+
# Unless required by applicable law or agreed to in writing, software
|
9
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
10
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
11
|
+
# See the License for the specific language governing permissions and
|
12
|
+
# limitations under the License.
|
13
|
+
|
14
|
+
require_relative "../resource"
|
15
|
+
require_relative "selinux/common_helpers"
|
16
|
+
|
17
|
+
class Chef
|
18
|
+
class Resource
|
19
|
+
class SelinuxLogin < Chef::Resource
|
20
|
+
unified_mode true
|
21
|
+
|
22
|
+
provides :selinux_login
|
23
|
+
|
24
|
+
description "Use the **selinux_login** resource to add, update, or remove SELinux user to OS login mappings."
|
25
|
+
introduced "18.1"
|
26
|
+
examples <<~DOC
|
27
|
+
**Manage test OS user mapping with a range of s0 and associated SELinux user test_u**:
|
28
|
+
|
29
|
+
```ruby
|
30
|
+
selinux_login 'test' do
|
31
|
+
user 'test_u'
|
32
|
+
range 's0'
|
33
|
+
end
|
34
|
+
```
|
35
|
+
DOC
|
36
|
+
|
37
|
+
property :login, String,
|
38
|
+
name_property: true,
|
39
|
+
description: "An optional property to set the OS user login value if it differs from the resource block's name."
|
40
|
+
|
41
|
+
property :user, String,
|
42
|
+
description: "SELinux user to be mapped."
|
43
|
+
|
44
|
+
property :range, String,
|
45
|
+
description: "MLS/MCS security range for the SELinux user."
|
46
|
+
|
47
|
+
load_current_value do |new_resource|
|
48
|
+
logins = shell_out!("semanage login -l").stdout.split("\n")
|
49
|
+
|
50
|
+
current_login = logins.grep(/^#{Regexp.escape(new_resource.login)}\s+/) do |l|
|
51
|
+
l.match(/^(?<login>[^\s]+)\s+(?<user>[^\s]+)\s+(?<range>[^\s]+)/)
|
52
|
+
# match returns [<Match 'data'>] or [], shift converts that to <Match 'data'> or nil
|
53
|
+
end.shift
|
54
|
+
|
55
|
+
current_value_does_not_exist! unless current_login
|
56
|
+
|
57
|
+
# Existing resources should maintain their current configuration unless otherwise specified
|
58
|
+
new_resource.user ||= current_login[:user]
|
59
|
+
new_resource.range ||= current_login[:range]
|
60
|
+
|
61
|
+
user current_login[:user]
|
62
|
+
range current_login[:range]
|
63
|
+
end
|
64
|
+
|
65
|
+
action_class do
|
66
|
+
include Chef::SELinux::CommonHelpers
|
67
|
+
|
68
|
+
def semanage_login_args
|
69
|
+
# Generate arguments for semanage login -a or -m
|
70
|
+
args = ""
|
71
|
+
|
72
|
+
args += " -s #{new_resource.user}" if new_resource.user
|
73
|
+
args += " -r #{new_resource.range}" if new_resource.range
|
74
|
+
|
75
|
+
args
|
76
|
+
end
|
77
|
+
end
|
78
|
+
|
79
|
+
action :manage, description: "Sets the SELinux login mapping to the desired settings regardless of previous state." do
|
80
|
+
run_action(:add)
|
81
|
+
run_action(:modify)
|
82
|
+
end
|
83
|
+
|
84
|
+
# Create if doesn't exist, do not touch if user already exists
|
85
|
+
action :add, description: "Creates the SELinux login mapping if not previously created." do
|
86
|
+
raise "The user property must be populated to create a new SELinux login" if new_resource.user.to_s.empty?
|
87
|
+
|
88
|
+
if selinux_disabled?
|
89
|
+
Chef::Log.warn("Unable to add SELinux login #{new_resource.login} as SELinux is disabled")
|
90
|
+
return
|
91
|
+
end
|
92
|
+
|
93
|
+
unless current_resource
|
94
|
+
converge_if_changed do
|
95
|
+
shell_out!("semanage login -a#{semanage_login_args} #{new_resource.login}")
|
96
|
+
end
|
97
|
+
end
|
98
|
+
end
|
99
|
+
|
100
|
+
# Only modify port if it exists & doesn't have the correct context already
|
101
|
+
action :modify, description: "Updates the SELinux login mapping if previously created." do
|
102
|
+
if selinux_disabled?
|
103
|
+
Chef::Log.warn("Unable to modify SELinux login #{new_resource.login} as SELinux is disabled")
|
104
|
+
return
|
105
|
+
end
|
106
|
+
|
107
|
+
if current_resource
|
108
|
+
converge_if_changed do
|
109
|
+
shell_out!("semanage login -m#{semanage_login_args} #{new_resource.login}")
|
110
|
+
end
|
111
|
+
end
|
112
|
+
end
|
113
|
+
|
114
|
+
# Delete if exists
|
115
|
+
action :delete, description: "Removes the SELinux login mapping if previously created." do
|
116
|
+
if selinux_disabled?
|
117
|
+
Chef::Log.warn("Unable to delete SELinux login #{new_resource.login} as SELinux is disabled")
|
118
|
+
return
|
119
|
+
end
|
120
|
+
|
121
|
+
if current_resource
|
122
|
+
converge_by "deleting SELinux login #{new_resource.login}" do
|
123
|
+
shell_out!("semanage login -d #{new_resource.login}")
|
124
|
+
end
|
125
|
+
end
|
126
|
+
end
|
127
|
+
end
|
128
|
+
end
|
129
|
+
end
|
@@ -0,0 +1,137 @@
|
|
1
|
+
#
|
2
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
3
|
+
# you may not use this file except in compliance with the License.
|
4
|
+
# You may obtain a copy of the License at
|
5
|
+
#
|
6
|
+
# http://www.apache.org/licenses/LICENSE-2.0
|
7
|
+
#
|
8
|
+
# Unless required by applicable law or agreed to in writing, software
|
9
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
10
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
11
|
+
# See the License for the specific language governing permissions and
|
12
|
+
# limitations under the License.
|
13
|
+
|
14
|
+
require_relative "../resource"
|
15
|
+
require_relative "selinux/common_helpers"
|
16
|
+
|
17
|
+
class Chef
|
18
|
+
class Resource
|
19
|
+
class SelinuxUser < Chef::Resource
|
20
|
+
unified_mode true
|
21
|
+
|
22
|
+
provides :selinux_user
|
23
|
+
|
24
|
+
description "Use the **selinux_user** resource to add, update, or remove SELinux users."
|
25
|
+
introduced "18.1"
|
26
|
+
examples <<~DOC
|
27
|
+
**Manage test_u SELinux user with a level and range of s0 and roles sysadm_r and staff_r**:
|
28
|
+
|
29
|
+
```ruby
|
30
|
+
selinux_user 'test_u' do
|
31
|
+
level 's0'
|
32
|
+
range 's0'
|
33
|
+
roles %w(sysadm_r staff_r)
|
34
|
+
end
|
35
|
+
```
|
36
|
+
DOC
|
37
|
+
|
38
|
+
property :user, String,
|
39
|
+
name_property: true,
|
40
|
+
description: "An optional property to set the SELinux user value if it differs from the resource block's name."
|
41
|
+
|
42
|
+
property :level, String,
|
43
|
+
description: "MLS/MCS security level for the SELinux user."
|
44
|
+
|
45
|
+
property :range, String,
|
46
|
+
description: "MLS/MCS security range for the SELinux user."
|
47
|
+
|
48
|
+
property :roles, Array,
|
49
|
+
description: "Associated SELinux roles for the user.",
|
50
|
+
coerce: proc { |r| Array(r).sort }
|
51
|
+
|
52
|
+
load_current_value do |new_resource|
|
53
|
+
users = shell_out!("semanage user -l").stdout.split("\n")
|
54
|
+
|
55
|
+
current_user = users.grep(/^#{Regexp.escape(new_resource.user)}\s+/) do |u|
|
56
|
+
u.match(/^(?<user>[^\s]+)\s+(?<prefix>[^\s]+)\s+(?<level>[^\s]+)\s+(?<range>[^\s]+)\s+(?<roles>.*)$/)
|
57
|
+
# match returns [<Match 'data'>] or [], shift converts that to <Match 'data'> or nil
|
58
|
+
end.shift
|
59
|
+
|
60
|
+
current_value_does_not_exist! unless current_user
|
61
|
+
|
62
|
+
# Existing resources should maintain their current configuration unless otherwise specified
|
63
|
+
new_resource.level ||= current_user[:level]
|
64
|
+
new_resource.range ||= current_user[:range]
|
65
|
+
new_resource.roles ||= current_user[:roles].to_s.split.sort
|
66
|
+
|
67
|
+
level current_user[:level]
|
68
|
+
range current_user[:range]
|
69
|
+
roles current_user[:roles].to_s.split.sort
|
70
|
+
end
|
71
|
+
|
72
|
+
action_class do
|
73
|
+
include Chef::SELinux::CommonHelpers
|
74
|
+
|
75
|
+
def semanage_user_args
|
76
|
+
# Generate arguments for semanage user -a or -m
|
77
|
+
args = ""
|
78
|
+
|
79
|
+
args += " -L #{new_resource.level}" if new_resource.level
|
80
|
+
args += " -r #{new_resource.range}" if new_resource.range
|
81
|
+
args += " -R '#{new_resource.roles.join(" ")}'" unless new_resource.roles.to_a.empty?
|
82
|
+
|
83
|
+
args
|
84
|
+
end
|
85
|
+
end
|
86
|
+
|
87
|
+
action :manage, description: "Sets the SELinux user to the desired settings regardless of previous state." do
|
88
|
+
run_action(:add)
|
89
|
+
run_action(:modify)
|
90
|
+
end
|
91
|
+
|
92
|
+
# Create if doesn't exist, do not touch if user already exists
|
93
|
+
action :add, description: "Creates the SELinux user if not previously created." do
|
94
|
+
raise "The roles property must be populated to create a new SELinux user" if new_resource.roles.to_a.empty?
|
95
|
+
|
96
|
+
if selinux_disabled?
|
97
|
+
Chef::Log.warn("Unable to add SELinux user #{new_resource.user} as SELinux is disabled")
|
98
|
+
return
|
99
|
+
end
|
100
|
+
|
101
|
+
unless current_resource
|
102
|
+
converge_if_changed do
|
103
|
+
shell_out!("semanage user -a#{semanage_user_args} #{new_resource.user}")
|
104
|
+
end
|
105
|
+
end
|
106
|
+
end
|
107
|
+
|
108
|
+
# Only modify port if it exists & doesn't have the correct context already
|
109
|
+
action :modify, description: "Updates the SELinux user if previously created." do
|
110
|
+
if selinux_disabled?
|
111
|
+
Chef::Log.warn("Unable to modify SELinux user #{new_resource.user} as SELinux is disabled")
|
112
|
+
return
|
113
|
+
end
|
114
|
+
|
115
|
+
if current_resource
|
116
|
+
converge_if_changed do
|
117
|
+
shell_out!("semanage user -m#{semanage_user_args} #{new_resource.user}")
|
118
|
+
end
|
119
|
+
end
|
120
|
+
end
|
121
|
+
|
122
|
+
# Delete if exists
|
123
|
+
action :delete, description: "Removes the SELinux user if previously created." do
|
124
|
+
if selinux_disabled?
|
125
|
+
Chef::Log.warn("Unable to delete SELinux user #{new_resource.user} as SELinux is disabled")
|
126
|
+
return
|
127
|
+
end
|
128
|
+
|
129
|
+
if current_resource
|
130
|
+
converge_by "deleting SELinux user #{new_resource.user}" do
|
131
|
+
shell_out!("semanage user -d #{new_resource.user}")
|
132
|
+
end
|
133
|
+
end
|
134
|
+
end
|
135
|
+
end
|
136
|
+
end
|
137
|
+
end
|
@@ -440,7 +440,7 @@ class Chef
|
|
440
440
|
def export_cert(cert_obj, output_path:, store_name:, store_location:, pfx_password:)
|
441
441
|
# Delete the cert if it exists on disk already.
|
442
442
|
# We want to ensure we're not randomly loading an old stinky cert.
|
443
|
-
if ::File.
|
443
|
+
if ::File.exist?(output_path)
|
444
444
|
::File.delete(output_path)
|
445
445
|
end
|
446
446
|
|
@@ -118,13 +118,13 @@ class Chef
|
|
118
118
|
file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
|
119
119
|
file.close
|
120
120
|
file_path = file.path.tr("/", "\\")
|
121
|
-
cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
|
121
|
+
cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg \"#{file_path}\" /areas SECURITYPOLICY"
|
122
122
|
else
|
123
123
|
policy_line = "#{security_option} = #{security_value}"
|
124
124
|
file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
|
125
125
|
file.close
|
126
126
|
file_path = file.path.tr("/", "\\")
|
127
|
-
cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
|
127
|
+
cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg \"#{file_path}\" /areas SECURITYPOLICY"
|
128
128
|
end
|
129
129
|
shell_out!(cmd)
|
130
130
|
file.unlink
|
data/lib/chef/resource.rb
CHANGED
@@ -1508,7 +1508,17 @@ class Chef
|
|
1508
1508
|
dirname = ::File.dirname(partial)
|
1509
1509
|
basename = ::File.basename(partial, ".rb")
|
1510
1510
|
basename = basename[1..] if basename.start_with?("_")
|
1511
|
-
|
1511
|
+
|
1512
|
+
# Support recursive `use`
|
1513
|
+
callers = caller_locations
|
1514
|
+
used_from = if callers.first.label == "use"
|
1515
|
+
callers.detect { |caller| caller.label == "class_from_file" }.path
|
1516
|
+
else
|
1517
|
+
callers.first.path
|
1518
|
+
end
|
1519
|
+
|
1520
|
+
fullpath = ::File.expand_path("#{dirname}/_#{basename}.rb", ::File.dirname(used_from))
|
1521
|
+
class_eval IO.read(fullpath)
|
1512
1522
|
end
|
1513
1523
|
end
|
1514
1524
|
|
data/lib/chef/resources.rb
CHANGED
@@ -127,10 +127,12 @@ require_relative "resource/script"
|
|
127
127
|
require_relative "resource/selinux_boolean"
|
128
128
|
require_relative "resource/selinux_fcontext"
|
129
129
|
require_relative "resource/selinux_install"
|
130
|
+
require_relative "resource/selinux_login"
|
130
131
|
require_relative "resource/selinux_module"
|
131
132
|
require_relative "resource/selinux_permissive"
|
132
133
|
require_relative "resource/selinux_port"
|
133
134
|
require_relative "resource/selinux_state"
|
135
|
+
require_relative "resource/selinux_user"
|
134
136
|
require_relative "resource/service"
|
135
137
|
require_relative "resource/sudo"
|
136
138
|
require_relative "resource/sysctl"
|
data/lib/chef/version.rb
CHANGED
data/lib/chef/win32/security.rb
CHANGED
@@ -721,7 +721,13 @@ class Chef
|
|
721
721
|
unless LogonUserW(username, domain, password, logon_type, logon_provider, token)
|
722
722
|
Chef::ReservedNames::Win32::Error.raise!
|
723
723
|
end
|
724
|
-
|
724
|
+
|
725
|
+
# originally this was .read_pointer, but that is interpreted as a non-primitive
|
726
|
+
# class (FFI::Pointer) and causes an ArgumentError (Invalid Memory Object) when
|
727
|
+
# compared to GetCurrentProcess(), which returns a HANDLE (void *). Since a
|
728
|
+
# HANDLE is not a pointer to allocated memory that Ruby C extensions can understand,
|
729
|
+
# the Invalid Memory Object error is raised.
|
730
|
+
Token.new(Handle.new(token.read_ulong))
|
725
731
|
end
|
726
732
|
|
727
733
|
def self.test_and_raise_lsa_nt_status(result)
|
File without changes
|
File without changes
|
File without changes
|
@@ -1,27 +1,38 @@
|
|
1
|
-
-----BEGIN CERTIFICATE-----
|
2
|
-
|
3
|
-
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
1
|
+
-----BEGIN CERTIFICATE-----
|
2
|
+
MIIGrTCCBJWgAwIBAgIQDo0oQK5IJZBWGLOoqeF6RzANBgkqhkiG9w0BAQwFADBJ
|
3
|
+
MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xITAfBgNVBAMT
|
4
|
+
GERpZ2lDZXJ0IFJTQTQwOTYgUm9vdCBHNTAeFw0yMTA0MTQwMDAwMDBaFw0zMTA0
|
5
|
+
MTMyMzU5NTlaMFQxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j
|
6
|
+
LjEsMCoGA1UEAxMjRGlnaUNlcnQgRzUgUlNBNDA5NiBTSEEzODQgMjAyMSBDQTEw
|
7
|
+
ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDCwLlUmeGwUTj93uzejg2I
|
8
|
+
tHjaSqm+knZ8az09cBAZFLFU9sKDzBHgf43/GpIWIHGLDUGXXZkKtkjJhl6POqda
|
9
|
+
XWt/4avSsQgkELz2uefSxhzELBl4o1U50EULTlri3zUBQ11Jr/hfJLxdMAJqKv21
|
10
|
+
iVD8GfFDs12Hy08h7IxuA5ROVdBQS2OiU/6Vd4A3uVpzyjaxQsfAvkwz9+3jsozf
|
11
|
+
G+kWW+6Fxa3Vt4EbX+3afaBLeIyBlQvPd3pUY8irY3T6MHlglEblraxyGZ3ifvFu
|
12
|
+
Vt7S98D5+U4CMFzzGSzCCqMxTkgasTMhP8+PjXRN+mL56xyfw/uVmN9vRPqgbRUD
|
13
|
+
g95zx+CRFXgpUQ8yslpl+ECSqCe0cYxm+jWz00VFWtUZAwpE4REGOVdmNGrfNR16
|
14
|
+
h7dggpFVfeFy7qCwd9up/sWkBmkZB1zL9ENjg68EH5aEbh+jlbF6HuLv4+jibVlD
|
15
|
+
/r+ZW/vJgnMXmUYW1gDl3L//vQ/V4ElqRYzxsSVsq3dwW0SYzI31PKFEb8sqI5IN
|
16
|
+
P10MtFtZ1DgISF9I8LJ35dBDqguoonGC0/d+iq2S7ipcpFIo/u3tK/Nu0QvKMEN6
|
17
|
+
Dlx6Yhssscj2PhiADKjhRnweWUj/2eKuX8Cb6UmXvh+R4Dm0iEIGop1/r37GUo0z
|
18
|
+
nqNszrYZz1zd4GWG6puFWQIDAQABo4IBhDCCAYAwEgYDVR0TAQH/BAgwBgEB/wIB
|
19
|
+
ADAdBgNVHQ4EFgQUbYE39zhEfkdCe1al7Lt3ZyEJ9DwwHwYDVR0jBBgwFoAUYm23
|
20
|
+
kU/E6qNiYI+g0L61jwZ8aAAwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsG
|
21
|
+
AQUFBwMBBggrBgEFBQcDAjB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0
|
22
|
+
dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2Vy
|
23
|
+
dHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0UlNBNDA5NlJvb3RHNS5jcnQwQwYDVR0f
|
24
|
+
BDwwOjA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0UlNB
|
25
|
+
NDA5NlJvb3RHNS5jcmwwPQYDVR0gBDYwNDALBglghkgBhv1sAgEwBwYFZ4EMAQEw
|
26
|
+
CAYGZ4EMAQIBMAgGBmeBDAECAjAIBgZngQwBAgMwDQYJKoZIhvcNAQEMBQADggIB
|
27
|
+
AGHJE9aY60MSsfdEfqIcrdE0c1dXxis9E1l9at6g18Jpyc1C6PsUHdmo6rJWq8Xe
|
28
|
+
NNPkD/4fKhJsrd9TRlUlpIgKiJZW1ituKHV6Ghm7DIRSyx0aMpP9NJ3heV3CIgZr
|
29
|
+
MLtJEFuG5WfolWIfu7sle2lYjA3HxA/xQo803jGOhxbEDX/BTzHo/1X7YGvwpRqJ
|
30
|
+
+7J1B+2l+TA1r9vAlLfIDQRazVYRNxHpJDOwU0ffKaEPbRrgPtogO+8hLSml9Zoe
|
31
|
+
Y8w94f31XbvBFxSbSVpX+/QctNdwx2VuIoRcT8WZ0lZ9aenna5q5AE1C8oTtbw2T
|
32
|
+
qoz4NCaM5XPgjvb0DGPBeH8jWveNo1BmClQA2qYXL55f00m8AZ4Hf6oYANt/zbuM
|
33
|
+
QPhAoSHWwW4V4Pug3XPXM70LlY50y9kPD/57eHryhO2oXQLLx+l6mg8xzL6vKsHT
|
34
|
+
E30whFM32vVTpjejLZ9hJBAJURFaUrH2TZyAmoVbCNy50yuHYQ6FooYpbsbnpYPi
|
35
|
+
KW/E9bc201rqm/GQOWJ4zOJ8a5Etn3zY+rlPaxjJvxc3pSMfgtwwrm9KGXHsI1Gf
|
36
|
+
ULMwUbXclKV2qR8d6ECtUOIRxoQKutN85lmwB05yddu6uQQg0hHeaGFUk7EU90SV
|
37
|
+
ib/FA/op9sXfS3CkOnHQISY0JbWxrzC6eHaKeQi6lR1I
|
38
|
+
-----END CERTIFICATE-----
|
@@ -1,57 +1,36 @@
|
|
1
1
|
-----BEGIN CERTIFICATE-----
|
2
|
-
|
2
|
+
MIIGTjCCBTagAwIBAgIQBK55YGZmkBq5xX+mbFvczTANBgkqhkiG9w0BAQsFADBl
|
3
3
|
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
/
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
2XthJLcFgTO+y+1/IKnnpLKDfkx1YngWEBXEBP+MrrpDUKKs053s45/bI9QBPISA
|
37
|
-
tXgnYxMH9Glo6FWWd13TUq++OKGw1p1wazH64XK4MAf5y/lkmWXIWumNuO35ZqtB
|
38
|
-
ME3wJISwVHzHB2CQjlDklt+Mb0APEiIFIZflgu9JNBYzLdvUtxiz15FUZQI7SsYL
|
39
|
-
TfXOD1KBNMWqN8snG2e5gRAzB2D161DFvAZt8OiYUe+3QurNlTYVzeHv1ok6UqgM
|
40
|
-
ZcLzg8m801rRip0D7FCGvMCU/ktdAgMBAAGjggHPMIIByzAfBgNVHSMEGDAWgBQP
|
41
|
-
gGEcgjFh1S8o541GOLQs4cbZ4jAdBgNVHQ4EFgQUwldjw4Pb4HV+wxGZ7MSSRh+d
|
42
|
-
pm4wHQYDVR0RBBYwFIIJKi5jaGVmLmlvggdjaGVmLmlvMA4GA1UdDwEB/wQEAwIF
|
43
|
-
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwawYDVR0fBGQwYjAvoC2g
|
44
|
-
K4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NzY2Etc2hhMi1nMy5jcmwwL6At
|
45
|
-
oCuGKWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzMuY3JsMEIG
|
46
|
-
A1UdIAQ7MDkwNwYJYIZIAYb9bAEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3
|
47
|
-
LmRpZ2ljZXJ0LmNvbS9DUFMwfAYIKwYBBQUHAQEEcDBuMCQGCCsGAQUFBzABhhho
|
48
|
-
dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jYWNl
|
49
|
-
cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS5jcnQw
|
50
|
-
DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAvcTWenNuvvrhX2omm8LQ
|
51
|
-
zWOuu8jqpoflACwD4lOSZ4TgOe4pQGCjXq8aRBD5k+goqQrPVf9lHnelUHFQac0Q
|
52
|
-
5WT4YUmisUbF0S4uY5OGQymM52MvUWG4ODL4gaWhFvN+HAXrDPP/9iitsjV0QOnl
|
53
|
-
CDq7Q4/XYRYW3opu5nLLbfW6v4QvF5yzZagEACGs7Vt32p6l391UcU8f6wiB3uMD
|
54
|
-
eioCvjpv/+2YOUNlDPCM3uBubjUhHOwO817wBxXkzdk1OSRe4jzcw/uX6wL7birt
|
55
|
-
fbaSkpilvVX529pSzB2Lvi9xWOoGMM578dpQ0h3PwhmmvKhhCWP+pI05k3oSkYCP
|
56
|
-
ng==
|
4
|
+
d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
|
5
|
+
b3QgQ0EwHhcNMTMxMTA1MTIwMDAwWhcNMjgxMTA1MTIwMDAwWjBlMQswCQYDVQQG
|
6
|
+
EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
|
7
|
+
cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ0EwggEi
|
8
|
+
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc+BEjP2q178AneRstBYeiEEMx
|
9
|
+
3w7UFRtPd6Qizj6McPC+B47dJyq8AR22LArK3WlYH0HtagUf2mN4WR4iLCv4un7J
|
10
|
+
NTtW8R98Qn4lsCMZxkU41z1E+SB8YK4csFoYBL6PO/ep8JSapgxjSbZBF1NAMr1P
|
11
|
+
5lB6UB8lRejxia/N/17/UPPwFxH/vcWJ9b1iudj7jkUEhW2ZzcVITf0mqwI2Reo2
|
12
|
+
119q4hqCQQrc6dn1kReOxiGtODwT5h5/ZpzVTdlG2vbPUqd9OyTDtMFRNcab69Tv
|
13
|
+
fuR7A+FEvXoLN+BPy4KKDXEY5KbgiSwb87JzPMGwkp4Yfb2rfcV9CKEswp9zAgMB
|
14
|
+
AAGjggL4MIIC9DASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjA0
|
15
|
+
BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0
|
16
|
+
LmNvbTCBgQYDVR0fBHoweDA6oDigNoY0aHR0cDovL2NybDQuZGlnaWNlcnQuY29t
|
17
|
+
L0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNybDA6oDigNoY0aHR0cDovL2NybDMu
|
18
|
+
ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENBLmNybDAdBgNVHSUE
|
19
|
+
FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwggGzBgNVHSAEggGqMIIBpjCCAaIGCmCG
|
20
|
+
SAGG/WwAAgQwggGSMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5j
|
21
|
+
b20vQ1BTMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBm
|
22
|
+
ACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABp
|
23
|
+
AHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAg
|
24
|
+
AEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAg
|
25
|
+
AFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAg
|
26
|
+
AHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBu
|
27
|
+
AGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBp
|
28
|
+
AG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMB0GA1UdDgQWBBTnAiOAAE/Y
|
29
|
+
17yUC9k/dDlJMjyKeTAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAN
|
30
|
+
BgkqhkiG9w0BAQsFAAOCAQEATtSJJ7n9HYd3fg8oBZDxCi/JOz69k5yQxq/6kVGH
|
31
|
+
MlRr6MrBcVFcmY61+uBiGZmmB5p8Eyfb5QKihBLZFfYKRFfENI9tcx861qABPd7j
|
32
|
+
guRFa7LrJf2AXh05kL5bQvbOkWDj+aBWDEgQzjNoe82Tq/Bqy09YD7l7XRsEgZ6n
|
33
|
+
IuJXSSfukpMIvmkIUwI6Ll3IGfRQgE4C2bBdkbSTh/mWloFVQI5m7YLYuyhf7Uxh
|
34
|
+
7QZYKBlTEUS8RyApsgRs2IlUmTt122d4LB6SeMZVPVgSETJuvUMMTTTbe8ZC2+y+
|
35
|
+
q5thTAaS447fISpQVwTAYKI11SSeZjcJSc/V+GWz4OJuwg==
|
57
36
|
-----END CERTIFICATE-----
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|