chef 18.10.17 → 19.1.164

data/lib/chef/resource/selinux_permissive.rb

@@ -18,23 +18,24 @@ class Chef
     class SelinuxPermissive < Chef::Resource
       unified_mode true
 
-      provides :selinux_permissive
+      provides :selinux_permissive, target_mode: true
+      target_mode support: :full
 
       description "Use the **selinux_permissive** resource to allow some domains to misbehave without stopping them. This is not as good as setting specific policies, but better than disabling SELinux entirely."
       introduced "18.0"
       examples <<~DOC
-        **Disable enforcement on Apache**:
+      **Disable enforcement on Apache**:
 
-        ```ruby
-        selinux_permissive 'httpd_t' do
-          notifies :restart, 'service[httpd]'
-        end
-        ```
+      ```ruby
+      selinux_permissive 'httpd_t' do
+        notifies :restart, 'service[httpd]'
+      end
+      ```
       DOC
 
       property :context, String,
-        name_property: true,
-        description: "The SELinux context to permit."
+                name_property: true,
+                description: "The SELinux context to permit."
 
       action_class do
         def current_permissives

data/lib/chef/resource/selinux_port.rb

@@ -19,34 +19,35 @@ class Chef
     class SelinuxPort < Chef::Resource
       unified_mode true
 
-      provides :selinux_port
+      provides :selinux_port, target_mode: true
+      target_mode support: :full
 
       description "Use the **selinux_port** resource to assign a network port to a specific SELinux context. For example, running a web server on a non-standard port."
       introduced "18.0"
       examples <<~DOC
-        **Allow nginx/apache to bind to port 5678 by giving it the http_port_t context**:
+      **Allow nginx/apache to bind to port 5678 by giving it the http_port_t context**:
 
-        ```ruby
-        selinux_port '5678' do
-         protocol 'tcp'
-         secontext 'http_port_t'
-        end
-        ```
+      ```ruby
+      selinux_port '5678' do
+       protocol 'tcp'
+       secontext 'http_port_t'
+      end
+      ```
       DOC
 
       property :port, [Integer, String],
-        name_property: true,
-        regex: /^\d+$/,
-        description: "Port to modify."
+                name_property: true,
+                regex: /^\d+$/,
+                description: "Port to modify."
 
       property :protocol, String,
-        equal_to: %w{tcp udp},
-        required: %i{manage add modify},
-        description: "Protocol to modify."
+                equal_to: %w{tcp udp},
+                required: %i{manage add modify},
+                description: "Protocol to modify."
 
       property :secontext, String,
-        required: %i{manage add modify},
-        description: "SELinux context to assign to the port."
+                required: %i{manage add modify},
+                description: "SELinux context to assign to the port."
 
       action_class do
         include Chef::SELinux::CommonHelpers

data/lib/chef/resource/selinux_state.rb

@@ -19,53 +19,54 @@ class Chef
     class SelinuxState < Chef::Resource
       unified_mode true
 
-      provides :selinux_state
+      provides :selinux_state, target_mode: true
+      target_mode support: :full
 
       description "Use **selinux_state** resource to manages the SELinux state on the system. It does this by using the `setenforce` command and rendering the `/etc/selinux/config` file from a template."
       introduced "18.0"
       examples <<~DOC
-        **Set SELinux state to permissive**:
+      **Set SELinux state to permissive**:
 
-        ```ruby
-        selinux_state 'permissive' do
-          action :permissive
-        end
-        ```
+      ```ruby
+      selinux_state 'permissive' do
+        action :permissive
+      end
+      ```
 
-        **Set SELinux state to enforcing**:
+      **Set SELinux state to enforcing**:
 
-        ```ruby
-        selinux_state 'enforcing' do
-          action :enforcing
-        end
-        ```
+      ```ruby
+      selinux_state 'enforcing' do
+        action :enforcing
+      end
+      ```
 
-        **Set SELinux state to disabled**:
-        ```ruby
-        selinux_state 'disabled' do
-          action :disabled
-        end
-        ```
+      **Set SELinux state to disabled**:
+      ```ruby
+      selinux_state 'disabled' do
+        action :disabled
+      end
+      ```
       DOC
 
       default_action :nothing
 
       property :config_file, String,
-        default: "/etc/selinux/config",
-        description: "Path to SELinux config file on disk."
+                default: "/etc/selinux/config",
+                description: "Path to SELinux config file on disk."
 
       property :persistent, [true, false],
-        default: true,
-        description: "Set the status update in the SELinux configuration file."
+                default: true,
+                description: "Set the status update in the SELinux configuration file."
 
       property :policy, String,
-        default: lazy { default_policy_platform },
-        equal_to: %w{default minimum mls src strict targeted},
-        description: "SELinux policy type."
+                default: lazy { default_policy_platform },
+                equal_to: %w{default minimum mls src strict targeted},
+                description: "SELinux policy type."
 
       property :automatic_reboot, [true, false, Symbol],
-        default: false,
-        description: "Perform an automatic node reboot if required for state change."
+                default: false,
+                description: "Perform an automatic node reboot if required for state change."
 
       deprecated_property_alias "temporary", "persistent", "The temporary property was renamed persistent in the 4.0 release of this cookbook. Please update your cookbooks to use the new property name."
 

data/lib/chef/resource/selinux_user.rb

@@ -19,35 +19,36 @@ class Chef
     class SelinuxUser < Chef::Resource
       unified_mode true
 
-      provides :selinux_user
+      provides :selinux_user, target_mode: true
+      target_mode support: :full
 
       description "Use the **selinux_user** resource to add, update, or remove SELinux users."
       introduced "18.1"
       examples <<~DOC
-        **Manage test_u SELinux user with a level and range of s0 and roles sysadm_r and staff_r**:
+      **Manage test_u SELinux user with a level and range of s0 and roles sysadm_r and staff_r**:
 
-        ```ruby
-        selinux_user 'test_u' do
-          level 's0'
-          range 's0'
-          roles %w(sysadm_r staff_r)
-        end
-        ```
+      ```ruby
+      selinux_user 'test_u' do
+        level 's0'
+        range 's0'
+        roles %w(sysadm_r staff_r)
+      end
+      ```
       DOC
 
       property :user, String,
-        name_property: true,
-        description: "An optional property to set the SELinux user value if it differs from the resource block's name."
+                name_property: true,
+                description: "An optional property to set the SELinux user value if it differs from the resource block's name."
 
       property :level, String,
-        description: "MLS/MCS security level for the SELinux user."
+                description: "MLS/MCS security level for the SELinux user."
 
       property :range, String,
-        description: "MLS/MCS security range for the SELinux user."
+                description: "MLS/MCS security range for the SELinux user."
 
       property :roles, Array,
-        description: "Associated SELinux roles for the user.",
-        coerce: proc { |r| Array(r).sort }
+                description: "Associated SELinux roles for the user.",
+                coerce: proc { |r| Array(r).sort }
 
       load_current_value do |new_resource|
         users = shell_out!("semanage user -l").stdout.split("\n")

data/lib/chef/resource/service.rb

@@ -1,7 +1,7 @@
 #
 # Author:: AJ Christensen (<aj@hjksolutions.com>)
 # Author:: Tyler Cloke (<tyler@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -29,6 +29,9 @@ class Chef
       extend Chef::Platform::ServiceHelpers
 
       provides :service, target_mode: true
+      target_mode support: :full,
+        introduced: "15.1",
+        updated: "19.0"
 
       description "Use the **service** resource to manage a service."
 
@@ -38,8 +41,8 @@ class Chef
 
       # this is a poor API please do not re-use this pattern
       property :supports, Hash, default: { restart: nil, reload: nil, status: nil },
-        description: "A list of properties that controls how #{ChefUtils::Dist::Infra::PRODUCT} is to attempt to manage a service: :restart, :reload, :status. For :restart, the init script or other service provider can use a restart command; if :restart is not specified, the #{ChefUtils::Dist::Infra::CLIENT} attempts to stop and then start a service. For :reload, the init script or other service provider can use a reload command. For :status, the init script or other service provider can use a status command to determine if the service is running; if :status is not specified, the #{ChefUtils::Dist::Infra::CLIENT} attempts to match the service_name against the process table as a regular expression, unless a pattern is specified as a parameter property. Default value: { restart: false, reload: false, status: false } for all platforms (except for the Red Hat platform family, which defaults to { restart: false, reload: false, status: true }.)",
-        coerce: proc { |x| x.is_a?(Array) ? x.each_with_object({}) { |i, m| m[i] = true } : x }
+               description: "A list of properties that controls how #{ChefUtils::Dist::Infra::PRODUCT} is to attempt to manage a service: :restart, :reload, :status. For :restart, the init script or other service provider can use a restart command; if :restart is not specified, the #{ChefUtils::Dist::Infra::CLIENT} attempts to stop and then start a service. For :reload, the init script or other service provider can use a reload command. For :status, the init script or other service provider can use a status command to determine if the service is running; if :status is not specified, the #{ChefUtils::Dist::Infra::CLIENT} attempts to match the service_name against the process table as a regular expression, unless a pattern is specified as a parameter property. Default value: { restart: false, reload: false, status: false } for all platforms (except for the Red Hat platform family, which defaults to { restart: false, reload: false, status: true }.)",
+               coerce: proc { |x| x.is_a?(Array) ? x.each_with_object({}) { |i, m| m[i] = true } : x }
 
       property :service_name, String,
         description: "An optional property to set the service name if it differs from the resource block's name.",
@@ -117,9 +120,9 @@ class Chef
         description: "Debian platform only. The relative priority of the program for start and shutdown ordering. May be an integer or a Hash. An integer is used to define the start run levels; stop run levels are then 100-integer. A Hash is used to define values for specific run levels. For example, { 2 => [:start, 20], 3 => [:stop, 55] } will set a priority of twenty for run level two and a priority of fifty-five for run level three."
 
       property :timeout, Integer,
-        description: "The amount of time (in seconds) to wait before timing out.",
-        default: 900,
-        desired_state: false
+      description: "The amount of time (in seconds) to wait before timing out.",
+      default: 900,
+      desired_state: false
 
       property :parameters, Hash,
         description: "Upstart only: A hash of parameters to pass to the service command for use in the service definition."

data/lib/chef/resource/smartos_package.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Toomas Pelberg (<toomasp@gmx.net>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -22,8 +22,9 @@ class Chef
   class Resource
     class SmartosPackage < Chef::Resource::Package
 
-      provides :smartos_package
-      provides :package, platform_family: "smartos"
+      provides :smartos_package, target_mode: true
+      provides :package, platform_family: "smartos", target_mode: true
+      target_mode support: :full
 
       description "Use the **smartos_package** resource to manage packages for the SmartOS platform."
 

data/lib/chef/resource/snap_package.rb

@@ -1,6 +1,6 @@
 #
 # Author:: S.Cavallo (<smcavallo@hotmail.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -22,40 +22,49 @@ class Chef
   class Resource
     class SnapPackage < Chef::Resource::Package
 
-      provides :snap_package
+      provides :snap_package, target_mode: true
+      target_mode support: :full
 
-      description "Use the **snap_package** resource to manage snap packages on Debian and Ubuntu platforms."
+      description "Use the **snap_package** resource to manage snap packages on supported Linux distributions."
       introduced "15.0"
       examples <<~DOC
-        **Install a package**
+      **Install a package**
 
-        ```ruby
-        snap_package 'hello'
-        ```
+      ```ruby
+      snap_package 'hello'
+      ```
 
-        **Upgrade a package**
+      **Upgrade a package**
 
-        ```ruby
-        snap_package 'hello' do
-          action :upgrade
-        end
-        ```
+      ```ruby
+      snap_package 'hello' do
+        action :upgrade
+      end
+      ```
 
-        **Install a package with classic confinement**
+      **Install a package from a specific channel track**
 
-        ```ruby
-        snap_package 'hello' do
-          options 'classic'
-        end
-        ```
+      ```ruby
+      snap_package 'firefox' do
+        channel 'esr/stable'
+        action :upgrade
+      end
+      ```
+
+      **Install a package with classic confinement**
+
+      ```ruby
+      snap_package 'hello' do
+        options 'classic'
+      end
+      ```
       DOC
 
       allowed_actions :install, :upgrade, :remove, :purge
 
-      property :channel, String,
-        description: "The default channel. For example: stable.",
-        default: "stable",
-        equal_to: %w{edge beta candidate stable},
+      property :channel, [String, nil],
+        description: "The desired channel. For example: `latest/stable`. `latest/beta/fix-test-062`, or `0.x/edge`. If nil, the resource will install the snap's default version. See <https://snapcraft.io/docs/channels>.",
+        default: "latest/stable",
         desired_state: false
     end
   end

data/lib/chef/resource/solaris_package.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Toomas Pelberg (<toomasp@gmx.net>)
 # Author:: Prabhu Das (<prabhu.das@clogeny.com>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -23,7 +23,8 @@ class Chef
   class Resource
     class SolarisPackage < Chef::Resource::Package
 
-      provides :solaris_package
+      provides :solaris_package, target_mode: true
+      target_mode support: :full
 
       description "Use the **solaris_package** resource to manage packages on the Solaris platform."
 

data/lib/chef/resource/ssh_known_hosts_entry.rb

@@ -2,7 +2,7 @@
 # Author:: Seth Vargo (<sethvargo@gmail.com>)
 #
 # Copyright:: 2013-2018, Seth Vargo
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -24,24 +24,25 @@ class Chef
   class Resource
     class SshKnownHostsEntry < Chef::Resource
 
-      provides :ssh_known_hosts_entry
+      provides :ssh_known_hosts_entry, target_mode: true
+      target_mode support: :full
 
       description "Use the **ssh_known_hosts_entry** resource to add an entry for the specified host in /etc/ssh/ssh_known_hosts or a user's known hosts file if specified."
       introduced "14.3"
       examples <<~DOC
-        **Add a single entry for github.com with the key auto detected**
+      **Add a single entry for github.com with the key auto detected**
 
-        ```ruby
-        ssh_known_hosts_entry 'github.com'
-        ```
+      ```ruby
+      ssh_known_hosts_entry 'github.com'
+      ```
 
-        **Add a single entry with your own provided key**
+      **Add a single entry with your own provided key**
 
-        ```ruby
-        ssh_known_hosts_entry 'github.com' do
-          key 'node.example.com ssh-rsa ...'
-        end
-        ```
+      ```ruby
+      ssh_known_hosts_entry 'github.com' do
+        key 'node.example.com ssh-rsa ...'
+      end
+      ```
       DOC
 
       property :host, String,

data/lib/chef/resource/sudo.rb

@@ -4,7 +4,7 @@
 #
 # Copyright:: 2011-2018, Bryan w. Berry
 # Copyright:: 2012-2018, Seth Vargo
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2009-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -25,7 +25,8 @@ class Chef
   class Resource
     class Sudo < Chef::Resource
 
-      provides(:sudo) { true }
+      provides(:sudo, target_mode: true) { true }
+      target_mode support: :full
 
       description "Use the **sudo** resource to add or remove individual sudo entries using sudoers.d files." \
                   " Sudo version 1.7.2 or newer is required to use the sudo resource, as it relies on the" \
@@ -34,66 +35,66 @@ class Chef
                   " and RHEL (6+) all support this feature."
       introduced "14.0"
       examples <<~DOC
-        **Grant a user sudo privileges for any command**
+      **Grant a user sudo privileges for any command**
 
-        ```ruby
-        sudo 'admin' do
-          user 'admin'
-        end
-        ```
+      ```ruby
+      sudo 'admin' do
+        user 'admin'
+      end
+      ```
 
-        **Grant a user and groups sudo privileges for any command**
+      **Grant a user and groups sudo privileges for any command**
 
-        ```ruby
-        sudo 'admins' do
-          users 'bob'
-          groups 'sysadmins, superusers'
-        end
-        ```
+      ```ruby
+      sudo 'admins' do
+        users 'bob'
+        groups 'sysadmins, superusers'
+      end
+      ```
 
-        **Grant passwordless sudo privileges for specific commands**
+      **Grant passwordless sudo privileges for specific commands**
 
-        ```ruby
-        sudo 'passwordless-access' do
-          commands ['/bin/systemctl restart httpd', '/bin/systemctl restart mysql']
-          nopasswd true
-        end
-        ```
-
-        **Create command aliases and assign them to a group**
-
-        ```ruby
-        sudo 'webteam' do
-          command_aliases [
-            {
-              'name': 'WEBTEAM_SYSTEMD_JBOSS',
-              'command_list': [
-                '/usr/bin/systemctl start eap7-standalone.service',
-                '/usr/bin/systemctl start jbcs-httpd24-httpd.service', \
-                '/usr/bin/systemctl stop eap7-standalone.service', \
-                '/usr/bin/systemctl stop jbcs-httpd24-httpd.service', \
-                '/usr/bin/systemctl restart eap7-standalone.service', \
-                '/usr/bin/systemctl restart jbcs-httpd24-httpd.service', \
-                '/usr/bin/systemctl --full edit eap7-standalone.service', \
-                '/usr/bin/systemctl --full edit jbcs-httpd24-httpd.service', \
-                '/usr/bin/systemctl daemon-reload',
+      ```ruby
+      sudo 'passwordless-access' do
+        commands ['/bin/systemctl restart httpd', '/bin/systemctl restart mysql']
+        nopasswd true
+      end
+      ```
+
+      **Create command aliases and assign them to a group**
+
+      ```ruby
+      sudo 'webteam' do
+        command_aliases [
+          {
+            'name': 'WEBTEAM_SYSTEMD_JBOSS',
+            'command_list': [
+              '/usr/bin/systemctl start eap7-standalone.service',
+              '/usr/bin/systemctl start jbcs-httpd24-httpd.service', \
+              '/usr/bin/systemctl stop eap7-standalone.service', \
+              '/usr/bin/systemctl stop jbcs-httpd24-httpd.service', \
+              '/usr/bin/systemctl restart eap7-standalone.service', \
+              '/usr/bin/systemctl restart jbcs-httpd24-httpd.service', \
+              '/usr/bin/systemctl --full edit eap7-standalone.service', \
+              '/usr/bin/systemctl --full edit jbcs-httpd24-httpd.service', \
+              '/usr/bin/systemctl daemon-reload',
+            ]
+          },
+          {
+            'name': 'GENERIC_SYSTEMD',
+            'command_list': [
+              '/usr/sbin/systemctl list-unit-files',
+              '/usr/sbin/systemctl list-timers', \
+              '/usr/sbin/systemctl is-active *', \
+              '/usr/sbin/systemctl is-enabled *',
               ]
-            },
-            {
-              'name': 'GENERIC_SYSTEMD',
-              'command_list': [
-                '/usr/sbin/systemctl list-unit-files',
-                '/usr/sbin/systemctl list-timers', \
-                '/usr/sbin/systemctl is-active *', \
-                '/usr/sbin/systemctl is-enabled *',
-                ]
-            }
-          ]
-          nopasswd true
-          users '%webteam'
-          commands [ 'WEBTEAM_SYSTEMD_JBOSS', 'GENERIC_SYSTEMD' ]
-        end
-        ```
+          }
+        ]
+        nopasswd true
+        users '%webteam'
+        commands [ 'WEBTEAM_SYSTEMD_JBOSS', 'GENERIC_SYSTEMD' ]
+      end
+      ```
       DOC
 
       # According to the sudo man pages sudo will ignore files in an include dir that have a `.` or `~`
@@ -216,11 +217,11 @@ class Chef
         target = "#{new_resource.config_prefix}/sudoers.d/"
         directory(target)
 
-        Chef::Log.warn("#{new_resource.filename} will be rendered, but will not take effect because the #{new_resource.config_prefix}/sudoers config lacks the includedir directive that loads configs from #{new_resource.config_prefix}/sudoers.d/!") if ::File.readlines("#{new_resource.config_prefix}/sudoers").grep(/includedir/).empty?
+        Chef::Log.warn("#{new_resource.filename} will be rendered, but will not take effect because the #{new_resource.config_prefix}/sudoers config lacks the includedir directive that loads configs from #{new_resource.config_prefix}/sudoers.d/!") if ::TargetIO::File.readlines("#{new_resource.config_prefix}/sudoers").grep(/includedir/).empty?
         file_path = "#{target}#{new_resource.filename}"
 
         if new_resource.template
-          logger.trace("Template property provided, all other properties ignored.")
+          Chef::Log.trace("Template property provided, all other properties ignored.")
 
           template file_path do
             source new_resource.template
@@ -235,16 +236,16 @@ class Chef
             local true
             mode "0440"
             variables sudoer:            (new_resource.groups + new_resource.users).join(","),
-              host:               new_resource.host,
-              runas:              new_resource.runas,
-              nopasswd:           new_resource.nopasswd,
-              noexec:             new_resource.noexec,
-              commands:           new_resource.commands,
-              command_aliases:    new_resource.command_aliases,
-              defaults:           new_resource.defaults,
-              setenv:             new_resource.setenv,
-              env_keep_add:       new_resource.env_keep_add,
-              env_keep_subtract:  new_resource.env_keep_subtract
+                      host:               new_resource.host,
+                      runas:              new_resource.runas,
+                      nopasswd:           new_resource.nopasswd,
+                      noexec:             new_resource.noexec,
+                      commands:           new_resource.commands,
+                      command_aliases:    new_resource.command_aliases,
+                      defaults:           new_resource.defaults,
+                      setenv:             new_resource.setenv,
+                      env_keep_add:       new_resource.env_keep_add,
+                      env_keep_subtract:  new_resource.env_keep_subtract
             verify visudo_content(file_path) if visudo_present?
             action :create
           end
@@ -279,13 +280,13 @@ class Chef
         end
 
         def visudo_present?
-          return true if ::File.exist?(new_resource.visudo_binary)
+          return true if ::TargetIO::File.exist?(new_resource.visudo_binary)
 
           Chef::Log.warn("The visudo binary cannot be found at '#{new_resource.visudo_binary}'. Skipping sudoer file validation. If visudo is on this system you can specify the path using the 'visudo_binary' property.")
         end
 
         def visudo_content(path)
-          if ::File.exist?(path)
+          if ::TargetIO::File.exist?(path)
             "cat #{new_resource.config_prefix}/sudoers | #{new_resource.visudo_binary} -cf - && #{new_resource.visudo_binary} -cf %{path}"
           else
             "cat #{new_resource.config_prefix}/sudoers %{path} | #{new_resource.visudo_binary} -cf -"